The retention periods below are guidelines based on the type of record. This Data Retention Matrix should be read in conjunction with the Group’s Data Retention and Destruction Policy, which explains how this matrix should be used in order to assist the Group to comply with its data retention obligations under data protection laws. The retention periods should be aligned to/with the respective periods listed in the various data set inventories (also referred to as “Records of Processing Activities”). The following is an excerpt of our internal Data Retention and Destruction Policy Players Data Retention Periods - iGaming: Data Category Purpose Legal Ground Duration Start of the Period Where are these stored? Data Owner Transaction Data Tax & Accounting Legal Obligation Last Transaction Sensei, backoffice, Sisense, hive, redshift, s3, mysql(bdp- staging) Tech Account Registration Data (Including SVJ & RGIAJ calls, player or staff decisions impacting player accounts or payment methods) AML Legal Obligation NB: If includes tax relevant data, then 10 years for DE After closure of account or the time of reporting of unusual transaction Sensei, backoffice, Sisense, hive, redshift, s3, mysql(bdp- staging) Tech Identification & verification data (KYC, AML) (Other documentation and information obtained from trustworthy independent sources) AML Legal Obligation NB: If includes tax relevant data, then 10 years for DE. After closure of account or the time of reporting of unusual transaction Sensei, backoffice, Jumio, hive, redshift, s3, mysql(bdp- staging), Sisense Tech Notes on player’s account AML Legal Obligation After closure of account or the time of reporting of unusual transaction Sensei, backoffice, mysql(bdp- staging) Tech Gaming history AML & Player Protection Directive Legal Obligation After closure of account Sensei, backoffice, Sisense, hive, redshift, s3, mysql(bdp- staging) Tech Contracts To comply with contractual obligation Contractual Obligation NB: For ON - do not generally need to be retained except to the extent they pertain to the listed categories of information that must be retained in Section 20.2 of iGO’s AML Operational Guidance. After closure of account Confluence, Sugarsync Legal and Casino Operations Business correspondence & Player interaction AML Legal Obligation NB: For ON - do not generally need to be retained except to the extent they pertain to the listed categories of information that must be retained in Section 20.2 of iGO’s AML Operational Guidance. After closure of account Intercom, Google Mailboxes Tech Self- Exclusion data (Defined period) (including NSE & SE) Protection against gambling addiction Legal obligation From expiry of self- exclusion period Sensei, backoffice, hive, redshift, s3, Sisense Tech Self- Exclusion data (Indefinite period) (including NSE & SE) Protection against gambling addiction Legal obligation Immediate Sensei, backoffice, hive, redshift, s3, Sisense Tech Data regarding responsible gaming RG, AML Legal obligation From the moment of termination Sensei, backoffice, hive, redshift, s3, Sisense Tech Other Data Retention Periods: Data Category Purpose Legal Ground Duration Start of the Period Where are these stored? Data Owner CCTV footage Office Security Legal Obligation From the data of the footage Internal IT Internal IT Information, including logs, related to compliance with the law, the AGCO Standards and Requirements and/or adherence with control activities Licensing in Ontario Legal Obligation Immediate at creation of record Confluence Compliance & Legal Financial Records Retention Periods: Data Category Purpose Legal Ground Duration Start of the Period Where are these stored? Data Owner Tax and National Insurance Records Financial record keeping Legal obligation Immediate at creation of record Bamboohr and Dakar HR & Payroll Supplier and Consultants personal data (Name, Surname and IBAN number) Financial record keeping Legal obligation After termination of contract Financial systems: SUN, ERP - Unit4 Finance Payroll Calculation Financial record keeping Legal obligation Immediate at creation of record Dakar, Google Drive, Emails Finance & Payroll Procurement Records (includes supplier IBAN, supplier address, supplier details, supplier invoices, supplier agreements) Financial record keeping Legal obligation Immediate at creation of record Soft copies are saved on V: and hard copies are stored in cabinets in our office Agreements on Confluence Finance & Legal Accounting Records Financial record keeping Legal obligation Immediate at creation of record Soft copies are saved on V: and hard copies are stored in cabinets in our office Finance Inventory Records Financial record keeping Legal obligation Immediate at creation of record We don't store this Yearly Financial Statements Financial record keeping Legal obligation Immediate at creation of record Soft copies are saved on V: and hard copies are stored in cabinets in our office. Finance HR Data Retention Periods: Data Item Duration (as per below except for ES as it should be 4 years) Reason Where are these stored? Owner Name & Surname (including preferred name) Cap. 594 requires every employer to provide to Jobsplus a list of employees who were in his employ at any given time as required by the Corporation. No time limit specified by law. S.L. 452.83 states it shall be the duty of the employer to furnish the Director for Employment and Industrial Relations (DIER) with any information which the Director may request. No time limit specified by law. BambooHR, Engagedly Employee Experience Residential Address Cap. 594 requires every employer to provide to Jobsplus a list of employees who were in his employ at any given time as required by the Corporation. No time limit specified by law. S.L. 452.83 states it shall be the duty of the employer to furnish the Director for Employment and Industrial Relations (DIER) with any information which the Director may request. No time limit specified by law. BambooHR Employee Experience Email addresses (personal + work) Business Legitimate Interest BambooHR, Engagedly Employee Experience Telephone (personal mobile + work mobile) (DO NOT RETAIN HOME NUMBER) Business Legitimate Interest BambooHR Employee Experience D.O.B Cap. 594 requires every employer to provide to Jobsplus a list of employees who were in his employ at any given time as required by the Corporation. No time limit specified by law. S.L. 452.83 states it shall be the duty of the employer to furnish the Director for Employment and Industrial Relations (DIER) with any information which the Director may request. No time limit specified by law. BambooHR Employee Experience Nationality/ Citizenship