SECURITY009 - Data retention and destruction

1.0 Overview and Purpose

The purpose of this policy is to ensure that necessary records and documents of XTRM, Inc are adequately protected and maintained and that records which are no longer needed are discarded at the appropriate time. This policy is also for the purpose of aiding employees of XTRM, Inc in understanding their obligations in retaining and destroying either physical (paper) or electronic documents - including email, text files, digital images, sound and movie files, PDF documents, and all other formatted files or paper documents.

2.0 Scope

This policy applies to employees, faculty, staff, contractors, vendors, and other personnel who are responsible for owning and managing records and documents in either paper or electronic formats.

3.0 Retention

XTRM, Inc retains data in an identifiable format for the least amount of time necessary to fulfill our legal or regulatory obligations and for our business purposes.  We may retain data for longer periods than required by law if it is in our legitimate business interests and not prohibited by law.  If an Account is closed, we may take steps to mask data and other information, but we reserve our ability to retain and access the data for so long as required to comply with applicable laws. We will continue to use and disclose such data in accordance with our Privacy Statement.

4.0 Record and Document Destruction

In accordance with applicable laws, any documents containing personal or confidential information should be destroyed so that the information cannot be practically read or reconstructed. For physical (paper) documents, this means that personal or confidential data should be destroyed with a cross-cut shredder. For electronic documents, personal or confidential data should be destroyed with the appropriate software for overwriting electronic data, disk degaussing technology or through other means of physical destruction where the information cannot be practically read or reconstructed.

5.0 Suspension of Record and Document Destruction

In the event XTRM is served with a subpoena or request for documents or any employee becomes aware of a governmental investigation or audit concerning the commencement of any litigation against or concerning XTRM, Inc, such personnel shall inform General Counsel and any further disposal of documents shall be suspended until such time as General Counsel determines otherwise. General Counsel shall take such steps as is necessary to promptly inform appropriate staff of any suspension in the further disposal of documents. Upon notice from General Counsel, the data in question will be made available for legal holds; automatic archiving will be turned off; and all backup media within scope will be removed from the general rotation backup cycle and held in a designated location as needed. Once the litigation is terminated or settled, General Counsel will notify the appropriate individuals so that documents and data media can be put back into general rotation, archiving can be turned back on and relevant data stored for the legal hold can be deleted.

6.0 Enforcement

Anyone found to have violated this policy may be subject to disciplinary action, up to and including immediate termination.