# Data Retention and Disposal Policy **Digital Benefits Pte Ltd (WiBiz)** **Version:** 1.0 **Effective Date:** 15 April 2026 **Owner:** CEO / Operations Lead **Review Cycle:** Annual (next review by April 2027) --- ## 1. Purpose This policy defines how long WiBiz retains different categories of data and how data is securely disposed of when retention periods expire. It ensures compliance with Singapore regulatory requirements (PDPA, IRAS), contractual obligations to clients, and information security best practices. --- ## 2. Scope This policy applies to all data created, collected, processed, or stored by WiBiz in the course of business operations. This includes: - Client data (conversation records, CRM records, contact information, payment data) - Employee and contractor records - Financial and billing records - System and application logs - Backup data - Marketing and prospect data This policy applies regardless of storage medium (cloud services, local storage, physical documents) and regardless of location (Singapore, Philippines, or any third-party data centre). --- ## 3. Data Retention Schedule | Data Category | Retention Period | Rationale | |---|---|---| | Client conversation data (WhatsApp, Instagram, Facebook, web chat, voice) | Duration of client contract + 90 days | Contractual obligation; client access to historical data during contract; 90-day buffer for offboarding and data return | | Client CRM records (contacts, pipeline data, tags, notes) | Duration of client contract + 90 days | Same as above | | Client payment and transaction data | Duration of client contract + 90 days | Operational reference during contract; financial records retained separately per IRAS requirements | | Financial and billing records (invoices, receipts, payment records, tax filings) | 7 years from end of financial year in which the transaction occurred | Singapore IRAS requirement under the Income Tax Act (Section 67) | | Employee records (contracts, performance records, payroll, tax filings) | Duration of employment + 2 years | Singapore MOM and CPF requirements; sufficient for dispute resolution | | Contractor and freelancer records | Duration of engagement + 2 years | Aligned with employee records | | Intern records | Duration of internship + 1 year | Proportionate to engagement length | | System and application logs (access logs, error logs, audit trails) | 12 months from date of creation | Security monitoring, incident investigation, and compliance auditing | | Backup data | Aligned with the retention period of the source data | Backups must not outlive the data they contain; expired source data must be purged from backups at next backup rotation | | Marketing and prospect data (leads not converted to clients) | 12 months from last interaction | PDPA consent freshness; prospects who have not engaged in 12 months are purged unless consent is renewed | | Internal project documentation | Duration of relevance + 12 months | Operational reference; purged when no longer needed | ### 3.1 Retention Period Start Date - For client data: retention period begins on the date the client contract is terminated or expires (not the date data was created). - For employee records: retention period begins on the last day of employment. - For financial records: retention period begins at the end of the financial year in which the transaction occurred. - For logs: retention period begins on the date of creation. --- ## 4. Disposal Methods When a retention period expires, data must be disposed of securely within 30 days of the expiry date. ### 4.1 Electronic Data | Method | When to Use | |---|---| | **Cryptographic erasure** | Preferred method for cloud-hosted and encrypted storage. Destroy the encryption keys, rendering the data irrecoverable. | | **Secure deletion** | For data on local storage, virtual machines, or systems without encryption-at-rest. Use tools that overwrite data (not simple file deletion). On SSDs, use manufacturer-provided secure erase commands or full-disk encryption with key destruction. | | **Account/instance deletion** | For SaaS platforms where WiBiz controls the sub-account. Delete the sub-account entirely after confirming all required data has been exported or returned to the client. | ### 4.2 Physical Media | Method | When to Use | |---|---| | **Cross-cut shredding** | Paper documents containing any personal data, client data, financial data, or confidential information. Strip-cut shredding is not acceptable. | | **Physical destruction** | Hard drives, USB drives, or other physical media that have stored confidential data. Degaussing followed by physical destruction, or use of a certified destruction service with a certificate of destruction. | ### 4.3 Disposal Records A record must be kept for each disposal action, containing: - Data category disposed - Disposal method used - Date of disposal - Person responsible for disposal - Confirmation that disposal was completed (screenshot, certificate, or log entry) Disposal records must be retained for 3 years. --- ## 5. Client Data Deletion Requests ### 5.1 During Active Contract Clients may request deletion of specific data during an active contract. Such requests will be evaluated on a case-by-case basis. WiBiz will comply where technically feasible and where deletion does not conflict with legal or regulatory obligations. ### 5.2 Post-Contract Deletion Upon contract termination or expiry: 1. WiBiz will notify the client that their data will be retained for 90 days following the end of the contract. 