Data Retention and Classification Policy

elikemdodor

 

1.0       Executive Summary

The purpose of this Policy is to establish requirements for the retention and disposal of JMP's records and to define how those records are classified and handled based on their sensitivity. This Policy is designed to prevent premature or tardy destruction of records. Premature destruction could result in loss of valuable information, compliance risk, and possible legal implications. Tardy destruction could result in excessive costs to store, maintain, and retrieve records which no longer serve a useful business purpose, as well as legal implications for having out-of-date information on hand.  Retention periods are determined based on business necessity and legal/regulatory requirements.

 

2.0       Scope

This procedure is maintained and administered by the Legal Department and it applies to all JMP Statistical Discovery LLC (“JMP”) employees.

 

3.0        Definitions  

3.1       Record(s).  “Records” means any information, data, content, or material created, received, collected, processed, or maintained by or on behalf of JMP in the course of business, in any format or medium and in any location. Records also include system-generated data and telemetry (for example, audit logs and access logs) required for legal, regulatory, security, or business purposes Examples include documents, emails, messages, chats, contracts, spreadsheets, presentations, drawings, designs, source code, databases and data sets, logs, audio or video files, images, webpages, calendar entries, task lists, notes, forms, surveys, transaction records, invoices, receipts, financial statements, HR files, training materials, marketing assets, product and research materials, legal and compliance files, audit trails, and related metadata.

 

Records cover items stored or sent using company-managed systems and company-approved third-party services and collaboration tools (such as cloud storage, SaaS apps, messaging platforms, code repositories, customer support systems, and productivity suites), whether accessed on web, desktop, or mobile. 

 

4.0        Data Retention Policy

4.1     Once a retention period has expired, all hard-copy records should be discarded by shredding and all electronic and system records should be purged and deleted. In the event a Record does not fall under one of the appendices attached, retention periods should be developed and documented in accordance with the SAS Records Retention and Disposal Schedule Standard.

4.2       JMP has implemented the retention periods for Microsoft Office 365 products such as Outlook, Teams, and SharePoint. Data housed in Microsoft Office 365 is subject to removal based on its last modified date. The retention periods in Appendix A are applied uniformly across all of SAS, JMP, and IDeaS.

4.3       Salesforce Records will be maintained and disposed of in accordance with the Retention Schedule in Appendix B.

4.4       Records in DocuSign CLM will be maintained and disposed of in accordance with the Retention Schedule in Appendix C.

4.5       Human Resources Records will be maintained and disposed of in accordance with the Retention Schedule in Appendix D.  Human Resources retains and destroys personnel records in accordance with SAS’ corporate policies on business records retention, as well as federal and state laws governing record retention.  This information is for the purpose of aiding Human Resources employees in understanding their obligations in retaining electronic documents - including e-mail, web files, text files, sound and movie files, PDF documents, and all Microsoft Office, or other formatted files. 

4.6       Finance and Procurement Records, including those stored in financial software (e.g., Zip, Magento, and NetSuite), will be maintained and disposed of in accordance with the Retention Schedule in Appendix E.  Unless otherwise specified, all retention periods begin on December 31 of the year of contract completion, lease termination, employment termination, asset disposal, or investment sale, etc. and shall apply unless a longer period is required pursuant to the express terms of such contract, lease, etc. or otherwise required by law (i.e., litigation hold).  It is the responsibility of each finance manager to ensure compliance with this Policy. Each finance manager should coordinate with their IT department representative to ensure electronic and system records are purged and disposed of in accordance with this Policy. Finance shall work with each of our vendors to ensure compliance with this Policy. Examples of external service providers include, but is not limited to: outsourced payroll providers, credit card application companies, and financial institutions.  Once the retention period has expired, all hard-copy records should be discarded by shredding and all electronic and system records should be purged and deleted. The target completion for discarding records is the end of the second calendar quarter of each year. The Finance Senior Director is responsible for ensuring compliance.

