Coldest River Software, LLC

Document and Record Retention Policy

1. Purpose

The purpose of this Document and Record Retention Policy (“Policy”) is to ensure that necessary Records and documents of Coldest River Software, LLC (“Coldest River”) are adequately protected and maintained and to ensure Records that are no longer needed by Coldest River or are of no value are discarded at the appropriate time. This Policy is also designed to help Coldest River employees understand their obligations concerning the retention of electronic documents – including email, text files, PDF documents, research documents, and all other formatted files.

2. Policy

Coldest River prohibits the inappropriate destruction of any records, files, documents, samples, and other forms of information. This Policy is in accordance with the Sarbanes-Oxley Act of 2002, under which it is a crime to change, conceal, falsify, or destroy any record with the intent to impede or obstruct any official or government proceeding. Therefore, this Policy is part of a Coldest River-wide system for the review, retention, and destruction of Records Coldest River creates or receives in connection with the business it conducts.

3. Types of Documents

This Policy explains the different Records, disposable information, and Confidential Information belonging to others.

• Records: A record is any type of information created, received, or transmitted in the transaction of Coldest River’s business, regardless of physical format. Examples of where the various types of information are located include:
  • Appointment books and calendars
  • Audio and video recordings
  • Computer programs
  • Contracts
  • Electronic files
  • E-mails (see below)
  • Handwritten notes
  • Invoices
  • Letters and other correspondence
  • Magnetic tape
  • Memory in cell phones (relating to Coldest River business)
  • Online posts, such as on Facebook, Twitter, Instagram, Snapchat, TikTok, and other social media platforms and websites
  • Performance reviews
  • Test samples
  • Voicemails
• E-Mail Records: any document created, transmitted, or received on an email system, including the message, its text and any attachments, such as word processed documents, spreadsheets, and graphics that may be transmitted with a message, or with an envelope containing no message.
  • E-Mail Records include transmission data that identifies the sender and the recipient(s) and the date and time the message was sent and/or received;
  • When e-mail is sent to a distribution list, information identifying all parties on the list is retained for as long as the message is retained; and
  • If the e-mail system uses codes, or aliases to identify senders or recipients, a record of their real names is kept for as long as any Record containing only the codes or aliases. A record must be kept of who they are—this might be done simply by always including their full name in the body of the message (i.e. John Smith).
• Confidential Information: means all technical and business information that is orally or visually designated as “confidential” or “proprietary” or by the nature of the information would reasonably be understood to be confidential. Confidential Information includes, without limitation, Personal Information, Coldest River content, concepts, research and development objectives, product ideas and developments, product specifications, product or component samples, data, designs, sketches, photographs, drawings, reports, marketing plans, market research, marketing and sales information, financial information, cost information, studies, findings, inventions, ideas, know-how, all intellectual property, and any other information and materials relating to Coldest River’s business, finances, products, customers, personnel, business processes, infrastructure, IT resources and technology systems, and any materials that Coldest River obtained from a third party subject to an obligation of confidentiality.
• Disposable Information: Disposable information consists of information that may be discarded or deleted at the discretion of the user once it has served its temporary useful purpose and/or information that may be safely destroyed because it is not a Record as defined by this Policy. Examples may include:
  • Duplicates of originals that have not been annotated
  • Preliminary drafts of letters, memoranda, reports, worksheets, and informal notes that do not represent significant steps or decisions in the preparation of an official record
  • Books, periodicals, manuals, training binders, and other printed materials obtained from sources outside of Coldest River and retained primarily for reference purposes
  • Copies of memoranda or text sent for information rather than action
  • Instruction memoranda or information bulletins
  • Messages that have only temporary value such as a message that a meeting time has changed
  • Spam and junk mail
• Confidential Information Belonging to Others: Any Confidential Information or Records that an employee may have obtained from a source outside of Coldest River, such as a previous employer, must not, so long as such information remains confidential, be disclosed to or used by Coldest River. Unsolicited Confidential Information submitted to Coldest River should be refused, returned to the sender where possible, and deleted, if received via the internet.

