Data Retention & Disposal Policy

Lekhan Kala

Effective Date: 3 August 2026
Review Cycle: Every Two Years

Data Retention & Disposal Policy

1. Introduction

LekhanKala.org (“LekhanKala,” “we,” “our,” or “us”) is committed to responsibly managing personal information throughout its lifecycle. This policy sets out our principles and procedures for retaining, reviewing, archiving, and securely disposing of personal data and organizational records.

Proper data retention promotes transparency, accountability, legal compliance, operational efficiency, and privacy protection. Secure disposal reduces risks of unauthorized access, data breaches, and unnecessary data accumulation.

This policy supplements LekhanKala’s Privacy Policy, Data Protection Policy, Information Security Policy, Child Safeguarding Policy, and all relevant data protection regulations, including the General Data Protection Regulation (GDPR) where applicable.

2. Purpose

The purpose of this policy is to:
* Protect the privacy and rights of individuals whose information we process.
* Ensure personal data is retained only for legitimate organizational purposes.
* Comply with legal, contractual, regulatory, and donor requirements.
* Promote responsible information management.
* Reduce cybersecurity and privacy risks associated with excessive data retention.
* Establish secure methods for archiving and disposing of information.
* Ensure consistent record management across the organization.

3. Scope

This policy applies to all information managed by LekhanKala, including data relating to:
* Website visitors
* Students
* Teachers
* Parents and guardians
* Volunteers
* Members
* Donors
* Staff
* Board members
* Consultants
* Contractors
* Partners
* Event participants
* Applicants
* Newsletter subscribers
* Research participants
* Vendors and service providers

It covers information stored in:
* Paper records
* Electronic files
* Databases
* Email systems
* Cloud storage
* Mobile devices
* External storage media
* Audio, photographs, and videos
* Backup systems

4. Guiding Principles

LekhanKala manages information according to the following principles:

* Collect only the information necessary for legitimate purposes.
* Retain information only for as long as required.
* Protect information throughout its lifecycle.
* Dispose of information securely when no longer needed.
* Maintain transparency regarding retention practices.
* Comply with applicable legal obligations.
* Respect the rights of data subjects.

5. Types of Records

Records maintained by LekhanKala may include:
Governance Records
* Board meeting minutes
* Policies
* Strategic plans
* Annual reports
* Legal registrations

Administrative Records
* Internal communications
* Operational documents
* Procurement records
* Contracts
* Asset registers

Financial Records
* Accounting documents
* Invoices
* Receipts
* Audit reports
* Bank records
* Grant documentation

Human Resources Records
* Employment records
* Volunteer files
* Recruitment documents
* Training records
* Performance records

Programme Records
* Workshop registrations
* Attendance sheets
* Applications
* Certificates
* Monitoring and evaluation reports
* Creative writing submissions

Communications Records
* Email correspondence
* Website inquiries
* Media requests
* Newsletters
* Social media records

Website Data
* Website logs
* Cookie records
* Analytics information
* Contact forms

6. Data Retention Principles

Personal information shall be retained only for as long as necessary to:
* Deliver organizational programs.
* Fulfill contractual obligations.
* Meet legal and regulatory requirements.
* Complete financial reporting.
* Respond to audits.
* Protect organizational interests.
* Resolve disputes.
* Exercise or defend legal claims.
* Preserve historically significant organizational records.

When these purposes no longer exist, the organization will securely dispose of or anonymize the information.

7. Retention Schedule

The following retention periods serve as general organizational guidelines.
Record Type Recommended Retention
Website inquiries Up to 2 years
Newsletter subscriptions Until the user unsubscribes
Contact forms Up to 2 years
Volunteer applications Up to 3 years
Membership records Duration of membership plus 3 years
Event registrations: Up to 3 years
Program participation records: Up to 5 years
Certificates issued: Permanent verification record where appropriate
Financial records: Minimum 7 years or longer if required by law
Grant and donor records: Minimum 7 years after project completion
Contracts: 7 years after expiry
Employment records: As required by applicable law
Child safeguarding records: In accordance with safeguarding requirements and legal obligations
Board meeting minutes: Permanent
Organizational policies: Permanent historical archive
Website analytics: Typically 12–26 months, depending on system configuration
Security logs: 12–24 months unless needed for investigations

Retention periods may be extended where required by law, litigation, audits, donor agreements, or regulatory investigations.

