Data Retention Policy

Company: MaxX Holdings Inc.
Effective Date: October 4, 2026
Last Updated: October 4, 2026
Policy Owner: Privacy & Compliance Team
Approved By: Executive Management

1. Purpose

This Data Retention and Deletion Policy (“Policy”) establishes the principles and requirements governing the retention, storage, review, archival, deletion, destruction, and anonymization of information maintained by MaxX Holdings Inc. (“Company,” “we,” “us,” or “our”).

The purpose of this Policy is to ensure that information is retained only for legitimate and documented purposes, kept only as long as necessary or legally required, protected throughout its lifecycle, deleted or anonymized when no longer justified, and preserved when required for legal, regulatory, contractual, audit, or dispute-related purposes.

2. Scope

This Policy applies to all Company personnel, contractors, temporary workers, consultants, business units, subsidiaries, systems, applications, databases, and third-party service providers that process information on behalf of the Company.

It applies to customer information, employee information, applicant information, supplier information, user accounts, business records, transaction records, communications, support tickets, security logs, audit records, financial information, contracts, intellectual property, user-generated content, system data, cookies and online identifiers, backup data, physical records, archived information, and other information subject to Company control.

3. Worldwide application

The Company operates across multiple jurisdictions, and retention obligations may differ between countries, states, provinces, territories, industries, and regulatory frameworks.

This Policy establishes a global baseline. Where local law requires a longer retention period, a shorter retention period, a specific deletion process, or additional privacy protections, the Company will follow the applicable mandatory requirement.

4. Fundamental retention principle

The Company will not retain information indefinitely merely because storage is technically possible. Personal information should generally be retained only for as long as reasonably necessary for the purpose for which it was collected or otherwise processed, unless a longer period is justified by applicable law or another documented legitimate requirement.

5. Retention objectives

The Company’s retention program is designed to support legitimate business operations, meet legal and regulatory requirements, protect individual rights, support contractual obligations, maintain appropriate financial records, support security and fraud prevention, preserve evidence where required, support audits and investigations, protect intellectual property, reduce unnecessary privacy and security risk, and ensure timely deletion or anonymization of outdated information.

6. Data lifecycle

Information should be managed throughout its lifecycle: collection, use, active storage, review, archive where justified, and deletion, destruction, or anonymization. Each stage should have an identified owner and appropriate security controls.

7. Data classification

Information should be classified according to sensitivity and business/legal requirements. The Company uses the following categories:

• Public: information intended for public disclosure.
• Internal: information for internal business use.
• Confidential: information that could cause harm if improperly disclosed.
• Restricted/Highly Confidential: information requiring enhanced controls, such as sensitive personal data or security data.

Retention periods should be determined by purpose and legal requirements, not sensitivity alone.

8. Retention schedule

The Company will maintain a formal Records Retention Schedule identifying, at minimum, the record category, description, purpose, data owner, system or location, retention period, trigger, legal requirement, jurisdiction, archival requirement, deletion method, anonymization method, legal-hold status, and responsible department.

9. Retention triggers

Retention periods may begin from various events, including account creation, last activity, transaction completion, contract termination, end of employment, recruitment completion, support-case closure, subscription expiration, project completion, audit finalization, dispute resolution, or another legally defined event.

10. Customer and user account data

Customer account information may include name, email address, contact information, account identifiers, login records, subscription details, preferences, historical account activity, support records, and transaction information. The Company retains this information only as long as necessary to provide services, maintain the account, meet contractual obligations, prevent fraud, resolve disputes, satisfy legal requirements, or establish, exercise, or defend legal claims.

11. Customer transaction records

Transaction information may include orders, invoices, payments, refunds, tax information, billing information, and transaction identifiers. These records may need to be retained for accounting, tax, financial, audit, fraud-prevention, contractual, or legal purposes. The applicable retention period should be determined by the laws governing the relevant entity and transaction.

12. Payment card information

The Company should minimize retention of payment-card information and should generally avoid retaining sensitive payment credentials where payment processing is outsourced. Where such information is retained, it must be subject to enhanced security and compliance controls.

13. Employee records

Employee information may include employment contracts, payroll records, benefits information, performance records, leave records, training records, disciplinary records, tax records, immigration records, pension information, and termination records. Retention periods should account for applicable employment, tax, benefits, safety, and legal requirements.

14. Recruitment and applicant information

Applicant information should not be retained indefinitely. Recruitment data may include resumes, applications, assessment records, interview notes, communications, and reference information. After the process ends, information should be deleted or anonymized when no longer necessary unless a lawful retention reason applies.