4.7 Marketing Records will be maintained and disposed of in accordance with the Retention Schedule in Appendix F.

 

5.0        Data Classification

5.1       This section applies to all Records owned, collected, used, shared or processed by JMP, including those stored in or processed through third-party platforms (e.g., Microsoft Office 365, Salesforce, and DocuSign), regardless of format or medium. All Records must be classified and handled according to their sensitivity level and all applicable legal, regulatory and contractual obligations.

5.2       JMP adopts and incorporates by reference the SAS Data Classification and Handling Policy (“SAS DCH Policy”), as it may be amended from time to time; any updates to that policy are automatically incorporated and apply to JMP upon publication. This ensures consistent classification and handling of JMP Records in alignment with SAS standards. For clarity, JMP personnel (employees, contractors and other authorized users) are considered “SAS Associates” for purposes of the SAS DCH Policy and are fully subject to its requirements.

5.3       JMP personnel must determine the appropriate classification level for the Records they handle using Table 1, Data Classification Definitions, Technical

Controls, and Examples (“SAS Table 1”), in the SAS DCH Policy. Appendix G provides JMP-specific examples to illustrate how common JMP Record types align with those classification levels. These examples are intended to supplement, not replace, the examples in SAS Table 1.

5.4       All Records containing personally identifiable information are regarded as “confidential and proprietary” under the SAS’ Use and Disclosure of Confidential and Proprietary Information Policy. All use, disclosure, and destruction of these Records must be in accordance with such policy. Access to such information is only allowed on a need-to-know basis and consistent with the terms of any nondisclosure agreement or other contractual protection.

 

6.0        Compliance

6.1 Failure to comply with this Policy can result in disciplinary action, up to and including termination, as outlined in the SAS’ Global Conduct Policy.

 

7.0       Litigation Hold

7.1       In some cases, such as when JMP is involved in actual or potential litigation, the JMP Legal Department may impose a “legal hold” on specific records, even if standard retention rules suggest that the data can be disposed of. When a legal hold conflicts with a defined disposal period, the affected records should be retained. Under no circumstances should any record or document be hidden, altered, or destroyed with the intent to obstruct an investigation or litigation.

Appendix A Microsoft 365

Record Type	Retention Schedule
Outlook: Email, Calendar, To Do, Tasks, Notes, User and Shared/Generic Mailboxes Contacts not affected by retention policies	3.0 years
Teams: Channel Posts These are the messages posed in a Teams channel.	3.0 years
Teams: Chat Messages These are the messages in your “Chat” icon.	180 days
Teams: Inactive Team Expiration Any change or update to a Team constitutes an activity.	1.0 years
Teams: Meeting Recordings Only New Meeting Recordings are affected after date determined by Microsoft.	60 days
SharePoint: Files, Folders, List Items, etc. Teams Backend is SharePoint (Wikis, Files, Channel Messages).	3.0 years
OneDrive for Business: Files, Folders, etc.	3.0 years
OneNote	3.0 years
O365 Groups	3.0 years

 

Exemption Procedures

Business units requiring longer retention periods than shown in the above table may apply preapproved exemption labels to their Microsoft Office 365 Documents that meet valid business requirements for exemption. The pre-approved exemption periods for Microsoft Office 365 content are as follows:

