Data Retention & Disposal Policy

Effective Date: 01/02/2025
Approved By: President, KPG99 Inc.

---

1. Purpose

The purpose of this policy is to define how KPG99 Inc. manages the retention, storage, and secure disposal of data in compliance with legal, regulatory, and contractual requirements. The policy ensures that data is retained only for as long as necessary and securely destroyed once it is no longer required for business or compliance purposes.

---

2. Scope

This policy applies to all data created, received, or maintained by KPG99 Inc., including electronic and paper records. It covers all business units, employees, contractors, and subcontractors who handle company, client, or candidate data.

---

3. Policy Statement

KPG99 Inc. is committed to retaining and disposing of data responsibly to protect privacy, maintain compliance, and prevent unauthorized use or disclosure. All data will be managed in accordance with defined retention schedules and securely deleted or destroyed when the retention period expires.

---

4. Data Retention Principles

KPG99 Inc. follows these principles for data management:

1. Purpose-Based Retention: Data is retained only for as long as necessary to meet business, contractual, or legal obligations.
2. Data Classification: Retention periods are defined by data type (e.g., financial records, HR data, client submissions).
3. Security During Retention: Data is stored securely with access limited to authorized personnel.
4. Controlled Disposal: Expired data is permanently deleted or destroyed in a secure manner.

---

5. Retention Periods

Typical retention periods include:

• Client Contracts and Agreements: Minimum 7 years after completion or termination.
• Employee and Payroll Records: Minimum 7 years after separation.
• Candidate Resumes and Placement Records: Up to 3 years after last activity or as required by client agreement.
• Financial and Tax Records: Minimum 7 years in accordance with accounting and regulatory standards.
• Compliance and Audit Records: Minimum 5 years or as per client-specific terms.

Retention timelines may vary based on applicable law or contractual obligations.

---

6. Secure Disposal Methods

When data reaches the end of its retention period, it must be securely disposed of through one of the following methods:

• Electronic Data: Secure deletion using certified software ensuring permanent removal.
• Physical Records: Shredding or secure destruction through an authorized vendor.
• Backup Data: Periodic review and removal of outdated or expired data from archived storage.

All disposals must be documented and, where necessary, approved by the Compliance & Operations Team.

---

7. Suspension of Disposal

If data is subject to legal, regulatory, or audit requirements, disposal will be suspended until authorization is received from management or legal counsel.

---

8. Responsibilities

• Department Heads: Ensure data under their control is managed per retention schedules.
• IT Department: Maintain secure storage, backups, and disposal procedures.
• Compliance Team: Review adherence, update retention schedules, and maintain disposal logs.

---

9. Review

This policy will be reviewed annually to ensure ongoing compliance with legal requirements, client contracts, and best practices for data lifecycle management.

---

Approved and Authorized by:
Puneet Gulati
President, KPG99 Inc.
Date: 01/02/2025