Data Retention Policy

Data Retention Policy. Personal Data shall not be retained for longer than is necessary for the purposes for which it was collected and processed, in accordance with the principles of data minimization and storage limitation set forth in Article 5(1)(c) and (e) of the GDPR. The Data Controller shall establish and maintain a Data Retention Schedule that specifies, for each category of Personal Data: (a) the business or legal purpose for retention; (b) the maximum retention period, based on the applicable legal, regulatory, contractual, or operational requirements; (c) the criteria used to determine the retention period where a fixed period is not practicable; and (d) the method of secure destruction or anonymization upon expiration of the retention period. At the end of the applicable retention period, Personal Data shall be securely deleted, destroyed, or irreversibly anonymized such that the data subject can no longer be identified. Retention periods shall be reviewed annually and updated as necessary to reflect changes in legal requirements or business needs. This policy shall be communicated to all employees who process Personal Data, and compliance shall be monitored through periodic audits.