• 5-year label
• 7-year label
• 10-year label
• 15-year label
• 50-year label

Appendix B Salesforce Records

Record Type	Retention Schedule	Start of Retention Period	Disposition Method	Owner
Accounts	10 years	End date of most current associated contract or close date of most recent associated opportunity	Delete	Sales / Business Operations
Contacts	10 years	Current customer: end date of most recent software authorization or contract. Prospective customer: last activity date or last log-in to My JMP	Delete	Sales
Leads	5 years	Last activity	Delete	Marketing / Sales
Opportunities	10 years	Close date	Delete	Sales / Business Operations
Cases	10 years	Close date	Delete	Tech Support
Quotes	10 years	End date	Delete	Sales / Business Operations
Sales Orders	10 years	End date	Delete	Sales / Business Operations
Contracts	10 years	End date of most current associated contract or close date of most recent associated opportunity.	Delete	Business Operations
Contact Software Authorization	10 years	End date of associated contract	Delete	User Enablement
Record Type	Retention Schedule	Start of Retention Period	Disposition Method	Owner
Software Authorization	10 years	End date of associated contract	Delete	User Enablement
User Records	2 years	De-activation date, last login date, and active checkbox unchecked	Anonymize	Digital Ops (Salesforce team)
Community Users	10 years	De-activation date, last login date, and active checkbox unchecked	Anonymize	User Enablement
Amazon Voice	1 year	Creation Date	Delete	User Enablement
OwnBackup	3 years	Creation Date	Delete	Digital Ops
All other records	5 years	Last modified date	Delete	Digital Ops

 

Appendix C DocuSign CLM

Record Type/Folder	Retention Schedule	Beginning of Retention Period
Salesforce (executed customer contracts)	12 years	Inactive Date
Customer Contracts	12 years	Inactive Date
Customer Drafts	1 year	Last Modified Date
NDA Drafts	1 year	Last Modified Date
NDA Signed	25 years	Creation Date
Toolbox Archives	15 years	Last Modified Date
Toolbox	Permanent	Permanent
Corporate	15 years	Last Modified Date
Compliance & Human Resources	See subfolders	See subfolders
Anti-Corruption	Permanent	Permanent
Audits/Reviews/Investigations	Permanent	Permanent
Public ECCN Chart	Permanent	Permanent
Employment/Human Resources	Permanent	Permanent
Compliance	15 years	Last Modified Date
Privacy	15 years	Last Modified Date
Business Operations & Legal Communication	12 years	Last Modified Date
Government Affairs	15 years	Last Modified Date
Individual Workspace	15 years	Last Modified Date
Research Fellowship Agreements	12 years	Inactive Date
Sole Source Letters	12 years	Inactive Date
Vendor Contracts	12 years	Inactive Date

*Inactive Data is the date the license agreement terminates or expires. This date will be pulled from Salesforce and automatically updated when an agreement is renewed (either by customer's payment of an invoice or by amendment). 

Appendix D Human Resources Records*

 

Record Type	Retention Schedule
Personnel File
Hiring and recruiting records including background checks, promotion, demotion, transfer, layoff/termination records, Ads or notices relating to job openings, training programs, promotions, or overtime work opportunities	End date of employment plus five (5) Years
Rates of pay, terms of compensation
Employment inquiry records, including resumes, applications, and interview notes
Selection for training or “apprenticeship”
Requests for reasonable accommodation (ADA only)
Job orders submitted to employment agency or labor organization
Employment contracts and collective bargaining agreements
Copies of: employee benefit plans, seniority systems, and merit systems
Records of those involuntarily terminated
Records relating to complaints, compliance reviews, enforcement actions
Employment Records
Hiring and recruitment records including employment inquiry records, applications, interview notes, applicant flow records, table of referrals and placements, job or status change, test papers completed by candidates	Two (2) years after adverse impact has been eliminated
Agreements, plans, notices, certificates	Three (3) years from last effective date
I-9 forms	Three (3) years after date of hire OR 1 year after date of individual’s termination if later
Apprenticeship records under EEOC regulations, including Title VII, ADA, and GINA	Two (2) years from date application was received OR period of selected applicant’s apprenticeship (if EEOC requires annual report) if later
Employee genetic information records under GINA	No specified retention period, but this information should be treated as a confidential medical record as regulated under the ADA

 

