Retention and Deletion Policy

Scope

This Policy applies to the information described in Section 2 that we receive from or about a Customer in connection with its Units and our support services (“Customer Data”). It does not cover information about visitors to our website, job applicants or our own personnel. Information about visitors to our website, job applicants and users of our other services is described in our Privacy Policy at pantograph.com/legal/privacy.

Customer Data We Receive

We receive the following Customer Data:

1. operational and diagnostic data about a Unit’s condition and performance that we obtain as the Customer’s agreement permits (“Device Health Data”), such as Unit identifiers, firmware and software versions, diagnostic telemetry, fault and alarm records, and safety events, including motor, battery, temperature and emergency-stop logs;
2. materials a Customer sends us, or that we collect with the Customer’s permission during a visit, for support or troubleshooting (“Support Materials”), such as technical issue descriptions, error reports, screenshots, logs, configuration details, recordings, or other information the Customer provides when requesting support;
3. data that remains on a Unit when the Unit is returned to us or replaced; and
4. contact details, agreements, orders, invoices and correspondence relating to the Customer’s account (“Account Records”).

“Customer Content” means imagery, video, code, models, files and other content that a Customer or its personnel create, collect or load using a Unit, wherever we receive it. Device Health Data does not include Customer Content. We receive Customer Content only if a Customer sends it to us, if we collect it with the Customer’s permission during a visit, or if it remains on a Unit that comes back to us. Except with the Customer’s express written permission or by the Customer’s own action, Units do not send imagery, teleoperation, or other motion data to Pantograph.

Please do not submit passwords, keys or other credentials, or personal information that is not needed to resolve an issue, in Support Materials.

How We Use Customer Data

We do not access or otherwise use Customer Data except as necessary to provide, secure, and support our Units and services for the relevant Customer, to comply with applicable law and legal process, to establish, exercise or defend legal claims, and to assess, maintain, improve, and develop our products using Device Health Data as the Customer’s agreement permits. We do not share Customer Data between Customers. We do not use Customer Content to train, fine-tune, or develop our own or any third party’s foundation or machine learning models unless the Customer agrees in writing, and we do not sell Customer Data.

Data Retention

Subject to Section 5 of this Policy, we retain Customer Data for as long as necessary to fulfill the purposes described in this Policy and then delete it, or, for Device Health Data, deidentify or aggregate it, except where a longer period is set out below or required by law. Our retention periods are as follows:

1. Support Materials and Customer Content: for the term of the Customer’s agreement, and then deleted as described in Section 5, unless the Customer agrees in writing that we may keep specified materials for longer;
2. Device Health Data: for the term of the Customer’s agreement and 24 months thereafter, other than (i) records of safety incidents involving a Unit, which we retain for six years, and (ii) fault and failure records that do not contain Customer Content and do not identify any individual, which we may keep for as long as we determine necessary to improve the safety and reliability of our products, subject to the confidentiality terms of the Customer’s agreement;
3. Data remaining on a returned or replaced Unit: until the Unit’s storage is reimaged or replaced as described in Section 6;
4. Account Records: for the term of the Customer’s agreement and seven years thereafter; and
5. Records subject to a legal hold or necessary to establish, exercise or defend legal claims: for the duration of the matter and any applicable limitations period.

Deletion

Within 30 days after a Customer’s written request, or after the Customer’s agreement ends, we delete that Customer’s Support Materials and Customer Content from our active systems. Copies that remain in trash, recovery windows or backups are purged in the ordinary course on our and our service providers’ standard schedules, and we do not restore or access them in the meantime. Device Health Data, Account Records and records described in Section 4(e) are kept for the periods in Section 4 and are not deleted in response to a request. Where an exception applies we will tell the Customer which one and delete the balance. On request, an authorized officer of Pantograph will confirm by email what was deleted, when, and anything we kept under an exception.

If you wish to exercise rights with respect to Customer Data, please contact the Customer concerned; we will support that Customer in responding and act on its written instructions.

Returned and Replaced Units

Before a Unit leaves a Customer’s site, the Customer should remove its data and credentials, such as SSH keys, network passwords and API keys, and we will help with that at any in-person visit. When we collect a Unit in person, we will offer to wipe its storage before the Unit leaves the site. We reimage or replace the storage of every Unit that comes back to us before the Unit is reused or leaves our control, and in any event within 30 days after we receive it. Until then, we do not access data left on the Unit except to reimage it or to diagnose a fault the Customer reported. On request, we will confirm by email when this has been done.

Security

Apart from data on returned Units, we hold Customer Data in cloud accounts we control, with our hosting, storage and backup providers, and on servers at our own premises. We maintain administrative, technical and physical safeguards designed to protect Customer Data against unauthorized access, use, disclosure, alteration and destruction, appropriate to the nature of the information and the size and complexity of our operations. These measures currently include requiring multi-factor authentication for employee logins to critical accounts. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Government and Law Enforcement Requests

We do not give any government or law enforcement agency access to Customer Data voluntarily. We disclose Customer Data in response to a government or law enforcement request only through valid legal process, and we review each request for validity and scope and object to or seek to narrow a request that is overbroad, defective or unlawful. Unless we are prohibited from doing so, we notify the Customer before we disclose anything, so that the Customer can seek to limit or prevent the disclosure, and where notice is prohibited we give it as soon as the prohibition allows. We disclose no more than the request requires. Requests should be sent to legal@pantograph.com.

Changes to This Policy

We may update this Policy from time to time. When we do, we will revise the version number and Last Updated date above. No update will reduce the protection this Policy gives to Customer Data we already hold for a Customer unless we first notify that Customer. We retain prior versions of this Policy and will provide a copy on request.

How to Contact Us

If you have questions about this Policy or would like to make a request under it, please contact us at legal@pantograph.com.