Data Retention Policy

Overview of our Privacy Policy

Color Card Administrator (“CCA”, “we”, “our”, or “us”) maintains this Data Retention Policy to define how we retain, review, and securely dispose of personal data and business records.

This Policy applies to all employees, contractors, and third parties processing data on behalf of CCA.

Purpose

The purpose of this Policy is to:

Ensure data is retained only as long as necessary
Support legal, contractual, and operational requirements
Reduce risks associated with data over-retention
Enable secure deletion and lifecycle management

A structured retention policy ensures organizations keep only necessary data and securely dispose of the rest, reducing legal and security risks.

Scope

This Policy applies to:

Personal data (customers, users, employees)
Business records (contracts, invoices, logs)
System data (logs, backups, analytics)
Third-party processed data

It covers all systems including:

Production systems
Backup and archival systems
Cloud and on-premise infrastructure

Core Principles

CCA follows these principles:

Data Minimization

We retain only data that is necessary for defined purposes.

Storage Limitation

Data is not kept longer than required for legal or operational needs.

Purpose Limitation

Retention periods are tied to the purpose for which data was collected.

Security & Integrity

Data is protected during retention and securely deleted after expiry.

Accountability

Retention practices are documented and periodically reviewed.

Legal & Regulatory Considerations

CCA designs retention periods based on applicable laws and standards, including:

CCPA / CPRA (California)
U.S. federal and state recordkeeping laws
GDPR (where applicable)
Contractual obligations
Industry standards (e.g., PCI DSS where relevant)

Example: Certain financial records may need to be retained for multiple years under regulatory requirements, while logs may follow shorter cycles depending on security needs.

Data Retention Schedule

CCA maintains a structured retention schedule based on data category.

Customer & User Data

Data Type	Retention Period	Rationale
Account Data	The Company retains personal information for the following general periods, unless a longer retention period is required or permitted by law	Support, disputes, legal
Transaction Data		Financial compliance
Support Communications		Service improvement, dispute handling

Employee & HR Data

Data Type	Retention Period
Employment Records	The Company retains personal information for the following general periods, unless a longer retention period is required or permitted by law
Payroll & Tax Records
Recruitment Data

Technical & System Data

Data Type	Retention Period
System Logs	The Company retains personal information for the following general periods, unless a longer retention period is required or permitted by law
Security Logs
Backup Data

Marketing Data

Data Type	Retention Period
Email Marketing Data	The Company retains personal information for the following general periods, unless a longer retention period is required or permitted by law
Analytics Data

Legal & Compliance Records

Data Type	Retention Period
Contracts	The Company retains personal information for the following general periods, unless a longer retention period is required or permitted by law
Legal Claims Data

Data Deletion & Disposal

When Data Subject requests:

Data is securely deleted or anonymized
Deletion methods include:

Cryptographic erasure
Secure overwrite

Secure deletion is a core part of retention policy lifecycle management to ensure data is not recoverable after expiry.

Backup & Archive Management

Backups are maintained for business continuity only
Backup retention is time-limited and automated
Deleted data may persist temporarily in backups but is removed upon backup cycle expiration

Backups are treated as part of the retention scope and must follow the same policy controls.

Legal Holds

CCA may suspend deletion when required for:

Litigation
Regulatory investigations
Legal obligations

During a legal hold:

Data is preserved beyond normal retention periods
Deletion processes are paused until release

Roles & Responsibilities

Role	Responsibility
Management	Policy oversight
IT Team	Implementation & enforcement
Legal/Compliance	Retention validation
Employees	Adherence to policy

Security Measures

During retention, CCA applies:

Access controls (least privilege)
Encryption (in transit and at rest)
Monitoring and logging
Secure storage practices

User Rights & Requests

Where applicable, individuals may request:

Data deletion
Access to retained data
Correction of inaccurate data

Requests are subject to:

Legal retention obligations
Identity verification

Policy Limitations

CCA does not guarantee absolute deletion from all systems immediately
Retention timelines may vary based on:

Legal obligations
Technical constraints

Some data may be retained longer where required by law or legitimate business needs

CONTACT:

Don't hesitate to contact CCA if you have any questions.

-Via website: Contact Us