Data Retention & Erasure Policy

NOVARIC® is committed to retaining records and personal data only for as long as they are needed for the purposes for which they were collected, or as required by applicable law, and to destroying or anonymising them securely and verifiably once those periods have expired.

This policy applies to all records held in any medium — electronic, cloud-hosted, or physical — across NOVARIC® Sh.A. (Albania) and NOVARIC® Ltd. (Malta) and all their operations.

Retention decisions are not made ad hoc. They follow the schedule and procedures in this policy. Nothing in this policy prevents the application of a legal hold where litigation, regulatory investigation, or a preservation notice is in effect.

This policy:

• defines the minimum and maximum periods for which different categories of records must be kept;
• establishes a classification framework governing how records are handled, shared and indexed;
• specifies the procedures for secure disposal and erasure;
• defines the legal hold mechanism that suspends disposal during active proceedings;
• allocates responsibility for retention decisions and disposal actions; and
• provides the legal basis for each retention category under applicable law.

This policy applies to:

It covers all records and personal data held by NOVARIC® in any medium, including:

• SharePoint Online (NOVARIC_CASES, NOVARIC_CASE_TIMELINE, NOVARIC_CASE_UPLOADS and all other lists);
• PostgreSQL database (leads, candidates, compliance_profiles, audit_log and all other tables);
• Azure Blob and file storage;
• Microsoft Exchange / Outlook mailboxes and shared mailboxes;
• Azure Active Directory / Entra ID;
• Physical paper records held in NOVARIC® offices (Shkodër, Albania; Ta' Xbiex, Malta); and
• Records held by authorised partners or processors on NOVARIC®'s behalf.

All NOVARIC® records are assigned one of four classification tiers. Classification determines retention category, access controls, encryption requirements, AI indexing eligibility and disposal method.

Downgrading a classification tier requires documented approval by the asset owner and a legal/compliance review. Upgrading may be done by the asset owner without approval.

Cross-entity visibility: NOVARIC® Sh.A. constitutional and statutory documents are Restricted to the Sh.A. Board and shareholders. Group-wide policies are Internal across all entities. Candidate and client data is Confidential per entity; cross-border transfers require a documented legal basis and DPO/Compliance approval.

Personal data is subject to GDPR Article 5(1)(e) storage limitation: it must be kept in a form that permits identification of data subjects for no longer than is necessary for the purposes for which it was collected.

Candidates

• Active candidates: retained for the duration of the active relationship. A candidate is considered active while they are engaging with NOVARIC® in connection with a placement or service.
• Unsuccessful candidates (not placed): retained for 2 years from the date of last contact. After that period, records are anonymised or destroyed unless a legal hold applies.
• Placed candidates: retained for the duration of the assignment plus 2 years. After that, records are anonymised or destroyed unless a legal hold applies.
• Case files (NOVARIC Case Progress Centre): retained for 5 years from case closure. [VERIFY against applicable law and limitation periods in origin and destination jurisdictions.]

Employees

• Employee personal data is retained for the duration of employment plus 7 years, consistent with applicable limitation periods for employment claims in Malta and Albania [VERIFY per jurisdiction].
• Special category data (health records, absence data) must be held separately with additional access controls and reviewed for earlier deletion where the specific purpose no longer applies.

Automated retention enforcement

The compliance_service.py runtime enforcement layer stores a data_retention_days field in each entity's compliance profile. When the retention period expires, the record is flagged for disposal review. The disposal review (Section 9) must then be completed by a human before any deletion occurs. Bulk automated deletion without human review is not permitted.

A legal hold suspends all disposal activity on records within a defined scope. A legal hold must be applied immediately on receipt of — or in reasonable anticipation of — a subpoena, court order, regulatory request, notice of pending litigation, or formal direction from Legal Counsel.

Legal hold procedure

1. Notice. Legal Counsel (or the Founder & Executive Director in interim) issues a written legal hold notice to all relevant custodians and to the Operations Manager / IT Administration function. The notice specifies: matter name and reference; custodians and systems in scope; relevant date range; key topics and search terms; and the anticipated preservation period.
2. Tagging. Records within scope are tagged Legal_Hold = Yes in document metadata. Tagged records are moved or copied to the 90 Archive / Legal Hold location in the relevant system.
3. Preservation. Automatic deletion is suspended. Backup and archive copies are preserved. Cloud and SaaS administrators are notified. All preservation actions are documented in LEGAL-HOLD-REGISTER.csv.
4. Review. Legal hold status is reviewed at least every 6 months by Legal Counsel and updated in the register.
5. Release. Legal Counsel issues a written release notice when the hold ends. Normal retention resumes. If another hold applies to the same records, it continues to govern. Released records enter the standard disposal review process.

All disposal decisions follow a five-step review process. No records are deleted outside this process except pursuant to a verified data subject erasure request (GDPR Article 17) handled through the Data Subject Rights Procedure.

1. Identify. Records approaching or past their retention period are identified through scheduled review (minimum annual) or triggered by the compliance_service retention flag.
2. Legal hold check. Confirm that no legal hold applies. If a legal hold is active, halt and record the reason for deferral in RETENTION-SCHEDULE.csv.
3. Confirm retention category. Verify the applicable retention period and jurisdictional requirements. Confirm that the disposal trigger event has occurred.
4. Approve disposition. The document owner or their nominated delegate approves one of: retain further (with documented justification and new review date); archive; or destroy.
5. Record. The disposal decision, date, method and approver are recorded in RETENTION-SCHEDULE.csv. For personal data: the record is also noted in the GDPR processing register.

Secure destruction methods

• Digital records: cryptographic erasure or verified overwrite to NIST SP 800-88 standard. Azure Storage supports cryptographic erasure through key deletion for customer-managed keys.
• Physical records: cross-cut shredding (DIN 66399 security level P-4 minimum for Confidential; P-5 for Restricted) or certified third-party destruction with certificate of destruction.
• Anonymisation: where destruction is disproportionate and anonymisation achieves the same data protection outcome, verified irreversible anonymisation is acceptable in place of destruction.

NOVARIC® production data resides in Microsoft Azure (West Europe data centre). Cross-border transfer of personal data for the purpose of disposal — for example, transfer to a certified destruction service located outside the EU/EEA — requires a documented lawful transfer mechanism under GDPR Chapter V.

Candidate and client data held in Albania is subject to Albanian Law 9887/2008 on the Protection of Personal Data. Cross-border transfer from Albania requires either adequacy recognition or appropriate safeguards as specified by the Albanian Information and Data Protection Commissioner.

All cross-border transfers for disposal purposes are recorded in the GDPR processing register and approved by the document owner prior to transfer.

• GDPR (EU) 2016/679, Art. 5(1)(e) — storage limitation principle
• GDPR (EU) 2016/679, Art. 17 — right to erasure (right to be forgotten)
• GDPR (EU) 2016/679, Art. 18 — right to restriction of processing
• GDPR (EU) 2016/679, Art. 5(2) — accountability principle (basis for audit trail)
• Albanian Law 9887/2008 on the Protection of Personal Data (as amended)
• Albanian Tax Procedures Law 9920/2008 [VERIFY retention periods]
• Albanian Labour Code Law 7961/1995 [VERIFY employment records retention]
• Malta Data Protection Act Cap. 586
• Malta Value Added Tax Act Cap. 406 (10-year VAT record retention)
• Malta Companies Act Cap. 386 (accounting records — 10 years)
• Malta Employment and Industrial Relations Act Cap. 452 [VERIFY payroll retention]