Effective Date: April 23, 2026

Data Retention and Disposal Policy

Version 1.0

Document Information

Document Name	Data Retention and Disposal Policy
Version	1.0
Effective Date	April 23, 2026
Applies To	All employees, contractors, systems, and third-party service providers
Review Frequency	Periodic
Owner	Sandman Sports, LLC
Classification	Internal / Confidential

1. Purpose

This Data Retention and Disposal Policy establishes guidelines for the retention, storage, and secure disposal of data maintained by Sandman Sports LLC ("Sandman Sports" or the "Company"). The purpose of this policy is to:

Ensure compliance with applicable legal and regulatory requirements
Minimize risk associated with data over-retention
Protect sensitive customer and financial information
Define consistent and secure data handling practices

2. Scope

This policy applies to:

All data created, collected, stored, or processed by Sandman Sports
Customer data, transaction data, and identity verification data
Internal business records and system logs
Data maintained by third-party service providers

3. Data Classification

Sandman Sports classifies data into the following categories:

a. Customer Data

Name, email, phone number, address
Account credentials and profile data

b. Financial & Transaction Data

Deposits, withdrawals, contest entries, payouts
Payment identifiers (processed via third parties)

c. Identity Verification Data

KYC/eKYC data collected through IDComply
Government ID verification results and metadata

d. Security & System Data

Login history, IP addresses, device data
Logs, audit trails, monitoring data

e. Business & Compliance Records

Policies, reports, investigations
AML and sanctions-related records

4. Retention Periods

Sandman Sports retains data only as long as necessary for business, legal, and regulatory purposes.

Data Type	Retention Period
Customer Account Data	Duration of account + 5 years after closure
Financial & Transaction Data	Minimum 5 years
Identity Verification (KYC) Data	Minimum 5 years after last activity
AML / Compliance Records	Minimum 5 years
Security Logs	12–24 months (or longer if required)
Support Communications	2–3 years
Marketing Data	Until user opts out or account closure

Retention periods are aligned with expectations under the Bank Secrecy Act and industry best practices.

5. Data Storage & Protection

Data is stored securely using:

Encryption in transit (TLS/HTTPS)
Encryption at rest where applicable
Secure cloud infrastructure and access controls
Tokenized or third-party managed payment systems

Sensitive financial data is handled by trusted providers such as Finix and PayPal, reducing direct storage risk.

6. Data Minimization

Sandman Sports limits data collection and retention to what is necessary to:

Provide services
Meet legal and compliance requirements
Prevent fraud and abuse

Data that is no longer required is securely deleted in accordance with this policy.

7. Data Disposal Procedures (Operationalized)

When data reaches the end of its retention period, Sandman Sports ensures secure disposal through:

a. Electronic Data

Permanent deletion from active systems
Removal from backups in accordance with retention cycles
Use of secure deletion methods to prevent recovery

b. Physical Records (if applicable)

Secure shredding or destruction

c. Third-Party Data

Requests to vendors to delete data where applicable
Reliance on vendor data retention policies where appropriate

8. Account Closure & Data Deletion

When a user account is closed:

Personal data is retained only as required for legal, regulatory, and fraud prevention purposes
Data is flagged for deletion after the applicable retention period
Certain data may be retained longer if required for dispute resolution, compliance, or legal obligations

9. Legal Holds

If Sandman Sports becomes aware of litigation, investigation, or regulatory inquiry:

Relevant data will be preserved beyond standard retention periods
Disposal processes will be suspended for affected data until the matter is resolved

10. Monitoring & Compliance

Sandman Sports periodically reviews:

Data retention practices
System storage and logs
Compliance with this policy

Violations may result in disciplinary action or corrective measures.

11. Third-Party Vendor Management

Sandman Sports works with trusted vendors, including:

Identity verification: IDComply
Payments: Finex, Paypal
Data services: Plaid

Vendors are expected to maintain appropriate data retention and security practices consistent with industry standards.

12. Policy Review & Updates

This policy is reviewed periodically and updated as necessary to reflect:

Changes in legal or regulatory requirements
Changes in business operations or technology
Evolving security risks

13. Contact

Compliance & Security
Sandman Sports LLC
[email protected]