1. Purpose

This policy establishes a structured framework for:

• • Defining data classification standards
• • Establishing retention schedules
• • Implementing secure deletion procedures
• • Ensuring regulatory compliance
• • Reducing legal, financial, and cybersecurity risk

This policy operationalizes retention and deletion controls aligned with:

• • GLBA (Gramm-Leach-Bliley Act)
• • FTC Safeguards Rule
• • U.S. federal and state consumer lending laws
• • Applicable Mexican and Latin American data protection regulations (where ACP operates)
• • Contractual obligations with lenders, servicers, and bureaus

This policy applies to:

• • All Aureon systems (cloud-hosted, SaaS, local endpoints)
• • Loan origination systems
• • CRM and marketing platforms
• • Accounting and servicing records
• • Email and communications
• • Physical documents
• • Backup archives
• • Third-party vendors processing Aureon data

4.1 Consumer Loan & Lending Records

4.2 Marketing & CRM Data

4.3 Corporate & Financial Records

4.4 Employee & Contractor Records

4.5 Security & Technology Logs

When litigation, audit, investigation, or regulatory inquiry is anticipated or active:

• • Automatic deletion is suspended
• • Relevant custodians are notified
• • Backup deletion is paused for relevant systems
• • Documentation of hold scope is maintained

Only General Counsel or Executive Management may lift a legal hold.

6.1 Digital Records

Aureon shall use:

• • Cryptographic erasure (for encrypted systems)
• • NIST SP 800-88 compliant overwriting
• • Secure wipe protocols for SSD/HDD disposal
• • Vendor-certified destruction certificates

Deletion must render data irrecoverable.

6.2 Cloud & SaaS Platforms

Vendors must:

• • Contractually commit to secure deletion
• • Provide deletion confirmation upon request
• • Maintain documented destruction procedures
• • Purge from backups within defined retention cycles

Vendor compliance must be reviewed annually.

6.3 Physical Records

• • Cross-cut shredding (minimum P-4 standard)
• • Locked destruction bins
• • Certified document destruction vendors
• • Destruction log maintained

For jurisdictions recognizing data rights:

Individuals may request:

• • Access to stored personal data
• • Correction of inaccurate data
• • Deletion (subject to legal retention requirements)
• • Restriction of processing

If deletion conflicts with regulatory retention requirements, Aureon will:

• • Restrict processing
• • Retain only required minimum data
• • Document the legal basis for retention

• • Encrypted backups maintained separately from production
• • Retention aligned with primary system schedule
• • Backup purging automated
• • Quarterly review of backup integrity
• • No indefinite backup retention permitted

• • Annual retention audit
• • Quarterly deletion verification sampling
• • Vendor compliance review
• • Access log review
• • Incident documentation

Any deviation must be remediated within 30 days.

Improper retention or unauthorized deletion may result in:

• • Internal disciplinary action
• • Vendor termination
• • Regulatory reporting obligations

This policy shall be reviewed annually or upon:

• • Regulatory change
• • New product launch
• • New jurisdiction expansion
• • Major technology change

This policy ensures Aureon:

• • Minimizes liability exposure
• • Reduces cyber risk surface area
• • Maintains regulatory defensibility
• • Controls data sprawl
• • Aligns with U.S. and cross-border financial compliance standards