Legal / HuoPuo Support Data Retention and Secure Disposal Schedule

Definitions

Final ticket closure means the point at which the applicable support ticket is marked closed in HuoPuo’s support records and no further action is reasonably required from HuoPuo for that ticket, excluding any short administrative or quality-review period applied under HuoPuo’s internal support procedure.

Sensitive Diagnostic Information includes diagnostic materials containing special-category personal data, health information, identity documents, financial account data, authentication data, confidential business records, regulated data, large-scale personal data, or other information that presents heightened privacy, confidentiality, security, contractual, or regulatory risk.

1. General Principle

HuoPuo retains Personal Data and Customer-supplied support information only for the period reasonably necessary to fulfill the purpose for which the information was collected or otherwise processed, unless a longer retention period is required by applicable law, regulation, binding regulatory requirement, contractual obligation, or documented legal hold. Where applicable law establishes a mandatory retention period, that mandatory period shall prevail over HuoPuo’s ordinary retention schedule. Where no specific statutory retention period applies, HuoPuo shall determine and document an appropriate retention period based on the purpose of processing, the nature and sensitivity of the information, contractual requirements, applicable limitation periods, security requirements, and the risks associated with continued retention.

2. Customer Environment

HuoPuo does not remotely or directly access Customer machines, servers, databases, networks, endpoints, cloud environments, or other Customer-controlled infrastructure. Where diagnostic information is required for support, Customer selects and provides the information considered necessary for the applicable support request.

3. Data Minimization

Customers should provide only information reasonably necessary to reproduce, investigate, diagnose, or resolve the relevant technical issue. Where reasonably practicable, information provided for support should be anonymized, pseudonymized, redacted, or otherwise minimized before transmission to HuoPuo. HuoPuo may request that unnecessary Personal Data or sensitive information be removed before diagnostic material is submitted.

4. Ordinary Support Attachments

Customer-supplied logs, screenshots, diagnostic reports, configuration exports, sample files, error reports, and similar troubleshooting materials that are not subject to a specific statutory retention obligation shall be retained only for as long as reasonably necessary for the relevant support purpose. Such information shall ordinarily be deleted when no longer required and, unless a documented exception applies, no later than thirty (30) days after final closure of the applicable support ticket. The thirty-day period is a maximum ordinary HuoPuo operational retention period and does not require HuoPuo to retain information that is no longer necessary.

5. Sensitive Diagnostic Information

Diagnostic material containing sensitive or high-risk Personal Data shall be deleted as soon as reasonably practicable after it is no longer required for the applicable support purpose. HuoPuo’s operational target is to delete such material no later than seven (7) days after final ticket closure unless applicable law, Controller instructions, contractual requirements, an investigation, or a documented legal hold requires otherwise.

6. Credentials and Authentication Secrets

Customers must not provide passwords, private cryptographic keys, authentication secrets, complete payment-card credentials, CVV/CVC values, or comparable security credentials through ordinary support channels. Where such information is inadvertently received and identified, HuoPuo shall remove it as soon as reasonably practicable and may instruct Customer to revoke, rotate, or replace the affected credential.

7. Health Information

Customers should not provide identifiable patient or clinical information to HuoPuo for ordinary technical support where anonymized, synthetic, pseudonymized, or redacted information is reasonably sufficient. Where information constitutes a health record or other health information subject to a mandatory statutory retention period, HuoPuo and Customer shall apply the applicable healthcare legislation, regulatory requirements, and Controller instructions. Nothing in this Schedule authorizes destruction of information that applicable healthcare legislation requires to be retained.

8. Support Ticket Records

HuoPuo may retain support-ticket metadata, correspondence, technical findings, root-cause information, remediation records, and resolution history for operational support, service quality, audit, security, contractual administration, and the establishment, exercise, or defense of legal claims. Underlying Customer-supplied diagnostic attachments shall not be retained merely because the corresponding ticket record is retained. Where feasible, Personal Data and Customer confidential information shall be removed or minimized from retained technical knowledge and root-cause documentation.

9. Financial and Tax Records

Where information constitutes an accounting, tax, invoice, payment, or other record subject to a statutory record-keeping requirement, HuoPuo shall retain that record for the applicable statutory period notwithstanding a shorter support-data retention period. Support-data deletion periods shall not override mandatory tax, accounting, or corporate record-keeping requirements.

10. Legal and Regulatory Holds

Scheduled deletion shall be suspended for specific information where retention is reasonably necessary to comply with applicable law, a binding governmental or regulatory requirement, an active investigation, audit, litigation, anticipated litigation, or the establishment, exercise, or defense of legal claims. A legal hold shall apply only to information reasonably within the scope of the relevant matter. Information subject to a legal hold shall be access-restricted and shall be deleted or returned to the applicable retention schedule when the hold is released, unless another lawful retention ground continues to apply.

11. Backups

Deletion from HuoPuo’s active systems may not result in the instantaneous removal of every residual copy contained in protected backup media. Residual copies shall remain protected, shall not be restored or processed for ordinary business purposes, and shall expire through HuoPuo’s controlled backup-rotation process. For ordinary support information, HuoPuo shall target elimination of residual backup copies within thirty (30) days following deletion from active systems, unless a longer period is technically unavoidable or required by applicable law or documented legal hold. Where restoration of a backup causes previously deleted information to become active again, the applicable deletion controls shall be reapplied.

12. Secure Disposal

Information reaching the end of its retention period shall be securely deleted, destroyed, anonymized, or otherwise rendered inaccessible using methods appropriate to the storage technology, information classification, sensitivity, and applicable legal or regulatory requirements. HuoPuo shall maintain appropriate technical and organizational procedures governing secure disposal.

13. Earlier Deletion

Where no legal, regulatory, contractual, security, investigation, or legal-hold requirement prevents deletion, Customer-supplied support data may be deleted before the maximum period specified in this Schedule. Where legally applicable, requests for erasure or earlier deletion shall be assessed in accordance with applicable data-protection law and the instructions of the relevant Controller.

14. Retention Review

HuoPuo shall periodically review its retention schedule and update it where required by changes in applicable laws, regulations, contractual requirements, processing activities, technology, security risks, or regulatory guidance. Retention periods shall not be extended merely for convenience or applied indiscriminately to unrelated categories of information.

15. Customer-Neutral Technical Knowledge

HuoPuo may retain de-identified, anonymized, aggregated, or customer-neutral technical knowledge, root-cause patterns, remediation procedures, and product-improvement notes for longer periods, provided they do not identify Customer, reveal Customer confidential information, or contain Personal Data.

16. Contact

• ▪General Contact: info@huopuo.com

• ▪Security Contact: security@huopuo.com

• ▪Legal/Privacy Contact: legal@huopuo.com