Best Practices for Storing Paper Customer Info?

Filled out phone order forms

[akmac]

Hi All,
We get a significant number of phone-in orders, where the customer information written on a paper form. I'm curious what you do in regards to storing this information.

As I understand it-all information but the cvv2 number can be stored. Is this correct?

Are there specific requirements/best practices for storing these order forms?

Specifically, I'm wondering how long you wait before destroying these forms, and how they are stored in the interim.

[The Contractor]

Scan them to PDF's removing all credit-card information/numbers except last 4 and what credit card was used (black-out other numbers before scanning with a black marker). If you name them the same as the order number you have a quick/easy way of pulling up this data/order.

[ispy]

They should be stored in a secure locked location. How secure? Well nobody really cares or checks as long as the data is not comprimised. If it's just you with a key, no risk. If its your employees the time to call fort knox. If the data is ever stolen you must legally inform the customers of this. It can safely be destroyed when you no longer need the info. A good rule of thumb of no longer needing the info. is when you know you will never need to contact the customer again of your own volition and will not ever need to do any type of refund, charge, or credit again.

[Corey Bryant]

You should keep the records for three years

-Corey

[Wlauzon]

Records yes, but they don't have to be paper records. We use Quickbooks Enterprise. We enter the phone in order directly, and seldom use paper at all.

[sun818]

Best place to store this information is in a paper shredder. We use order manager software to enter in order manually while customer is on the phone. Then once order is approved, customer's credit card is charged. That could be same day, or later when their order can ship.