PLEASE REVIEW OUR DATA RETENTION POLICY CAREFULLY

OVERVIEW OF OUR PRIVACY POLICY

Color Card Administrator (CCA, we, our, or us) maintains this Data Retention Policy to define how we retain, review, and securely dispose of personal data and business records.

This Policy applies to all employees, contractors, and third parties processing data on behalf of CCA.

PURPOSE

The purpose of this Policy is to:

• Ensure data is retained only as long as necessary
  
• Support legal, contractual, and operational requirements
  
• Reduce risks associated with data over-retention
  
• Enable secure deletion and lifecycle management
  

A structured retention policy ensures organizations keep only necessary data and securely dispose of the rest, reducing legal and security risks.

SCOPE

This Policy applies to:

• Personal data (customers, users, employees)
  
• Business records (contracts, invoices, logs)
  
• System data (logs, backups, analytics)
  
• Third-party processed data
  

It covers all systems including:

• Production systems
  
• Backup and archival systems
  
• Cloud and on-premise infrastructure
  

CORE PRINCIPLES

CCA follows these principles:

DATA MINIMIZATION

We retain only data that is necessary for defined purposes.

STORAGE LIMITATION

Data is not kept longer than required for legal or operational needs.

PURPOSE LIMITATION

Retention periods are tied to the purpose for which data was collected.

SECURITY & INTEGRITY

Data is protected during retention and securely deleted after expiry.

ACCOUNTABILITY

Retention practices are documented and periodically reviewed.

LEGAL & REGULATORY CONSIDERATIONS

CCA designs retention periods based on applicable laws and standards, including:

• CCPA / CPRA (California)
  
• U.S. federal and state recordkeeping laws
  
• GDPR (where applicable)
  
• Contractual obligations
  
• Industry standards (e.g., PCI DSS where relevant)
  

Example: Certain financial records may need to be retained for multiple years under regulatory requirements, while logs may follow shorter cycles depending on security needs.

DATA RETENTION SCHEDULE

CCA maintains a structured retention schedule based on data category.

CUSTOMER & USER DATA

Data Type	Retention Period	Rationale
Account Data	The Company retains personal information for the following general periods, unless a longer retention period is required or permitted by law	Support, disputes, legal
Transaction Data		Financial compliance
Support Communications		Service improvement, dispute handling

EMPLOYEE & HR DATA

Data Type	Retention Period
Employment Records	The Company retains personal information for the following general periods, unless a longer retention period is required or permitted by law
Payroll & Tax Records
Recruitment Data

TECHNICAL & SYSTEM DATA

Data Type	Retention Period
System Logs	The Company retains personal information for the following general periods, unless a longer retention period is required or permitted by law
Security Logs
Backup Data

MARKETING DATA

Data Type	Retention Period
Email Marketing Data	The Company retains personal information for the following general periods, unless a longer retention period is required or permitted by law
Analytics Data

LEGAL & COMPLIANCE RECORDS

Data Type	Retention Period
Contracts	The Company retains personal information for the following general periods, unless a longer retention period is required or permitted by law
Legal Claims Data

DATA DELETION & DISPOSAL

When Data Subject requests:

• Data is securely deleted or anonymized
  
• Deletion methods include:
  . Cryptographic erasure
  . Secure overwrite
  

Secure deletion is a core part of retention policy lifecycle management to ensure data is not recoverable after expiry.

BACKUP & ARCHIVE MANAGEMENT

• Backups are maintained for business continuity only
  
• Backup retention is time-limited and automated
  
• Deleted data may persist temporarily in backups but is removed upon backup cycle expiration
  

Backups are treated as part of the retention scope and must follow the same policy controls.

LEGAL HOLDS

CCA may suspend deletion when required for:

• Litigation
  
• Regulatory investigations
  
• Legal obligations
  

During a legal hold:

• Data is preserved beyond normal retention periods
  
• Deletion processes are paused until release
  

ROLES & RESPONSIBILITIES

Role	Responsibility
Management	Policy oversight
IT Team	Implementation & enforcement
Legal/Compliance	Retention validation
Employees	Adherence to policy

SECURITY MEASURES

During retention, CCA applies:

• Access controls (least privilege)
  
• Encryption (in transit and at rest)
  
• Monitoring and logging
  
• Secure storage practices
  

USER RIGHTS & REQUESTS

Where applicable, individuals may request:

• Data deletion
  
• Access to retained data
  
• Correction of inaccurate data
  

Requests are subject to:

• Legal retention obligations
  
• Identity verification
  

POLICY LIMITATIONS

• CCA does not guarantee absolute deletion from all systems immediately
  
• Retention timelines may vary based on:
  . Legal obligations
  . Technical constraints
  
• Some data may be retained longer where required by law or legitimate business needs
  

CONTACT INFORMATION

For questions regarding this Policy:

Color Card Administrator (CCA)
7898 Ostrow Street, Suite E
San Diego, CA 92111, United States
Click Here to contact us.