4. Administration

Attached as Appendix A is a Record Retention Schedule that is approved as the initial maintenance, retention, and disposal schedule for physical records of Coldest River and the retention and disposal schedule of electronic documents. [NAME OF EMPLOYEE] is in charge of the administration of this Policy and the implementation of processes and procedures to ensure that the Record Retention Schedule is followed (the “Records Administrator”). The Records Administrator is also authorized to:

• Make modifications to the Record Retention Schedule from time to time to ensure that it is in compliance with local, state, and federal (U.S. and Canada) laws and includes the appropriate document and record categories for Coldest River;
• Monitor local, state, and federal (U.S. and Canada) laws affecting record retention;
• Monitor Coldest River’s compliance with this Policy; and
• Annually review and make revisions to this Policy.

Any paper Records and electronic files that are part of any of the categories listed in the Record Retention Schedule, must be retained for the amount of time indicated in the Record Retention Schedule. A Record must not be retained beyond the period indicated in the Record Retention Schedule, unless a valid business reason (or a litigation hold or other special situation) calls for its continued retention. If you are unsure whether to retain a certain record, contact the Records Administrator.

5. Suspension of Record Disposal In Event of Litigation or Claims

In the event Coldest River is on notice of a potential legal claim or served with any subpoena or request for documents, or any employee becomes aware of a governmental investigation or audit concerning Coldest River or the commencement of any litigation against or concerning Coldest River, such employee shall immediately inform the Records Administrator and any further disposal of documents shall be suspended until such time as the Records Administrator, with advice of Legal Counsel, determines otherwise. The Records Administrator shall take all such steps as are necessary to promptly inform all Coldest River employees of any suspension in the further disposal of documents.

6. Applicability

This Policy applies to all physical and electronic Records generated in the course of Coldest River’s operation, including both original documents and reproductions. It does not apply to Vendor Records, except for those Records provided to us, as we rely upon Vendors to set appropriate retention policies and schedules. This Policy also applies to electronic documents described above.

7. Responsibility/Mandatory Compliance

Coldest River strives to comply with the laws, rules, and regulations that govern it and with recognized compliance practices. All Coldest River employees must comply with this Policy, the Records Retention Schedule and any litigation hold communications. Failure to do so may subject Coldest River, its employees, and owners to serious civil and/or criminal liability. An employee’s failure to comply with this Policy may result in disciplinary sanctions, including suspension or termination.

8. Reporting Policy Violations

Coldest River is committed to enforcing this Policy as it applies to all forms of Records. The effectiveness of Coldest River’s efforts, however, depends largely on employees. If you feel that you or someone else may have violated this Policy, you should report the incident immediately to your supervisor. If employees do not report inappropriate conduct, Coldest River may not become aware of a possible violation of this Policy and may not be able to take appropriate corrective action. No one will be subject to and Coldest River prohibits, any form of discipline, reprisal, intimidation, or retaliation for reporting incidents of inappropriate conduct of any kind, pursuing any Record destruction claim, or cooperating in related investigations.

9. How to Store and Destroy Records

The destruction of electronic Records must be coordinated with the Information Technology staff.

• Storage: Coldest River’s Records must be stored in a safe, secure, and accessible manner. Any documents and financial files that are essential to Coldest River’s business operations during a Disaster must be duplicated and/or backed up at least once per week and maintained off site in a segregated system.
• Destruction: Coldest River’s Records Administrator is responsible for the continuing process of identifying the Records that have met their required retention period and supervising their destruction.
• Destruction by Category of Records
  • High = Records that contain private or restricted information, Confidential Information, Sensitive Personal Information, or Personal Information. These records must be destroyed in a secure manner such as incineration, maceration, shredding, pulping, or secure electronic destruction.
  • Medium = Records that do not contain PI, but do contain potentially important business information (e.g., client contracts). Medium category records should be destroyed through the methods for High category records.
  • Low = All other Records that do not fit into one of the above categories (e.g., marketing material) and can be destroyed by placing in trash or recycling, or via electronic destruction, as well as in the manner described for high category Records.

10. Approval and Revision

Coldest River reviews and confirms each revision of this Policy. Review of this Policy by the Records Administrator will occur on an annual basis. Each revision of this Policy will be reviewed and approved by separate individuals, and will be documented within the table below.

