Data Retention and Disposal Policy

Last update: February 10, 2026

1. Introduction

This Data Retention and Disposal Policy ("Policy") describes how Progresus S.A.S. ("Progresus", "CheckOP", "we", "us", "our" or "our") manages the retention, storage and disposal of data of customers using the CheckOP platform.

This Policy forms an integral part of CheckOP's Terms and Conditions of Service, Privacy Policy and Data Processing Agreement.

2. Data Retention Principles

2.1 Retention Limitation Principle

Progresus retains personal data and customer information only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law.

2.2 Guiding Principles

Data retention is governed by the following principles:

• Necessity: Data is retained only as long as it is necessary to provide the Service.
• Proportionality: The retention period isproportionate to the purpose of the processing.
• Security: Data is kept protected throughout the retention period.
• Compliance: Applicable legal and regulatory requirements are respected.

3. Data Categories and Retention Periods

3.1 Active Customer Data

Definition: Data associated with customers with current and active subscriptions.

Retention Period: Customer data is retained for as long as the customer remains an active customer with a current subscription.

Access: The customer has full access to their data through the platform and can use the export functions available.

3.2 Terminating Customer Data

Definition: Data of customers whose subscription has ended, either by cancellation, non-renewal or termination of the contract.

Retention Period:

• Production database: Data is deleted within ninety (90) days after termination of the relationship, upon written request from the customer.
• Without express request: Data may be deleted after an established period according to Progresus' internal policies.

Process: The customer must request deletion in writing prior to the termination of the contract or within the grace period.

3.3 Backups and Backups

Definition: Information stored in backups, snapshots and backups.

Retention Period: Information in backups is not constantly purged, but ages naturally in the repositories according to the life cycle of the information.

Characteristics:

• Daily backups are retained for a minimum of seven (7) days.
• Backups are progressively overwritten according to the rotation scheme
• Complete deletion of backup data may take additional time after production deletion.

3.4 Activity and Audit Logs

Definition: Logs of system access, activities, modifications and events.

Retention Period: Progresus retains activity logs to:

• Provide traceability to customers.
• Comply with security requirements
• Facilitate incident resolution
• Comply with legal or regulatory obligations

Specific periods depend on the type of record and applicable requirements.

3.5 Billing and Transaction Data

Definition: Information related to billing, payment and business transactions.

Retention Period: Depending on applicable tax and business law requirements, typically between five (5) and ten (10) years from the date of the transaction.

3.6 Support Communications

Definition: Support tickets, emails and other communications related to technical assistance.

Retention Period: Retained as long as useful for providing ongoing support and historical reference, subject to periodic review.

4. Legal Obligation Retention

4.1 Legal Requirements

Regardless of Customer requests, Progresus may retain certain data when:

• It is required by applicable law.
• It is necessary to comply with tax, accounting or regulatory obligations
• Required by judicial or administrative orders
• It is necessary to establish, exercise or defend legal claims.

4.2 Types of Data Retained by Obligation

Data that may be retained under legal compulsion includes:

• Security-related records and metadata
• Information required for tax compliance
• Data required for legal investigations or audits
• Information needed to resolve disputes

4.3 Minimization

When information is withheld because of a legal obligation, Progresus:

• Limit access to such information
• Maintain the information in a secure manner
• Delete the information when it is no longer required by law.

5. Deletion of Data

5.1 Deletion at Customer Request

Active customers may request deletion of specific data through:

Self-Service:

• Deletion tools available on the platform for certain types of data.
• Deleting individual records (customers, tasks, users, etc.)
• Configuration of retention policies when available.

Request to Support:

• For mass deletions or data that cannot be deleted via self-service.
• Via support portal (support.checkop.co) or email (soporte@checkop.co)

5.2 Deletion at End of Relationship.

Standard process:

1. Customer notifies termination of subscription.
2. Customer is advised to export all data they wish to retain prior to termination.
3. The customer can request in writing the deletion of his data
4. Progresus proceeds with the deletion within the established timeframe (90 days)
5. Deletion is confirmed to the customer upon request

5.3 Methods of Deletion

Data deletion is performed by:

• Logical deletion: Marking records as deleted, making them inaccessible.
• Physical deletion: Final deletion from the production database.
• Anonymization: Where appropriate, data may be anonymized rather than deleted.

5.4 Verification of Deletion.

After deletion:

• Data will no longer be accessible through the Service.
• Data will be removed from the production databases
• Data in backup copies will age naturally according to the rotation cycle
• Customer may request written confirmation of deletion.

6. Data Export

6.1 Export Right

Customers have the right to export their data prior to the termination of their subscription. CheckOP provides export functionalities through the platform.

6.2 Export Formats

Data can be exported in standard formats, typically:

• CSV/XLSX for tabular data
• PDF for reports and documents
• Other formats depending on available functionalities

6.3 Export Deadline

The customer is advised to complete any necessary data exports prior to the termination date of their subscription. After termination, access to the Service may not be available.

6.4 Export Assistance

The support team can assist with data export queries through the usual support channels.

7. Customer Responsibilities

7.1 Data Management

The customer is responsible for:

• Determining what data to store on the platform
• Managing the accuracy and updating of its data
• Deleting data that is no longer needed using available tools
• Complying with its own data retention obligations.

7.2 Timely Export

The customer is responsible for exporting the data it wishes to retain prior to:

• The termination of your subscription
• The requested deletion of specific data
• Any action that results in loss of access to the data.

7.3 Own Backups

Although Progresus maintains system backups, the customer is advised to:

• Maintain own copies of critical information
• Do not rely exclusively on Progresus backups for business-specific recovery.
• Implement their own backup procedures for critical information.

8. Security During Retention

8.1 Protection of Stored Data

During the entire retention period, data is protected by:

• Encryption at rest (AES-256)
• Role-based access controls
• Continuous security monitoring
• Cloud infrastructure protections

8.2 Backup Protection

Backups are protected by:

• Access control restrictions on infrastructure networks.
• Access control lists on the file systems
• Database security protections
• Storage in durable and secure services

9. Exceptions and Special Circumstances

9.1 Security Investigations

In case of security investigations or incidents, Progresus may retain relevant data as long as necessary to complete the investigation and take corrective action.

9.2 Legal Disputes

If there is a pending or anticipated legal dispute, Progresus may retain relevant data as potential evidence, even if it would otherwise be eligible for disposal.

9.3 Requests from Authorities

Progresus may be required to retain data in response to requests from governmental or judicial authorities, as required by applicable law.

10. Review and Update

10.1 Policy Review

This Policy is reviewed periodically to ensure that it reflects current practices and complies with applicable legal requirements.

10.2 Notification of Changes

Significant changes to this Policy will be notified to customers through appropriate channels with reasonable advance notice.

11. Contact

For inquiries related to data retention or deletion:

Progresus S.A.S.

• E-mail: soporte@checkop.co
• Support Portal: https://support.checkop.co

For data deletion requests, please include:

• Account or company name
• Specific description of the data to be deleted
• Confirmation that you have exported the data you wish to keep
• Confirmation that you understand that the deletion is irreversible

This Data Retention and Deletion Policy is an integral part of CheckOP's Terms and Conditions of Service.