1. Purpose
This policy defines how Murzo Group retains, preserves, and disposes of business records and information in a lawful, consistent, and defensible manner.
Its objectives are to ensure compliance with legal, regulatory, and contractual obligations, protect Murzo Group in the event of disputes, investigations, or audits, prevent unnecessary data accumulation and risk exposure, and establish clear procedures for legal holds.
2. Scope
This policy applies to:
- All records created, received, or maintained by Murzo Group
- Digital, physical, and hybrid records
- Structured and unstructured data
- Employees, contractors, and authorised third parties
This includes records stored on internal systems, client platforms, cloud services, and physical media and documentation.
3. Definition of Records
For the purposes of this policy, “records” include but are not limited to:
- Contracts and agreements
- Client communications and project documentation
- Financial, accounting, and tax records
- Design files, technical documentation, and research outputs
- Emails, messages, and correspondence relating to business activity
- System logs and security records
- Compliance, governance, and audit materials
Drafts and working documents may also constitute records where relevant.
4. Retention Principles
Murzo Group retains records based on the following principles:
- Lawfulness: Retention complies with applicable legal requirements
- Necessity: Records are retained only where required
- Proportionality: Retention periods reflect risk and purpose
- Security: Records are protected according to their classification
- Defensibility: Retention decisions can be justified if challenged
5. Retention Periods
Unless otherwise required by law or contract, Murzo Group applies the following indicative retention periods:
- Client project records: Up to five (5) years after project completion
- Contracts and legal agreements: Duration of contract plus six (6) years
- Financial and tax records: In accordance with statutory requirements
- Security and system logs: As required for operational and legal purposes
- HR and recruitment records: In accordance with employment law
Retention periods may vary depending on jurisdiction, risk, or regulatory obligation.
6. Client Platform Records
Data stored on Murzo Group client platforms:
- Is retained in line with the Client Platform User Agreement
- May be deleted earlier at client request where lawful and feasible
- Is permanently deleted or securely destroyed upon expiry of retention
Clients are advised not to upload sensitive personal or high-risk data.
7. Legal Holds
A Legal Hold is the suspension of routine record deletion where Murzo Group reasonably anticipates or becomes involved in litigation or legal disputes, regulatory investigations, law enforcement enquiries, audits, or compliance reviews.
When a legal hold is in effect:
- All relevant records must be preserved
- Automatic deletion processes are suspended
- Affected personnel are notified
- Records must not be altered, deleted, or destroyed
Legal holds remain in place until formally lifted by Murzo Group.
8. Responsibilities
- Senior Management: Overall accountability for compliance
- Information Owners: Ensuring appropriate retention and classification
- Employees & Contractors: Complying with retention and hold instructions
Failure to comply may result in disciplinary or contractual action.
9. Secure Storage & Access
Records must be stored:
- In approved systems or physical locations
- With access limited based on role and classification
- In accordance with Murzo Group’s Security Assurance Framework
Unauthorised copying, removal, or storage of records is prohibited.
10. Disposal & Destruction
When records reach the end of their retention period and are not subject to a legal hold:
- Digital records are securely deleted or overwritten
- Physical records are shredded or destroyed securely
- Storage media is sanitised or destroyed
Disposal must be irreversible and appropriate to the record’s classification.
11. Third-Party Records
Where third parties process or store records on Murzo Group’s behalf:
- Retention and disposal obligations must be contractually defined
- Third parties must comply with equivalent standards
- Murzo Group is not responsible for independent failures beyond legal obligations
12. Monitoring & Compliance
Murzo Group reserves the right to:
- Audit record-keeping practices
- Investigate non-compliance
- Enforce corrective measures
Non-compliance may expose Murzo Group to legal risk and will be addressed accordingly.
13. Limitations
This policy:
- Does not override statutory disclosure obligations
- Does not constitute legal advice
- Does not create contractual rights for third parties
Murzo Group retains discretion in applying retention measures where legally permitted.
14. Review & Updates
This policy is reviewed periodically and updated to reflect:
- Changes in law or regulation
- Operational or technological changes
- Lessons learned from disputes or audits
Revised versions will be published on Murzo Group platforms.