15. Marketing data

Marketing information may include email addresses, preferences, consent records, campaign interaction, unsubscribe records, and suppression lists. Marketing information should be reviewed periodically. A minimal suppression record may be retained to avoid sending unwanted communications again after a person unsubscribes.

16. Consent records

Where consent is relied upon, the Company should maintain evidence of who consented, when, what was presented, what purpose the consent covered, how consent was collected, and whether it was later withdrawn. Consent records should be retained for as long as necessary to demonstrate compliance and satisfy legal requirements.

17. Customer support records

Support records may include tickets, emails, chat transcripts, call records, attachments, and complaint records. These records should be retained only for the period necessary for customer service, quality assurance, security, fraud prevention, dispute resolution, or legal requirements.

18. Security logs

Security and technical logs may include login events, authentication attempts, IP addresses, device identifiers, administrative actions, and incident records. Retention should balance security requirements, threat detection, legal obligations, and privacy requirements.

19. Audit records

Audit records should be retained according to applicable law, regulatory requirements, internal policy, contractual obligations, and financial reporting requirements. Audit information should not be retained indefinitely without documented justification.

20. Contracts and agreements

Contracts may include customer contracts, vendor agreements, employment agreements, NDAs, DPAs, licensing agreements, order forms, and statements of work. Contracts should generally be retained for the duration of the relationship and any additional period necessary for tax, audit, warranty, dispute resolution, limitation periods, or legal claims.

21. Legal claims and litigation

When information is relevant to litigation, regulatory investigation, arbitration, mediation, government inquiry, or anticipated proceedings, the Company may suspend ordinary deletion procedures. This is known as a legal hold or litigation hold.

22. Legal hold

When a legal hold is issued, relevant deletion must be suspended, relevant records must be preserved, employees must be informed where appropriate, automated deletion processes may need to be disabled, relevant systems must be identified, and preservation activities must be documented. A legal hold overrides ordinary retention schedules to the extent necessary.

23. Release of legal holds

A legal hold remains in effect until the responsible legal authority determines that preservation is no longer required. After release, ordinary retention rules resume and unnecessary records are reviewed for deletion or anonymization.

24. Backups

Backups are subject to retention requirements appropriate to their purpose. Backup copies should not become a mechanism for indefinite retention of personal information. Backup systems should have defined retention periods, rotation schedules, access controls, encryption, restoration procedures, and deletion or overwrite procedures.

25. Archived information

Information may be archived where there is a continuing legitimate or legal need. Archived information should have a documented purpose, access restrictions, a defined review date, and a specific retention period. Archiving must not become a mechanism for avoiding deletion obligations.

26. Anonymization

Where appropriate, the Company may anonymize information instead of deleting it. Effective anonymization should prevent the information from reasonably being used to identify an individual. Pseudonymization is not the same as anonymization; a pseudonymized dataset may still constitute personal data.

27. Deletion

When the retention period expires and no legal exception applies, information should be securely deleted. Deletion may involve database deletion, file deletion, secure media destruction, key destruction, account deletion, or secure overwrite procedures. The deletion method should be proportionate to the sensitivity of the data.

28. Physical records

Paper records containing confidential or personal information should be securely destroyed when retention expires. Methods may include cross-cut shredding, secure destruction services, or controlled disposal. Ordinary recycling should not be used for sensitive records.

29. Electronic records

Electronic records should be deleted through appropriate technical procedures. Where direct deletion is technically difficult, the Company should use reasonable alternatives such as secure deletion, cryptographic erasure, access restriction, system retirement, or controlled overwrite.

30. Data held by service providers

Third-party processors and vendors that hold Company information must be subject to appropriate contractual and operational controls, including retention, deletion, return of information, security, legal hold, backup handling, and subprocessor terms. The Company should periodically assess whether vendors comply with contractual obligations.

31. International data transfers

Where personal information is transferred internationally, retention must continue to comply with applicable privacy and transfer requirements. International transfer arrangements should not be interpreted as permission to retain personal information indefinitely.

32. Sensitive personal information

Sensitive information should receive enhanced protection. Examples include health data, biometric information, financial information, government identification numbers, authentication data, and other categories receiving heightened protection under applicable law. The Company should periodically review whether continued retention remains necessary.

33. Children's information

Information relating to children should be subject to appropriate safeguards. Where applicable law imposes special retention requirements, those requirements will be followed. Where the information is no longer necessary, it should be deleted or anonymized unless a lawful retention requirement applies.

