Data Retention

MFC Safe Data Retention & Archiving Policy

1. Purpose This policy establishes guidelines for the retention, archiving, and secure disposal of data managed by MFC Safe. It ensures compliance with applicable laws, regulations, and contractual obligations, and protects sensitive business and customer information throughout its lifecycle.

2. Scope Applies to all digital data collected, stored, processed, and managed by MFC Safe, including:

• Customer records

• Transactional logs

• Platform usage data

• Audit and system logs

• Communications and support records

3. Data Retention Schedule

Customer profiles	7 years post-termination	Regulatory compliance & audit trail
Transaction records	7 years	Financial and regulatory compliance
System and audit logs	12 months	Security monitoring and auditing
Support tickets & chat logs	24 months	Operational and quality control
Temporary session data	24 hours	Performance & security optimization
Archived backups	90 days (rotating)	Disaster recovery readiness

4. Archiving Protocol

• Archived data must be encrypted at rest (AES-256) and stored in S3 Glacier or similar long-term storage.

• Metadata tags must define data type, archival date, and deletion schedule.

• Only authorized personnel may retrieve archived data.

5. Secure Disposal

• Data flagged for disposal is subject to automated purging via secure wipe scripts.

• Backups and logs are overwritten using cryptographic erasure.

• Compliance with NIST SP 800-88 for all data destruction.

6. Compliance and Review

• Annual audit of data lifecycle practices.

• Reviewed every 12 months or upon regulatory changes.

• Aligned with GDPR, PDPA (Singapore), and ISO/IEC 27001.

7. Roles and Responsibilities

• Data Protection Officer (DPO): Oversight and compliance

• DevOps Team: Enforces retention via infrastructure policies

• Developers: Tagging and classification of data

• QA/Compliance: Review and validation of archival procedures