Global Data Retention & Deletion Policy

This Global Data Retention and Deletion Policy establishes the principles, obligations, and procedures governing how FanSynQ collects, retains, manages, and permanently deletes personal data and other sensitive information. It is designed to ensure full compliance with applicable data protection laws across every jurisdiction in which we operate.

1.1 Purpose

The primary objectives of this Policy are to:

• Ensure compliance with global privacy and data protection legislation, including but not limited to the GDPR, CCPA/CPRA, PIPL, LGPD, DPDPA, POPIA, PIPA, PDPA, APPI, PIPEDA, nFADP, PDPL, Privacy Act 1988, and all applicable US state privacy laws.
• Define clear retention periods for each category of personal data, grounded in documented legal bases or legitimate business necessity.
• Protect the rights of data subjects — including the right to erasure, the right to access, and the right to portability — in accordance with applicable law.
• Minimize data storage costs, privacy risks, and security exposure by disposing of data that no longer serves its original, documented purpose.
• Establish a consistent, auditable framework for responding to deletion requests, regulatory inquiries, and litigation holds.

1.2 Scope

This Policy applies to:

• All personal data and sensitive personal information collected, processed, or stored by FanSynQ in any form — digital, physical, or otherwise.
• All employees, contractors, consultants, vendors, and third-party processors acting on behalf of FanSynQ.
• All systems, platforms, databases, cloud environments, backup media, and physical records under FanSynQ's control.
• All geographic locations and legal entities within the FanSynQ group.

This Policy does NOT override applicable law. Where a specific legal obligation requires longer retention, that obligation takes precedence. Where law requires shorter retention or immediate deletion, that requirement applies.

FanSynQ is subject to data protection obligations under the laws set out below. This table is not exhaustive and will be updated as new laws come into force. All references to penalties reflect the statutory maximums; actual penalties depend on the nature, gravity, and duration of the infringement.

Additionally, the following US state laws are applicable or anticipated: Virginia CDPA (2023), Colorado CPA (2023), Connecticut CTDPA (2023), Utah UCPA (2023), Iowa ICDPA (2025), Montana MCDPA (2024), Oregon OCPA (2024), Delaware DPDPA (2025), New Hampshire NHPA (2025), New Jersey NJDPA (2025), and Indiana IDPL (2026). FanSynQ monitors state privacy law developments on an ongoing basis.

Retention periods below represent minimum and maximum standards derived from applicable law, industry standards, and documented business necessity. All periods run from the later of: (a) the date data is collected, (b) the end of the customer/employment relationship, or (c) the last interaction, as noted below.

Important Note on Backup and Archive Data

Data stored in backup systems is subject to the same retention schedules as primary data. Backup purge cycles must be engineered to ensure that data deleted from live systems is also removed from all backups within 90 days (or earlier where required by law).

Where technical constraints prevent real-time backup deletion, the data must be flagged for deletion in the next scheduled purge cycle and access must be restricted.

Logs of deletions performed — but not the deleted data itself — must be retained for audit purposes for a minimum of 7 years.

Data may only be retained where at least one of the following lawful bases applies and is documented in the Records of Processing Activities (RoPA):

5.1 Legal Obligation

Where retention is required by statute, regulation, or court order (e.g., tax records, anti-money laundering requirements, employment law). The specific law, regulatory requirement, or government directive must be identified and documented. Retention beyond the legally required period is not permitted under this basis.

5.2 Contract Performance

Where data is necessary to fulfil or manage a contract with the data subject. Retention is permitted only for the duration of the contract plus any legally required post-contract period (e.g., warranty, dispute resolution window).

5.3 Consent

Where the data subject has given freely given, specific, informed, and unambiguous consent for a defined purpose and retention period. Consent must be recorded with a timestamp, method, and scope. Withdrawal of consent triggers immediate deletion unless another legal basis applies. Consent records themselves must be kept for the duration of the processing plus three years as proof of lawful processing.

5.4 Legitimate Interests

Where retention is necessary for the legitimate interests of FanSynQ or a third party, provided those interests are not overridden by the rights and freedoms of the data subject. A Legitimate Interests Assessment (LIA) must be documented before relying on this basis. This basis is not available under all applicable laws (e.g., it has no equivalent under PIPL or DPDPA in its current form).

5.5 Vital Interests

In limited circumstances involving a life-threatening emergency where the data subject cannot provide consent. This basis must be reviewed and replaced with a more permanent basis at the earliest opportunity.

5.6 Public Task

Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. Applicable primarily to public sector organizations and certain regulated entities.

All deletion must be performed in accordance with a method appropriate to the sensitivity of the data and the nature of the storage medium. The choice of method must be documented.

