Purpose

It is the policy of ACS Technologies Group, Inc. (“ACST”) to establish and maintain an electronic mail (“email”) retention policy for the purpose of knowledge management, regulatory compliance, and legal discovery. Communications sent via email is a strategic business asset and the property of ACST. As such, it must be protected while it has value, and deleted after its value is gone.

This policy clarifies that email is a communications tool, not a data storage application. Data that is received in email should be transferred and stored in the appropriate application (i.e. Salesforce, Intacct, Google docs, Concord, U drive). This policy and accompanying procedures are designed to help employees determine which emails should be retained, and for how long. It also establishes how and why emails may be retained past the default retention period.

Scope and Applicability

This policy applies to all ACST employees and contractors who have an @acst.com email address.

Policy

1. The default retention period for all email, regardless of subject or sensitivity is currently 2 years. This period will be gradually be shortened to 1 year.

2. Custom retention rules and their corresponding labels are created and managed by the Gmail Administrator in coordination with the departments that require them. Please refer to Table 1 for the list of custom retention rules and labels.

3. At the end of a retention period controlled by a label, Gmail will automatically remove affected messages. Messages consigned to the Google Vault for removal can be recovered if circumstances warrant.

4. Retention rules affect all email in our corporate email systems (@acst.com). Email received from outside of ACST can be labeled after it is received and retained just as any other email message.

5. ACST employees are made aware of existing and new retention rules using a mix of live training, LMS, intranet posts or topic-specific email.

6. Risk Management will verify compliance with this policy by conducting regular audits. If necessary, Risk Management may inspect individual emails to ensure retention rules are not being misused.

Regulatory Compliance and Other Exceptions

Some departments may require longer email retention periods by law. For example, ACST uses credit reporting information as part of employee background checks. Email containing elements of this information is subject to the requirements of the Federal Trade Commission ("FTC") Fair and Accurate Credit Transactions Act ("FACTA") Disposal Rule and is retained for a specified period. Other regulatory guidelines or business needs may warrant longer retention periods.

Procedures

1. Identify the emails that you need to retain in email for a period longer than the default retention rule. Labels function and serve as folders in Gmail. If you've already organized your inbox using labels (or folders), this should be easy.

2. The Gmail Administrator will work with each department to determine their needs for retention labels. For example, Human Resources must retain health plan benefit emails for longer than the default retention rule. The Gmail Administrator will designate a "Health Benefits" label, set the period, and make it available to HR staff.

3. Emails with no labels will automatically fall under the default rule for retention.

4. Each department will label their emails according to the retention rules needed and specified.

   Note:

   Labels created by other departments will not work for your department, each department's labels are specific for their department's use.

_{If your department needs to create a retention rule that is longer than the default.}

To request a new retention rule for your department:

1. Enter a general IT request in the ITSRS.

2. The request should include:

   • the reason for the new rule

   • how long email will be retained

   • the desired label name

   • your manager (to approve the request)

3. To gain approval, your manager must add a note in the ITSRS ticket acknowledging their approval.

To apply a label your department has created, start using those labels on the emails you're sending out.

How to create a label while composing an email in Gmail.

If you have emails in your inbox that need to be labeled for longer retention:

1. Select a single message or many messages.

   • Hint: search for the company name or a specific email address to label several at one time.

2. At the top, click Labels .

3. Select a label, or create a new one.

Recovering Email

Any email (including SPAM) that you have deleted will automatically be removed from your Trash after 30 days. This is unrelated to email retention.

Table 1 - Email Retention Labels

Each department sets their own rules. For example, if you're not a member of the Support department, you cannot use rules created by Support, they won't work for you. Also, you must apply the label exactly as written in the table below. Misspellings or incorrect capitalization will keep the retention from being applied.