# Data Retention & Disposal Policy

**Touch2Sign Ltd**  
**Version:** 1.0  
**Effective date:** 11 July 2026  
**Owner:** [DPO / Privacy Lead]  
**Approved by:** Robert — CEO / Managing Director  
**Next review:** 11 July 2027

---

## 1. Purpose

Define how long Touch2Sign retains customer data, audit evidence, and internal records, and how data is securely disposed of when retention periods expire or accounts are deleted. Supports GDPR storage limitation (Art 5(1)(e)), eIDAS evidence requirements, and ISO 27001 A.8.10.

## 2. Scope

Applies to:

- Customer documents and signed PDFs (S3)  
- Document metadata, recipients, and audit trails (RDS)  
- Identity verification results  
- Account, billing, and support data  
- Operational logs (CloudWatch, application logs)  
- Internal business records  

## 3. Retention principles

1. Retain data only as long as necessary for the purpose collected  
2. Honour customer organisation retention settings where configurable  
3. Meet legal and regulatory minimums for electronic signature evidence  
4. Securely delete data when retention expires — not merely deactivate access  
5. Document disposal actions for audit purposes  

## 4. Default retention periods

| Data type | Default retention | Legal / business basis |
|-----------|-------------------|------------------------|
| **Signed documents & audit trails** | **7 years** from completion | eIDAS / UK electronic signature evidence; customer contract default |
| **Unsigned / draft documents** | Per org setting; **90 days** if abandoned | Storage limitation |
| **Organisation account data** | Life of contract + **90 days** after termination | Contract; backup purge |
| **IDV verification records** | **7 years** aligned with signature evidence | Dispute resolution; regulatory challenge |
| **Billing / invoices (Stripe)** | **7 years** | Tax and accounting (Ireland) |
| **Support tickets** | **3 years** after closure | Customer service; dispute |
| **Application / CloudWatch logs** | **90 days** operational | Security monitoring |
| **Security incident records** | **3 years** minimum | ISO 27001; legal hold override |
| **Access review records** | **3 years** | Compliance evidence |
| **Employee HR records** | Per employment law | HR policy |

## 5. Organisation retention settings

Touch2Sign provides configurable retention at organisation level where product supports it:

- Minimum retention cannot fall below **1 year** without Legal approval (signature evidence risk)  
- Maximum aligns with **7-year eIDAS default** unless customer contract specifies otherwise  
- Changes logged in org audit trail  
- Customer notified of retention policy in DPA and product documentation  

## 6. Account deletion

When a customer requests account deletion or contract terminates:

| Step | Action | Timeline |
|------|--------|----------|
| 1 | Verify requester authority (org admin or DPA process) | Within 5 business days |
| 2 | Export available to customer if requested (DSAR portability) | Before deletion |
| 3 | Disable login and API access | Immediate |
| 4 | Soft-delete flag in application | Day 1 |
| 5 | Purge S3 objects (documents, signed PDFs) | Within **30 days** |
| 6 | Purge RDS rows (documents, recipients, audit_log per retention) | Within **30 days** or at retention expiry |
| 7 | Remove Cognito users for org | Within **30 days** |
| 8 | Confirm deletion to customer | Upon completion |
| 9 | Retain billing records per tax retention | Up to 7 years — anonymised where possible |

Legal hold suspends deletion until hold released by Legal.

## 7. Secure disposal methods

| Medium | Disposal method |
|--------|-----------------|
| **S3 objects** | Delete all object versions; verify bucket lifecycle completion |
| **RDS records** | Hard DELETE or table purge; vacuum where applicable |
| **RDS instance decommission** | Snapshot deleted after verification; KMS key retirement per crypto policy |
| **Backups** | Allow backup retention window to expire; no restore after purge confirmation |
| **Secrets Manager** | Delete secret version; schedule key deletion |
| **Local / laptop copies** | Secure wipe (NIST 800-88 aligned) — prohibited for production data |
| **Paper** | Cross-cut shred |

Disposal events logged with: date, data category, scope (org ID / record count), executor, verification method.

## 8. eIDAS and signature evidence

For qualified and advanced electronic signatures:

- Audit trails retained to demonstrate who signed, when, and what document hash was signed  
- Retention must support potential **7-year** regulatory or contractual challenge window  
- Early deletion of signature evidence requires Legal approval and customer written consent  

## 9. Sub-processor deletion

On account deletion or retention expiry, Touch2Sign instructs sub-processors to delete data per DPA:

- AWS: data deleted from Touch2Sign-controlled buckets and RDS  
- Stripe: retained per Stripe PCI/tax obligations — payment metadata only  
- OneID / eID Easy: deletion per provider DPA and QTSP rules  
- Anthropic: no persistent storage per API terms — confirm per DPIA  

## 10. Data subject requests

Erasure requests (GDPR Art 17) processed per **DSAR Procedure**. Erasure may be limited where retention is required for legal claims or signature evidence obligations — DPO documents justification.

## 11. Related documents

- Data Classification Policy  
- DSAR Procedure  
- Data Processing Agreement  
- Cryptography & Key Management Policy  
- HIPAA Scope Policy (PHI prohibited)  

## 12. Review

Reviewed **annually** and when product retention features or legal requirements change.

---

**Approval**

| Name | Role | Signature | Date |
|------|------|-----------|------|
| Robert | CEO | Electronic | 11 July 2026 |
| | DPO / Privacy Lead | | |