Data Retention Policy
Karia Technology Pty Ltd
DATA RETENTION POLICY
Version 2.0 | ABN 78 678 723 012 | Last updated August 2026
About this policy
This page explains how long Karia Technology Pty Ltd retains personal information and business records, and how data is securely disposed of when it is no longer required. For information about how we collect and use your personal information, please refer to our Privacy Policy.
Contents
Who we are
Our role and your data
NLP client data retention
Platform and system data
Business records
How data is stored
Secure disposal
Your rights
Changes to this policy
Contact us
1. Who we are
Karia Technology Pty Ltd (ABN 78 678 723 012) provides a SaaS platform to novated leasing providers (NLPs) across Australia. This policy applies to all data held by Karia, including data held on behalf of NLPs as a contracted service provider.
2. Our role and your data
Karia holds two distinct categories of data, each with different retention obligations:
Karia's own business data: records created or collected by Karia directly, including financial records, employment records, contracts, and operational data.
NLP client data: personal information about drivers and employees that is entered into the Karia platform by NLPs on behalf of their clients. Karia holds this data as a service provider to the NLP and does not control how or why it was originally collected. If you have questions about this data, your primary contact is your NLP or employer.
3. NLP client data retention
The following retention periods apply to personal information held in the Karia platform on behalf of NLPs.
Data type | Retention period | Reason |
|---|---|---|
Personal information (drivers and employees) | Subscription + 90 days | 90-day post-termination window allows NLP to export data before deletion |
Financial and transaction records (lease, payment, payroll) | 7 years | ATO record-keeping requirements |
FBT and tax-related records | 7 years | ATO record-keeping requirements |
Reimbursement and receipt records (including AI-scanned receipts) | 5 years | ATO substantiation requirements |
AI-processed receipt data (held by AI providers) | Zero retention | Enterprise agreements with OpenAI and Anthropic prohibit data retention beyond processing of each individual request |
4. Platform and system data
Karia retains operational and system data for the following periods. This data is used to operate, monitor, and improve the platform and does not contain raw personal information.
Data type | Retention period | Notes |
|---|---|---|
Infrastructure logs (Axiom) | 365 days | PII masked before ingestion, with no raw personal data in logs |
Application error logs (Sentry) | 365 days | PII scrubbed before ingestion |
Product analytics (PostHog) | 365 days | Anonymised data only, with no personal information |
Access logs and audit records | 12 months | Security and compliance monitoring |
Security incident records | 7 years | Legal and regulatory obligations |
Source code and version history | Permanent | Business continuity and IP retention |
NLP platform user accounts and support correspondence | Subscription + 90 days | Service delivery and offboarding |
Marketing contacts | 3 years | From last interaction, or until opt-out |
5. Business records
Karia retains its own business records for the following minimum periods, consistent with applicable Australian law.
Record type | Retention period | Basis |
|---|---|---|
Financial records (invoices, accounts, bank statements) | 7 years | Corporations Act 2001; ATO |
Tax records (BAS, GST, income tax) | 7 years | Taxation Administration Act 1953 |
Payroll records | 7 years | Fair Work Act 2009 |
Legal and contractual documents | 7 years post-expiry | Limitation periods |
Employment records | 7 years post-termination | Fair Work Act 2009 |
Corporate records (minutes, resolutions) | 7 years | Corporations Act 2001 |
Licences and regulatory approvals | Permanent | Ongoing regulatory compliance |
Insurance records | 7 years post-expiry | Limitation periods |
6. How data is stored
Karia is a fully cloud-native business with no physical servers or on-premises infrastructure. All data is stored within authorised cloud platforms:
AWS: primary platform and NLP client data, encrypted at rest and in transit.
Microsoft 365: email and business correspondence.
Atlassian: internal documentation and project records.
GitHub: source code and version history.
Data classification controls are applied across all storage environments, with the strictest controls applied to mission-critical personal and financial data (Grade A), including end-to-end encryption and anomaly detection.
7. Secure disposal
When data reaches the end of its retention period, it is securely deleted or de-identified. Electronic data deletion is performed at the database and storage layer within AWS, in accordance with NIST SP 800-88 standards for physical media sanitisation (managed by AWS under their ISO 27001 and SOC 2 Type II certifications). Physical documents, where they exist, are destroyed by cross-cut shredding.
Where data contains personal information that is no longer required for its original purpose but other aspects of the data remain useful, Karia will de-identify the data by removing or altering information that identifies or could reasonably identify an individual, consistent with the Australian Privacy Principles.
All data disposal events are recorded in Karia's internal data disposal register.
8. Your rights
You have the right to request access to and correction of personal information Karia holds about you, in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APP 12 and APP 13).
If your personal information is held in the Karia platform because your employer or NLP entered it on your behalf, we recommend contacting your NLP or employer in the first instance, as they are the primary APP entity responsible for that data.
To make a request directly to Karia, or to request deletion of data held about you (subject to applicable legal retention obligations), please contact us at legal@karia.com.au.
For complaints about privacy or data handling, you may also contact the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
9. Changes to this policy
This policy may be updated periodically to reflect changes in our practices, legal requirements, or data infrastructure. The latest version is always available at www.karia.com.au. Material changes will be communicated to NLP clients directly.
10. Contact us
For questions about this policy or data retention practices:
Email: legal@karia.com.au
Post: GM of Operations, Karia Technology Pty Ltd, L18 120 Spencer Street, Melbourne VIC 3000
Copyright 2026 Karia Technology Pty Ltd (ABN 78 678 723 012). Version 2.0, last updated August 2026.