Cap. 594 provides that offences under the Act are barred by prescription of six years. Since employing someone without a permit is an offence under the Act, proof of nationality (lack of need of permit) required for six years. BambooHR Employee Experience Bank Account Details Business Legitimate Interest BambooHR Employee Experience National Insurance and Social Security Number CIR has eight years to raise assessment, and eight further years to claim payment. BambooHR Employee Experience Tax Number CIR has eight years to raise assessment, and eight further years to claim payment. BambooHR Employee Experience Health (accident & incident reports; maternity risk assessments; workstation assessments) NB: If there are employees in DE, this should be regularly 6 years, however no longer than 10 years after the termination or resignation of the employees in DE Cap 424 contains a prescriptive period of six years for health and safety offences. BambooHR Employee Experience Images/ Employee Photos + photo/video consent Business Legitimate Interest BambooHR Employee Experience ID Card Number (do not retain a scan of front and back in the documents) Cap. 594 requires every employer to provide to Jobsplus a list of employees who were in his employ at any given time as required by the Corporation. No time limit specified by law. S.L. 452.83 states it shall be the duty of the employer to furnish the Director for Employment and Industrial Relations (DIER) with any information which the Director may request. No time limit specified by law. BambooHR Employee Experience Passport Cap 594 provides that offences under the Act are barred by prescription of six years. Since employing someone without a permit is an offence under the Act, proof of nationality (lack of need of permit) required for six years. BambooHR Employee Experience Education/Training Cap 16 provides that most civil suits must be filed within a maximum of five years. It may be necessary to prove the competence of an employee to defend a civil suit, and therefore keeping this information for five years is justified. BambooHR Employee Experience Signed Employment Contract Cap 16 provides that most civil suits must be filed within a maximum of five years. It may be necessary to prove the competence of an employee to defend a civil suit, and therefore keeping this information for five years is justified. BambooHR Employee Experience CVs of employee Cap 16 provides that most civil suits must be filed within a maximum of five years. It may be necessary to prove the competence of an employee to defend a civil suit, and therefore keeping this information for five years is justified. BambooHR Employee Experience CVs of persons who were not employed (including any other applicant data) Claim can be brought by prospective employee until 4 months after being informed of non- selection. CVs to be discarded after 6 months unless consent to hold further is available. BambooHR Employee Experience Reference details (Name, Surname, title, contact number, and email address) Cap 16 provides that most civil suits must be filed within a maximum of five years. It may be necessary to prove the competence of an employee to defend a civil suit, and therefore keeping this information for five years is justified. BambooHR Employee Experience Annual Appraisals Cap 16 provides that most civil suits must be filed within a maximum of five years. It may be necessary to prove the competence of an employee to defend a civil suit, and therefore keeping this information for five years is justified. BambooHR, Engagedly Employee Experience Employee Status CIR has eight years to raise assessment, and eight further years to claim payment. BambooHR Employee Experience Work Permit Cap. 594 provides that offences under the Act are barred by prescription of six years. Since employing someone without a permit is an offence under the Act, work permit to be retained for six years. BambooHR Employee Experience Injury on Duty Reports Cap 424 contains a prescriptive period of six years for health and safety offences. BambooHR Employee Experience Written Warnings Cap 16 provides that most civil suits must be filed within a maximum of five years. It may be necessary to prove the competence of an employee to defend a civil suit, and therefore keeping this information for five years is justified. BambooHR Employee Experience Sick Leave Certificates Business Legitimate Interest Until the age of 75, after which they are to be destroyed - based on work- related long-term illness. BambooHR Employee Experience Vacation Leave Cards/Data After which they are to be destroyed BambooHR Employee Experience T-shirt/hoodie size BambooHR Employee Experience Job Plus Employment and termination documents BambooHR Employee Experience FS3 financial statements and FS4 tax documents 8+8 years from termination or resignation as CIR has eight years to raise assessment, and eight further years to claim payment. BambooHR Employee Experience Compensation (Effective date, pay rate, pay type, pay schedule) Such records (in the HR system) should be kept for a period of 5 years in line with the prescriptive periods allowed under civil law in Malta. On the other hand, similar detailed data within the payroll system should be kept for a period of 10 years in order to fulfil obligations under the Companies Act. BambooHR Employee Experience Allowances (Date, allowance type, amount, comment) Such records (in the HR system) should be kept for a period of 5 years in line with the prescriptive periods allowed under civil law in Malta. On the other hand, similar detailed data within the payroll system should be kept for a period of 10 years in order to fulfil obligations under the Companies Act. BambooHR Employee Experience Emergency contacts (name, relationship, phone, email, address) BambooHR Employee Experience Time off balance Time taken for vacation, sick, study etc, then this data (in detail, dates, days etc) could be retained for a period of 2.5 years after termination of employment. However, the Company may then aggregate the data to retain as statistics (without being able to refer back to the individual) which may be kept indefinitely. BambooHR Employee Experience Last Payslip or FS3 from previous employment Payslips are required to calculate the tax for the first payment. BambooHR Employee Experience Police conduct (To be retained only for selected employees) To retain only for legal, directors and key function holders until expired in order to respond to DD requests. BambooHR Employee Experience Data Retention Schedule
Schedule 1 – Record Retention Schedule Guideline Retention Periods
Section A
Version: 1.5
Last updated: 27/11/24