Appendix A
Record Retention Schedule

The Record Retention Schedule is organized as follow:

SECTION TOPIC

1. A. Accounting and Finance
2. B. Corporate Documents
3. C. Correspondence and Internal Memoranda
4. D. Electronic Documents
5. E. Coldest River Issued Device(s)
6. F. Legal and Insurance Records
7. G. Research Data
8. H. Personnel Records
9. I. Payroll Records
10. J. Tax Records

CATEGORIES OF DOCUMENTS

Low
Medium
High

1. Accounting and Finance

2. Corporate Documents

3. Correspondence and Internal Memoranda

Most correspondence and internal memoranda should be retained for the same period as the document they pertain to or support. For instance, a letter pertaining to a particular contract would be retained as long as the contract (15 years after expiration). It is recommended that Records that support a particular project be kept with the project and take on the retention time of that particular project file.

Correspondence or memoranda that do not pertain to documents having a prescribed retention period should generally be discarded sooner. These may be divided into two general categories:

1. A. Routine Matters. Those pertaining to routine matters and having no significant, lasting consequences should be discarded within two years. Some examples include:
   1. i. Routine letters and notes that require no acknowledgment or follow-up, such as notes of appreciation, congratulations, letters of transmittal, and plans for meetings.
   2. ii. Form letters that require no follow-up.
   3. iii. Letters of general inquiry and replies that complete a cycle of correspondence.
   4. iv. Letters or complaints requesting specific action that have no further value after changes are made or action taken (such as name or address change).
   5. v. Other letters of inconsequential subject matter or that definitely close correspondence to which no further reference will be necessary.
   6. vi. Chronological correspondence files.

Please note that copies of interoffice correspondence and documents where a copy will be in the originating department file should be read and destroyed, unless that information provides reference to or direction to other documents and must be kept for project traceability.

1. B. Non-Routine Matters. Those pertaining to non-routine matters or having significant lasting consequences should generally be retained permanently.

4. Electronic Documents

1. B. Electronic Mail: Not all emails need to be retained, depending on the subject matter.
   1. i. Employees will strive to keep all but an insignificant minority of their emails related to business issues.
   2. ii. Coldest River will archive emails for three years after the staff has deleted it, after which time the emails will be permanently deleted.
   3. iii. Coldest River will retain email accounts of former employees for four years after their exit date.
   4. iv. Employees will not store or transfer Coldest River-related emails on non-work-related computers except as necessary or appropriate for Coldest River’s purposes.
   5. v. Employees will take care not to send Confidential Information to outside sources.
   6. vi. Any email an employee deems vital to the performance of their job should be copied to the employee’s internal drive folder, and printed and stored in the employee’s workspace.
2. C. Electronic Documents: including Google Drive and PDF files. Retention also depends on subject matter and whether the documents are included within project files.
   1. i. PDF Documents. The length of time that the PDF should be retained should be based upon the content of the file and the category under the various sections of this Policy. The maximum period a PDF file should be retained is 6 years. PDF files the employee deems vital to the performance of his or her job should be printed and stored in the employee’s workspace.
   2. ii. Text/formatted Files. Coldest River employees will conduct annual reviews of all text/formatted files (e.g., Google documents) and will delete all those they consider unnecessary or outdated. After five years, all text files will be deleted from the network and the employee’s laptop. Text/formatted files the employee deems vital to his or her job performance should be printed and/or stored electronically in the employee’s workspace.
   3. iii. Project Files. Coldest River may retain files in Google Drive or a similar platform indefinitely, including emails, work product, contracts, and other documents, so long as those documents do not contain personal information or are otherwise required to be destroyed or returned by client contract. Documents and materials containing personal information must be treated in accordance with the specific timelines herein.

5. Coldest River-Issued Devices

Upon termination, the employee’s laptop and any other Device must be turned into the IT coordinator. All data contained on the laptop and electronic devices will be imaged and stored on an archival drive for four years and then deleted, unless another section of this Policy applies to the specific data.

6. Legal and Insurance Records

7. Customer Service Data

8. Personnel Records

9. Payroll Records

10. Tax Records

14373784.1