6.1 Deletion Methods

6.2 Automated Deletion Schedule

The IT and Data Engineering teams must maintain automated deletion pipelines that:

• Trigger deletion when retention period expiry dates are reached, without manual intervention.
• Generate an immutable audit log entry recording: data category, deletion date, method used, responsible system, and authorizing policy section.
• Cover all environments including production, staging, development, analytics, data lakes, and all backup tiers.
• Send exception reports to the CPO/DPO within 24 hours when automated deletion fails for any reason.
• Be tested at least semi-annually and after any major system change.

6.3 Responding to Data Subject Deletion Requests

Where a data subject exercises their right to erasure (right to be forgotten), the following procedure applies:

1. Verify the identity of the requestor using at least two pieces of identifying information before acting on any request.
2. Log the request in the Data Subject Request Register, including requestor identity (hashed), date received, request type, and assigned handler.
3. Acknowledge receipt within 3 business days (or sooner as required by applicable law).
4. Conduct a legal hold check: verify no active litigation hold, regulatory inquiry, legal obligation, or overriding public interest prevents deletion.
5. If deletion is permissible, execute deletion across all systems (primary, backup, logs, third-party processors) within the timeframe required by applicable law (typically 30 days under GDPR; 45 days under CCPA/CPRA).
6. Notify all sub-processors and third-party processors of the deletion requirement and obtain written confirmation of compliance.
7. Notify the requestor of completion, including a summary of systems from which data was deleted.
8. Where deletion is refused (e.g., due to legal obligation), provide the data subject with a written explanation and their right to complain to the relevant supervisory authority.
9. Retain the audit log of the completed request (not the personal data) for 7 years.

6.4 Third-Party and Vendor Deletion

All Data Processing Agreements (DPAs) must include contractual provisions requiring vendors to:

• Comply with FanSynQ's retention schedules for data processed on our behalf.
• Delete or return all personal data upon termination of the agreement within 30 days.
• Confirm deletion in writing, including the method used, within 14 days of completing destruction.
• Permit FanSynQ to audit deletion procedures on reasonable notice.
• Notify FanSynQ within 48 hours if they are unable to comply with a deletion instruction for any reason.

When litigation, regulatory investigation, or other legal proceedings are reasonably anticipated or have commenced, normal deletion processes must be suspended for relevant data. This section governs the issuance, management, and release of litigation holds.

7.1 Triggering a Litigation Hold

A litigation hold must be issued immediately upon:

• Receipt of a formal legal claim, lawsuit, or court order.
• Receipt of a regulatory inquiry, audit notice, or official investigation.
• Internal escalation by Legal counsel identifying a reasonable anticipation of litigation.
• Receipt of a preservation notice from a counterparty or regulator.

7.2 Hold Procedures

1. Legal counsel issues a written Litigation Hold Notice to all relevant custodians and IT/Data Engineering.
2. Automated deletion for affected data categories is immediately suspended in all applicable systems.
3. A Hold Register entry is created, recording: matter name, hold date, scope of data affected, issuing attorney, and custodians notified.
4. Custodians acknowledge receipt of the hold notice in writing.
5. Hold status is reviewed quarterly and upon any material change in the underlying matter.
6. When the matter is resolved, Legal issues a written Hold Release Notice, and normal deletion schedules resume within 30 days for data no longer required.

FanSynQ respects and facilitates the exercise of data subject rights in accordance with applicable law. The following rights are recognized under one or more applicable regulations:

All data subject requests must be submitted through FanSynQ's designated privacy portal, email address, or written request process. We will verify the requestor's identity before processing any request. Requests may be extended by an additional 30 days (or as permitted by applicable law) for complex or high-volume requests, with written notification to the data subject.

Effective data retention and deletion requires clear ownership across all organizational levels. The following table defines accountability:

10.1 Security During the Retention Period

While data is retained, it must be protected in accordance with FanSynQ's Information Security Policy and the following minimum standards:

• All personal data must be encrypted at rest using AES-256 or equivalent, and in transit using TLS 1.2 or higher.
• Access to personal data must be governed by role-based access control (RBAC) on a need-to-know basis, reviewed quarterly.
• Sensitive personal data (health, biometric, financial) must be subject to additional access controls, including multi-factor authentication and privileged access management (PAM).
• All access to personal data must be logged and logs must be retained for a minimum of 12 months (security) and 7 years (audit).
• Data processing environments must be assessed via Data Protection Impact Assessments (DPIAs) prior to any new high-risk processing activity, as required under GDPR Article 35 and equivalent provisions.

