Document information and change log

Document Information

Change log

Gender And Entity Neutrality

The masculine form is used solely for the sake of better readability. It always refers to persons of any gender identity (m/f/diverse). This document uses the abbreviation “Give” for all legal entities and subsidiaries.

Table of Contents

I. PCI Data Retention and Disposal Policy        4

1. Purpose        4

2. Scope        4

3. Sensitive Data        4

Transmission Restrictions        5

Retention of Expired Card Data        5

5. Compliance Monitoring        6

6. Training and Awareness        6

7. Enforcement        6

8. Review and Revision        6

II. Record Retention and Disposal Policy        6

A. Introduction        6

B. Paper records storage        6

C. Destruction of records        7

D. Records of Destructions        7

E. Review        7

F. Disposal Schedule - Customer/Merchant Operational Information        7

Finance Records        12

Disposal Schedule - Governance and Operations: Human Resources and Payroll Records        15

1. PCI Data Retention and Disposal Policy

1. Purpose

The purpose of this policy is to define the retention and disposal requirements for all credit card data stored or processed by Give Corporation, in compliance with the Payment Card Industry Data Security Standards (PCI DSS).

2. Scope

This policy applies to all employees, contractors, and third-party service providers who handle credit card data on behalf of Give Corporation.

3. Sensitive Data

It is critical to protect sensitive data. Most of the data protection policy is addressed in the Information Security Policy sections which cover access control, strong authentication, encryption, monitoring and alerts etc.

In addition to what was covered thus far, Data protection also must include a policy for retention and disposal. Please reference Data Retention and Disposal Policy.

Give Corporation shall retain credit card data only for the period necessary to fulfill business, legal, and regulatory requirements, and shall securely dispose of such data after the retention period has expired.

The retention periods for credit card data shall be determined as follows:

• Primary Account Numbers (PANs) in plaintext, Card Verification Value (CVV) and Magnetic Stripe Data shall not be stored after authorization.
• Tokenized PANs associated with the risk profile, future payment, recurring payment or subscription service may be stored for the duration of the service or as required by law or specific business need.
• Cardholder data that is associated with the risk profile, future payment, recurring payment or subscription service may be stored for the duration of the service, or as required by law or specific business need.
• Security-related data (such as logs, audit trails, and security incident reports) shall be retained for a minimum of 1 year.
• Only authorized administrators can copy or export PAN data. Any other user with access to PAN data must have revoked privileges to export or copy tables with PAN data.
•  Truncated Card Number Access. Our system enforces strict access controls:

• Merchants can only view truncated card numbers for their own accounts.
• Acquirer users can view truncated card numbers across all accounts.

Access to truncated PAN is necessary for operational purposes, allowing authorized personnel to verify transaction details, resolve customer and merchant inquiries, and support fraud and risk investigations — all without exposing the full card number.

• Data will be inventoried and reviewed at least annually by key custodians for relevance and retention requirements.

Transmission Restrictions

The transmission of credit card data via Slack or any other instant messaging or end-user messaging service is strictly prohibited. This ensures that sensitive data is not shared over insecure or non-compliant channels.

Retention of Expired Card Data

Give Corporation retains expired card data for a maximum of two (2) years after the card’s expiration date. During this retention period, expired cards may continue to be processed through the Visa Account Updater (VAU) and Mastercard Automatic Billing Updater (ABU) services where applicable. At the end of the two-year retention period, all expired card data is securely deleted in accordance with Give Corporation’s data deletion procedures and applicable PCI DSS standards. This retention policy ensures operational continuity while minimizing the storage of cardholder data that no longer has business or legal value.

4. Disposal Requirements

Give Corporation shall dispose of credit card data in a secure and irreversible manner to prevent unauthorized access or retrieval. The disposal methods shall be appropriate to the sensitivity of the data and shall include at least one of the following:

• Physical destruction (such as shredding or incineration) of paper documents or storage media.
• Electronic erasure or destruction of electronic media (such as hard drives, tapes, or flash memory).
• Secure deletion criteria via DOD or NIST standards.

Prior to deletion, sensitive PCI card data such as the PAN must undergo a secure sanitization process. This includes replacing the PCIDigest by setting all its bytes to zero, ensuring that no residual sensitive information remains accessible or recoverable.

This process ensures that sensitive credit card information is not recoverable and complies with both regulatory requirements and industry best practices.

5. Compliance Monitoring

Give Corporation shall periodically review and test the effectiveness of this policy and its related procedures to ensure ongoing compliance with PCI DSS requirements.

6. Training and Awareness

Give Corporation shall provide regular training and awareness programs to all employees, contractors, and third-party service providers who handle credit card data, to ensure their understanding and adherence to this policy for retention and disposal.

7. Enforcement

Any employee, contractor, or third-party service provider found to have violated this policy shall be subject to disciplinary action, up to and including termination of employment or contract. Additionally, any violation of this policy that results in a data breach or other security incident shall be promptly reported to the appropriate authorities and subject to legal and regulatory consequences - use Incident Response Procedure.

8. Review and Revision

This policy shall be reviewed and updated as necessary to reflect changes in Give Corporation’s business practices, legal or regulatory requirements, or PCI DSS standards.

II. Record Retention and Disposal Policy

A. Introduction

This policy is to detail the procedures for the retention and disposal of information to ensure that we carry this out consistently and that we fully document any actions taken. Unless otherwise specified the retention and disposal policy refers to both hard and soft copy documents.

B. Paper records storage

Records should be kept for as long as they are needed to meet the operational needs of Give, together with legal and regulatory requirements.

Give regularly reviews the retention periods for different categories of information to determine whether they should be destroyed or retained for a further period. However, detailed in the record retention schedule below are the retention periods Give applies to the relevant information, unless otherwise advised by Give’s Compliance Officer, a judicial order, law enforcement request or members of the Senior Management team.

C. Destruction of records

Records can be destroyed in the following ways:

• Non-sensitive information – can be placed in a normal rubbish bin
• Confidential information – crosscut shredded and pulped or burnt.
• Electronic equipment containing information - they will be permanently deleted from the system.

Destruction of electronic records should render them non-recoverable even using forensic data recovery techniques.

D. Records of Destructions

Give may not document the disposal of records which have been listed on the records retention schedule. Documents disposed of other than in accordance with that schedule (either by being disposed of earlier or kept for longer than listed) will need to be recorded for audit purposes.

E. Review

Responsibility for reviewing this policy (including reviewing the retention periods for different categories of information) rests with the Compliance Officer. The policy should be reviewed annually.

F. Disposal Schedule - Customer/Merchant Operational Information

Finance Records

Disposal Schedule - Governance and Operations: Human Resources and Payroll Records

The information contained herein is intended to provide a general overview of the Company’s policies and procedures relating to compliance with this Policy and does not constitute legal advice or a complete description of the laws and regulations relating to this Policy. The Company has made every effort to ensure the accuracy and completeness of this Policy.  This document is intended to provide guidance to employees of Company on how to comply with applicable laws and regulations related to this Policy. Employees should consult with the Legal or Compliance Department if they have any questions about the Policy or how to comply with it. Company reserves the right to modify or update this Policy at any time without notice. Employees are responsible for reviewing the Policy on a regular basis to ensure that they are aware of any changes. This Policy applies to all employees of Company, regardless of their position or location unless stated otherwise in the Policy. Employees are responsible for complying with the Policy and for reporting any suspected violations to their respective supervisor, the Legal Department, AMLCO or respective recipient of such violation as outlined in this Policy.