2. During the 90-day period, the client may request a full export of their data. WiBiz will provide the export in a standard, machine-readable format (CSV, JSON, or equivalent). 3. At the end of the 90-day period, all client data will be securely disposed of using the methods described in Section 4. 4. WiBiz will provide written confirmation of deletion to the client upon request. ### 5.3 Ad Hoc Deletion Requests (PDPA / Data Subject Requests) Where an end customer (a contact within a client's CRM) submits a deletion request under PDPA or equivalent data protection law: - WiBiz will process the request within 30 days of receiving a verified request. - The client (as data controller) must authorize the deletion or forward the request. - WiBiz will confirm deletion in writing to the client. - If deletion conflicts with a legal hold or regulatory retention requirement, the requestor will be informed of the reason for the delay and the expected timeline. --- ## 6. Offboarding Data Handling ### 6.1 Client Offboarding When a client contract ends: | Step | Timeline | Action | |---|---|---| | 1 | Within 5 business days of contract end | Notify client of 90-day data retention window and offer data export | | 2 | Within 90 days | Client requests data export (if desired); WiBiz provides export | | 3 | Day 91 | Begin secure deletion of all client conversation data, CRM records, and platform configuration | | 4 | Within 30 days of step 3 | Complete deletion; log disposal record | | 5 | On request | Provide written deletion confirmation to client | Financial and billing records related to the client are retained for 7 years per IRAS requirements, separate from operational client data. ### 6.2 Employee / Contractor Offboarding When an employee or contractor departs: - All company data on personal devices must be removed or remotely wiped (per the Acceptable Use Policy BYOD provisions). - Access to all company systems must be revoked within 24 hours of the last working day (per the Access Control Policy). - Employee records enter the post-employment retention period (2 years). - Work product, documents, and files created during employment remain the property of WiBiz and must not be deleted by the departing individual. --- ## 7. Legal Hold ### 7.1 When a Legal Hold Applies A legal hold suspends all data disposal for data that may be relevant to: - Pending or threatened litigation - Regulatory investigation or audit - Internal investigation - Any legal proceeding where WiBiz is a party or has been notified of potential involvement ### 7.2 Legal Hold Process 1. The CEO or legal counsel issues a written legal hold notice specifying the scope of data to be preserved. 2. The Operations Lead identifies all systems and storage locations containing data within scope. 3. Automated deletion processes for in-scope data are suspended. 4. All individuals with access to in-scope data are notified in writing and instructed not to delete, modify, or move the data. 5. The legal hold remains in effect until the CEO or legal counsel issues a written release. 6. Upon release, normal retention and disposal schedules resume. Data that has exceeded its retention period during the hold will be disposed of within 30 days of the release. ### 7.3 Legal Hold Records A log of all legal holds must be maintained, including: date issued, scope, issuing authority, date released, and any actions taken during the hold period. --- ## 8. Annual Retention Review WiBiz will conduct an annual review of this policy and the data it governs. The review will include: - Confirmation that retention periods remain aligned with current legal and regulatory requirements. - Audit of a sample of data categories to verify that expired data has been disposed of on schedule. - Review of any legal holds in effect and their continued necessity. - Update of the retention schedule if new data categories have been introduced. - Verification that disposal records are complete and accurate. The review will be conducted by the Operations Lead and approved by the CEO. Findings and any required actions will be documented. --- ## 9. Exceptions Any exception to this policy must be approved in writing by the CEO. Exceptions must specify the data affected, the reason for the exception, the revised retention period, and the date the exception will be reviewed. --- ## 10. Related Policies - Acceptable Use Policy - Access Control Policy - Incident Response Policy - Information Security Policy --- ## Document Control | Field | Value | |---|---| | Document ID | WBZ-POL-DRD-001 | | Version | 1.0 | | Classification | Internal | | Author | Operations | | Approved by | CEO | | Effective date | 15 April 2026 | | Next review | April 2027 |