Run: Records Retention Policy

This policy establishes the standards for classifying, retaining, preserving, and securely disposing of business records. The policy is designed to support legal compliance, efficient information management, and timely destruction of records that are no longer required. The company will maintain records in accordance with applicable law, including recordkeeping obligations under the **EEOC**, **FLSA**, **FMLA**, **ADA**, **Title VII of the Civil Rights Act**, and any applicable state or local requirements.

This policy applies to all employees, contractors, temporary workers, and third parties who create, receive, store, manage, or dispose of company records. It applies to records in all formats, including: - Paper files - Email and attachments - Chat and collaboration messages - Spreadsheets and reports - Databases and system exports - Audio, video, and scanned documents - Cloud storage and shared drives **California employees:** records containing personal information must also be handled in a manner consistent with applicable privacy obligations, including secure storage and disposal practices where required by law. **All employees:** must follow any separate department-specific retention schedule if one has been approved by Legal or Compliance.

For purposes of this policy, the following terms apply: - **Business Record:** Any information created or received in the course of business. - **Retention Schedule:** The approved schedule that identifies how long records must be retained. - **Legal Hold:** A preservation requirement that suspends normal destruction of records. - **Secure Disposal:** A method of destroying or deleting records so they cannot reasonably be reconstructed. - **Record Owner / Policy Holder:** The business function or designated individual responsible for the accuracy, retention, and disposition of a record category.

1. **Record Classification** - Records must be classified by business function and sensitivity level (for example: HR, payroll, recruiting, finance, legal, operations, confidential, restricted). - Each record category must have an assigned record owner and an approved retention period. - Records containing PII, health information, payroll data, or confidential business information must be labeled and protected according to their sensitivity. 2. **Retention Requirements** - Records must be retained for the longer of: (a) the company’s approved retention schedule, or (b) the period required by applicable law, regulation, contract, audit, or litigation hold. - HR records must be retained in a manner consistent with applicable EEOC and FLSA recordkeeping requirements. - Payroll and wage records must be retained for the period required by the FLSA and any applicable state wage-hour law. - Records related to employment decisions, accommodations, leave, complaints, investigations, and disciplinary actions must be retained according to the approved schedule and any applicable legal requirement. 3. **Legal Hold** - When Legal or Compliance issues a legal hold, all normal destruction of relevant records must stop immediately. - Employees must preserve all potentially relevant records, including paper files, email, chat messages, drafts, backups, and system-generated data, until the hold is lifted in writing. - No record subject to a legal hold may be altered, deleted, overwritten, or disposed of without written authorization from Legal. 4. **Secure Disposal** - Records may be destroyed only after the retention period has expired and no legal hold, audit, investigation, or other preservation requirement applies. - Paper records must be shredded, pulped, or otherwise destroyed using approved secure methods. - Electronic records must be securely deleted or wiped using approved IT methods that prevent reasonable reconstruction. - Third-party destruction vendors must be approved by the company and, where appropriate, must provide a certificate of destruction. 5. **Exceptions** - Any exception to this policy must be approved in writing by Legal, Compliance, or the designated policy holder. - If a record category is not listed in the retention schedule, employees must retain the record until guidance is received from Legal or Compliance.

1. **Create and Classify Records** - Identify the record type and business function at the time of creation or receipt. - Assign the record to the appropriate retention category and storage location. - Mark records containing sensitive information with the required confidentiality designation. 2. **Store and Protect Records** - Store records in approved systems or repositories. - Restrict access based on role and business need. - Maintain records so they remain complete, accurate, and retrievable for the full retention period. 3. **Apply Retention Schedule** - The record owner must follow the approved retention schedule for each category. - HR, payroll, and recruiting records must be reviewed periodically to confirm the retention period, legal requirements, and any pending hold. - If a record is subject to multiple retention rules, the longest applicable retention period controls unless Legal directs otherwise. 4. **Issue and Manage Legal Holds** - Legal or Compliance will notify relevant employees when a legal hold is issued. - Recipients must acknowledge the hold and preserve all relevant records immediately. - The hold remains in effect until Legal issues a written release. 5. **Dispose of Records Securely** - Before destruction, confirm that the retention period has expired and no hold applies. - Use approved destruction methods based on record format and sensitivity. - Document destruction activity when required by the retention schedule or Legal. 6. **Escalation** - Any suspected loss, unauthorized destruction, or accidental deletion of records must be reported immediately to HR, Legal, Compliance, or IT Security. - Do not attempt to recreate, conceal, or overwrite records without direction from Legal or IT.

- **Policy Holder / Legal:** approves the retention schedule, issues and lifts legal holds, and interprets legal retention requirements. - **HR:** manages employee-related records, including personnel files, leave records, disciplinary records, and accommodation documentation. - **Finance / Payroll:** manages wage, tax, and payroll records in accordance with applicable law. - **IT:** maintains secure storage, access controls, backup procedures, and approved deletion methods. - **Managers:** ensure records within their teams are classified, retained, and escalated appropriately. - **All Employees:** create, store, preserve, and dispose of records in accordance with this policy and report concerns promptly.

Failure to follow this policy may result in disciplinary action, up to and including termination of employment, subject to applicable law and any collective bargaining agreement. Examples of policy violations include: - Destroying records before the retention period expires - Ignoring a legal hold - Storing records in unauthorized systems - Sharing confidential records without authorization - Failing to report accidental deletion, loss, or suspected tampering Where appropriate, the company may also take corrective action such as retraining, a documented warning, or a performance improvement plan (PIP).

This policy will be reviewed at least annually and updated as needed to reflect changes in law, business operations, retention schedules, or technology. Revisions must be approved by Legal or the designated policy holder. Updated versions should be communicated to affected employees and acknowledged when required.