Version 1.1 — Approved by Executive Management
Effective Date: November 13, 2025

1. Purpose

The purpose of this Data Retention & Disposal Policy is to define how FinovatePro retains, manages, and securely disposes of data in compliance with applicable laws, contractual obligations, regulatory requirements, and industry security standards.

This policy ensures that:

• Data is retained only for legitimate business or legal purposes
• Sensitive data, including Plaid-derived financial data, is not kept longer than necessary
• Data is disposed of securely and irreversibly
• Users are able to exercise their data rights

2. Scope

This policy applies to all:

• FinovatePro systems, environments, and applications
• Customer and financial data (including data received through Plaid APIs)
• Employee and vendor data
• Electronic and paper records
• Backups and archived data
• Third-party service providers handling FinovatePro data

3. Roles & Responsibilities

Executive Owner (CEO)

Provides overall governance and ensures compliance with retention and deletion requirements.

Information Security & Compliance Manager

Maintains the retention schedule, oversees enforcement, and conducts periodic reviews.

Technical Security Lead

Implements deletion controls within infrastructure, applications, databases, and backups.

All Employees & Contractors

Must comply with retention and disposal requirements as documented.

4. Data Classification for Retention Purposes

FinovatePro classifies data into the following categories:

1. Customer Account Data
2. Financial Data (including Plaid-derived data)
3. Billing and Transaction Records
4. Operational Logs & Audit Logs
5. User-Generated Content
6. System Configuration & Backups
7. Employee & Contractor Data

Different categories carry different retention periods as defined below.

5. Data Retention Periods

FinovatePro retains data only as long as necessary to perform services or meet regulatory obligations. Standard retention periods include:

5.1 Customer Account Data

Retained for the duration of the user’s active account and up to 12 months after account closure, unless a shorter period is required by law or the user requests deletion sooner.

5.2 Financial Data (Including Plaid-Derived Data)

• Restricted financial data (transactions, balances, account metadata) is retained only for as long as the user maintains a connection.
• Upon account unlinking or deletion, Plaid-derived data is deleted within 30 days, unless retention is required for legal, regulatory, or tax reasons.

5.3 Billing Records & Tax-Related Data

Retained for 7 years to meet accounting and audit requirements.

5.4 System & Security Logs

Retained for a minimum of 12 months for security, compliance, and forensic analysis.

5.5 Backups

Encrypted backups are retained for up to 90 days, after which they are securely overwritten or destroyed.

5.6 Employee & Vendor Data

Retained as required for payroll, employment law, or regulatory compliance (typically 7 years).

6. Data Minimization Requirements

FinovatePro adheres to data minimization principles:

• Only data necessary to provide services is collected
• Data is not retained beyond operational need
• Retention periods are strictly enforced
• Redundant or outdated data is routinely purged

7. Secure Data Disposal

All data deletion follows industry-standard secure erasure processes.

7.1 Electronic Data Deletion

When data reaches the end of its retention period, it is permanently deleted using methods such as:

• Cryptographic erasure
• Secure deletion functions in cloud storage
• Overwriting mechanisms for media that support it
• API-based deletion for integrated services (e.g., Plaid API disconnects)

7.2 Database Deletion

Data is removed from production databases, caches, and replicas.
Deletion events are logged.

7.3 Backup Data Disposal

Expired backups are destroyed automatically through the cloud provider’s secure lifecycle policies.

7.4 Third-Party Data Disposal

Vendors handling FinovatePro data must:

• Follow secure disposal practices
• Provide deletion confirmation upon request
• Meet SOC 2 or ISO 27001 standards

8. User-Initiated Data Deletion

Customers may request deletion of their personal or financial data at any time.
Upon receiving such a request:

• Identity verification is performed
• Data is deleted within 30 days (or sooner if required by law)
• The user is notified upon completion
• Plaid connections are revoked immediately

Users may also disconnect accounts through the Plaid Portal.

9. Compliance With Legal & Regulatory Requirements

FinovatePro complies with all applicable laws and frameworks regarding data retention and disposal, including:

• GDPR
• CCPA/CPRA
• GLBA
• SOC 2
• ISO 27001
• Applicable tax and employment laws

Where legal requirements override internal retention periods, legal requirements take precedence.

10. Monitoring & Periodic Review

This policy is reviewed annually and audited internally to ensure:

• Retention schedules are followed
• Disposal processes are functioning correctly
• Changes in regulatory requirements are implemented

Any updates are approved by the CEO and Information Security & Compliance Manager.

11. Enforcement

Violations of this policy may result in:

• Access revocation
• Disciplinary action
• Contract termination
• Escalation to executive management