8. Data Review

Information shall be reviewed periodically to determine whether it:
* Remains necessary.
* Is accurate and up to date.
* Requires correction.
* Should be archived.
* Should be securely deleted.

Regular reviews help ensure compliance with data minimization principles.

9. Secure Storage

During the retention period, records shall be protected through appropriate safeguards, including:
* Password protection
* Multi-factor authentication
* Role-based access controls
* Encryption where appropriate
* Secure cloud storage
* Locked filing cabinets for physical records
* Secure backup systems
* Regular security monitoring

Only authorized personnel may access retained information.

10. Secure Disposal

When information reaches the end of its retention period, dispose of it securely to prevent unauthorized access or recovery.

Physical Records
Paper records containing confidential information shall be:
* Cross-cut shredded
* Pulped
* Incinerated by authorized providers where appropriate
* Destroyed using secure document destruction services

Electronic Records
Electronic information shall be securely destroyed using appropriate methods, including:
* Permanent deletion
* Secure overwrite procedures
* Cryptographic erasure where applicable
* Secure destruction of storage media
* Certified disposal by authorized vendors when equipment is retired

Deleting a file without secure erasure may not permanently remove the information.

11. Archiving

Some records have enduring administrative, legal, historical, or educational value. Such records may be archived securely for:
* Institutional history
* Research
* Legal compliance
* Organizational memory
* Historical publications

Archived records remain protected under the same security standards as active records.

12. Children’s Information

Information relating to children and young people receives enhanced protection. Retention and disposal decisions involving children’s information shall:
* Follow child safeguarding requirements.
* Respect applicable legal obligations.
* Limit access to authorized personnel.
* Ensure secure destruction when no longer required.

13. Data Subject Rights

Individuals may request:
* Access to their personal information.
* Correction of inaccurate information.
* Deletion where legally permissible.
* Restriction of processing.
* Data portability where applicable.
* Withdrawal of consent where processing is based on consent.

Requests will be handled in accordance with applicable privacy legislation and LekhanKala’s Privacy Policy.

14. Legal Holds

Where information becomes relevant to:
* Litigation
* Regulatory investigations
* Government inquiries
* Audits
* Law enforcement requests

Suspend routine disposal until the matter is resolved.

15. Roles and Responsibilities

Board of Directors
Responsible for oversight of information governance.

Executive Director
Responsible for ensuring implementation of this policy across the organization.

Staff and Volunteers
Responsible for:
* Following retention schedules.
* Protecting confidential information.
* Reporting data risks.
* Securely handling organizational records.

Technology and Service Providers
Third-party providers processing information on behalf of LekhanKala must maintain appropriate retention, security, and disposal practices consistent with contractual and legal obligations.

16. Policy Review

This policy shall be reviewed at least every two years or sooner if required due to:
* Legislative changes
* Regulatory updates
* Technological developments
* Organizational restructuring
* Security incidents
* Operational improvements

17. Contact Us

For questions about this Data Retention & Disposal Policy or requests related to personal information, please contact:

LekhanKala.org
Kathmandu, Nepal
Email: info@lekhankala.org
Website: https://lekhankala.org

Our Commitment

LekhanKala.org is committed to retaining information only as long as it serves a legitimate purpose and disposing of it securely, responsibly, and transparently.

Through sound data retention and disposal practices, we protect privacy, strengthen cybersecurity, comply with legal obligations, and maintain the trust of our students, educators, volunteers, partners, donors, and the wider community.