10.2 Security at Deletion

When deleting personal data, the following controls must be applied:

• Deletion must be performed by a method appropriate to the data sensitivity classification (see Section 6.1).
• For cloud-stored data, cryptographic erasure (key destruction) supplemented by provider-confirmed deletion is acceptable.
• Physical media containing personal data must be destroyed by a certified vendor, with a certificate of destruction retained.
• Prior to disposal or re-use of any hardware, a certified data erasure process must be completed and documented.
• Employees must not use personal devices or unauthorized cloud services to store personal data subject to this Policy.

Where personal data is transferred to processors or sub-processors outside the country of collection, the following additional requirements apply to retention and deletion:

• Standard Contractual Clauses (SCCs), Binding Corporate Rules (BCRs), or equivalent transfer mechanisms must include deletion obligations consistent with this Policy.
• Where a jurisdiction prohibits or restricts cross-border transfer (e.g., China under PIPL, Russia under Federal Law No. 242-FZ), data must be localized and deletion procedures must be executed within that jurisdiction.
• Transfer Impact Assessments (TIAs) must evaluate whether the destination country's laws prevent effective deletion or compliance with data subject rights — this includes government access laws and mandatory data retention regulations.
• Upon termination of any cross-border processing arrangement, the receiving entity must confirm deletion in writing within 30 days.
• FanSynQ maintains a cross-border transfer register documenting all international transfers, legal mechanisms relied upon, and deletion confirmation records.

The volume and sensitivity of retained data directly affects breach risk and regulatory notification obligations. This section addresses the intersection of data breach management and retention practices.

12.1 Notification Timelines

Following any confirmed data breach, FanSynQ must conduct a Post-Incident Review within 30 days that specifically assesses whether: (a) the breached data should have already been deleted under this Policy; (b) retention periods for the affected data category should be shortened; and (c) security controls during retention were adequate.

All personnel with access to personal data must complete training on data retention and deletion obligations. Training requirements by role are:

Training completion records must be retained for a minimum of 5 years as evidence of compliance.

14.1 Internal Audit

The Privacy and Compliance team must conduct a comprehensive internal audit of this Policy's implementation at least annually. The audit must verify:

• Accuracy and completeness of the Records of Processing Activities (RoPA) and data inventory.
• That automated deletion pipelines are functioning correctly across all environments.
• That data subject deletion requests were completed within required timeframes, with documented outcomes.
• That litigation holds were properly issued, maintained, and released.
• That third-party processors have confirmed compliance with deletion obligations.
• That training completion rates meet the thresholds set out in Section 13.
• That any deviations from retention schedules are documented, justified, and authorized.

14.2 Audit Documentation

Audit reports must be presented to the Board of Directors or Audit Committee annually. Reports must include: findings, risk ratings, remediation actions, owners, and target completion dates. Audit records must be retained for 7 years.

14.3 Key Performance Indicators

15.1 Review Cycle

This Policy must be formally reviewed at least annually by the CPO/DPO and Legal team. An expedited review must be triggered by:

• Enactment of a new applicable data protection law or significant regulatory guidance.
• A material change to FanSynQ's data processing activities, systems, or geographic footprint.
• A significant data breach or enforcement action by a regulatory authority.
• Findings from an internal audit, external audit, or data subject complaint.

15.2 Version Control

15.3 Policy Hierarchy

This Policy operates within the following governance framework:

• Information Security Policy — governs data security controls during retention.
• Privacy Notice / Privacy Policy — public-facing disclosure of retention periods and rights.
• Data Processing Agreements (DPAs) — contractual retention and deletion obligations for processors.
• Records of Processing Activities (RoPA) — operational record of processing purposes and periods.
• Incident Response Policy — governs breach response and notification procedures.
• Employee Handbook — incorporates employee data handling obligations.

In the event of conflict between this Policy and a more specific operational document, the more protective standard applies unless legal counsel determines otherwise.

Deviations from the retention periods set out in Section 4 are permitted only in the following circumstances and must be formally authorized:

All approved exceptions must be recorded in the Exception Register and reviewed at each annual policy review. Exceptions not renewed within their authorized duration must revert to the standard schedule.

Failure to comply with this Policy may result in:

• Disciplinary action up to and including termination of employment or contract, in accordance with applicable employment law and FanSynQ's disciplinary procedures.
• Civil or criminal liability under applicable data protection law, which may be imposed personally on individuals as well as FanSynQ.
• Regulatory investigation, enforcement action, and fines by data protection authorities — up to the maxima set out in Section 3.
• Reputational damage to FanSynQ, resulting in loss of customer trust, business relationships, and market value.
• Litigation costs, court sanctions, and adverse judgments resulting from spoliation of evidence or failure to respect data subject rights.
• Mandatory remediation orders, processing bans, or temporary restrictions on data processing activities.

FanSynQ does not indemnify employees or contractors against personal liability arising from intentional or grossly negligent violations of this Policy.