Federal Contractor Records
Hiring, recruitment, and personnel records	Two (2) years from date the record was made or the date the personnel action occurred if later
Payroll Records including timecards, wage rates, wage additions and deductions, and basis for sexual differences in wage if relevant.
Medical Records
Benefit plans, seniority and merit systems
E-Verify documentation	Three (3) years after date of hire OR 1 year after date of individual’s termination if later
Hiring/selection process validation records	Six (6) years after: (1) expiration of qualifying $50,000 contract, or (2) discontinuance of selection process to which validation evidence relates, whichever occurs first
Affirmative action program outreach, data, and analysis records	Three (3) years from record creation
Payroll Records
Payroll or other records containing employee data, including name, address, DOB, sex and occupation, hourly schedule, wage info (rate of pay, total each pay period, daily/weekly earnings, overtime hours, etc.)	Duration of employment plus five (5) years
Records relating to the payment of wages, including job descriptions, job evaluations, merit and/or seniority systems, CBAs, description of practices with explanation of basis for wage differential of employees of opposite sex.
Sales and purchase records	Three (3) years
Employee leave details, leave and benefits policy documents, etc.	Three (3) years from the last date of entry
Records used as the basis for wage computations	Two (2) years from date of last entry or last effective date
Employee Benefits Records
Reporting and disclosure records under ERISA	Seven (7) years after filing
Benefits determination records under ERISA	Seven (7) years after a participant’s benefit determination and payment
Benefit plans and seniority and merit systems under the ADEA	Full period the plan/system is in effect AND for at least one (1) year after termination of plan/system
Documents relating to HIPAA privacy records	Six (6) years from date of the record’s creation OR the date when it last was in effect if later

 

COBRA records	Six (6) years from the date COBRA notice is given
Medical or Exposure Records
Medical Records	Three (3) years from the last date of entry
Logs, incident report forms, etc.	Five (5) years following the end of the year to which they relate.
Employee exposure records, analyses using exposure or medical records	Thirty (30) years (with exceptions)
Employee medical records under OSHA	Duration of employment plus thirty (30) years

*These records are currently all maintained by SAS Institute Inc. 

Appendix E Finance Records

Record Type	Retention Schedule
Accounts Payable reports, analysis files, original documents	7.0 years
Accounts Receivable reports, analysis files, original documents	7.0 years
Annual budgets and financial plans	7.0 years
Annual financial statements, reports, trial balances	Permanent
Audit reports (external, internal)	Permanent
Bank Statements and cancelled checks	7.0 years
Employee expense reports	7.0 years
General Ledgers (transaction details)	7.0 years
Interim Financial Statements	7.0 years
Internal Audit work papers and findings	7.0 years
Investment records	7.0 years
Payroll forms and payroll tax returns	7.0 years
System Records (Records residing within a financial system) – Master data	Permanent
System Records (Records residing within a financial system) – Transactional data and uploaded electronic files	7.0 years
Tax audit records	Permanent
Tax bills, receipts, statements	7.0 years
Tax returns – Income, Franchise, Property, Sales	Permanent
Tax – Exemption documents	Permanent
All other records	7.0 years

 

Appendix F Marketing Records

Record Type	Retention Schedule
Brand and Awareness Examples: Brand Guidelines, Brand Campaigns, Flagship Events, and more.	5.0 years
Company and Validation Examples: Data for Good, Company overview, Trust Center, Careers, Customers, Contact Us, Legal, Analyst Viewpoints, Podcasts, Speaker Bureaus, Partners, Communications, Press Releases, and more.	5.0 years
Products, Solutions, and Industry Examples: Industry, Product, Solutions, Trials, Demos, White Papers, eBooks, Events, Webinars, and more.	5.0 years
Engagement Examples: Education, Training, Certification, Learn, Support, Blogs and more.	5.0 years
Internal Assets Examples: Town Halls, Company Events, Company History, Recognition and promotions, Competitive Intelligence Content, Inside JMP and more.	5.0 years
Company History	Permanent – selected by Marketing Leadership Team

 

Appendix G

These JMP-specific examples help JMP personnel more easily identify how common JMP Records map to existing data classification levels. They do not replace the SAS DCH Policy or SAS Table 1. If there is any conflict between this appendix and the SAS policy, the SAS policy controls.

 

 

POL-LGL-00003 Data Retention and Classification Policy v2 (06_30_2026).docx.pdf