34. Data subject deletion requests

Individuals may have rights to request deletion or erasure of personal information depending on applicable law. A deletion request does not necessarily require immediate deletion where retention is legally required or another applicable exception applies. The Company will evaluate requests according to the law applicable to the individual and the processing activity.

35. Conflicting retention requirements

Where different legal obligations conflict, the Company will conduct a documented legal assessment. The Company may retain the minimum information necessary to satisfy the legal requirement while restricting use for unrelated purposes.

36. Data minimization

The Company will seek to avoid collecting and retaining information that is not necessary. Retention decisions should therefore consider both what information the Company has and whether it still needs that information.

37. Retention schedule examples

38. Periodic review

Retention schedules should be reviewed periodically. Reviews should consider whether the original purpose still exists, whether the information remains necessary, whether applicable law has changed, whether deletion periods have changed, whether new jurisdictions apply, and whether the data can now be anonymized or deleted.

39. Automated deletion

Where practical, the Company should automate retention controls, including account expiration, automatic log deletion, database TTL controls, scheduled record deletion, backup rotation, anonymization workflows, and expiration rules for marketing lists and documents.

40. Manual deletion

Where automation is not practical, designated personnel should conduct periodic deletion reviews. Manual deletion should be documented, authorized, secure, auditable, and consistent with the retention schedule.

41. Exceptions

Exceptions may be permitted where retention is necessary for legal claims, litigation, regulatory investigations, government requests, fraud investigations, security investigations, contractual requirements, or statutory obligations. Exceptions must be documented and approved by the appropriate authority.

42. Prohibition on indefinite retention

The Company must not adopt a general practice of retaining personal information indefinitely without a documented legal, operational, archival, or other legitimate justification. Long-term retention must be specifically justified and periodically reviewed.

43. Records of processing

Where applicable, retention information should be incorporated into the Company’s records of processing activities and related privacy documentation.

44. Data protection impact assessments

Where a processing activity presents significant privacy risks, the Company should consider whether a Data Protection Impact Assessment or equivalent privacy-risk assessment is required. Retention periods should be evaluated as part of the assessment.

45. Responsibilities

Executive management approves the overall governance framework, privacy and compliance functions oversee policy and legal requirements, legal departments interpret retention obligations, information security manages secure storage and deletion, records management administers retention schedules, business owners identify relevant data and retention needs, and employees and contractors must follow this Policy and report issues.

46. Training

Relevant personnel should receive training regarding data retention, secure deletion, privacy, legal holds, record management, information classification, and incident reporting.

47. Monitoring and auditing

The Company may periodically audit compliance with this Policy. Audits may assess retention schedules, deletion processes, backup retention, vendor retention, legal holds, access controls, and exceptions. Findings should be documented and remediated according to risk.

48. Data breach and retention issues

If information that should have been deleted remains accessible because of a technical or procedural failure, the issue should be assessed under the Company’s privacy and security incident-management procedures. If information is accidentally deleted when it was legally required to be preserved, the incident should be escalated to the appropriate legal, compliance, records-management, and security personnel.

49. Policy exceptions

Requests for exceptions must be documented and approved by the appropriate authority. An exception should specify the information concerned, reason, jurisdiction, legal or business justification, duration, security controls, and review date.

50. Policy review

This Policy should be reviewed periodically and whenever there are material changes to applicable law, business operations, data-processing activities, technology, international operations, regulatory requirements, or the risk environment.

51. Regional requirements

The Company may maintain regional retention schedules or supplements for jurisdictions including the European Union, United Kingdom, United States, individual U.S. states, Canada, Brazil, Japan, South Korea, India, China, Singapore, Australia, New Zealand, and other applicable regions. Regional schedules may impose shorter or longer retention periods than the global baseline. Where mandatory local law conflicts with this Policy, the mandatory local requirement will apply.

52. Governing principle

The Company will seek to apply the principle: keep information only when there is a documented reason to keep it. That reason may include a legitimate business purpose, contractual requirement, legal or regulatory requirement, security requirement, legal claim or investigation, or other lawful documented purpose. When that reason ends, the information should be deleted, securely destroyed, or effectively anonymized unless another documented retention requirement applies.

53. Contact

Questions concerning this Policy should be directed to:

MaxX Holdings Inc.
Privacy & Compliance Team
Email: privacy@maxxholdingsinc.us
Legal Department: legal@maxxholdingsinc.us
Address: 30 N Gould St, Ste R, Sheridan, WY 82801, United States