Data Retention Policy

This document defines how KwikID stores, retains, and manages customer data across:

• Amazon S3 (object storage)
• Database tables

It also explains how clients can export or download their data via the Admin Portal.

---

Overview

Data retention refers to how long information is stored before it is:

• Archived, or
• Permanently deleted

KwikID manages data retention in a way that:

• Meets legal and regulatory compliance requirements
• Provides transparency and controlled access to clients
• Minimizes unnecessary storage costs

---

Data Classification

Data Stored in S3

Data stored in Amazon S3 typically includes:

• KYC documents (ID proofs)
• Agent and user screen recordings
• Summary PDFs
• Log files

Data Stored in Databases

Database tables may contain:

• User and customer PII data
• KYC status and verification results
• Audit trails and access logs

---

Retention Options

Clients can configure retention behavior based on their subscription plan and regulatory requirements.

Note: Retention settings may vary based on contractual agreements and compliance requirements.

---

Data Deletion & Archival Behavior

Once data reaches the configured retention threshold:

1. Eligible data is identified automatically
2. Data is either:
   • Permanently deleted, or
   • Archived to cold storage (if configured)
3. All actions are logged for audit purposes

Deleted data cannot be recovered unless archival is enabled.

---

Downloading Data via Admin Portal

Clients can download data that is still within its active retention period.

Supported Download Methods

Session-related data can be downloaded using the following methods:

1. From the Session tab in the Admin Portal
2. From the Reports tab
3. On-demand via a Support request

Download availability depends on the configured retention policy.

---

Security & Access Control

• Access is governed by Role-Based Access Control (RBAC)
• All retention and deletion actions are auditable
• Data encryption:
  • At rest (S3 and databases)
  • In transit (HTTPS)
• Download links are time-limited and fully logged

---

Custom Retention Settings

Clients may request:

• Custom retention durations
• Archive-only retention policies
• Legal hold exceptions

All custom configurations are applied following contract approval and compliance review.

---

Compliance

KwikID's data retention practices align with:

• Applicable regulatory and legal requirements
• Client contractual obligations
• Internal security and audit standards

---

Support

For data retention changes or questions, contact:
support@getkwikid.com

---