Annexure H - Data Retention Policy

This Data Retention Policy sets out the principles, standards, and procedures adopted by Pico Public Cloud Limited ("Pico", "we", "us", or "our") for the retention, Grace Period, restricted access, deletion, and destruction of customer data in connection with the provision of cloud computing services.

This Policy applies to:

• All customer data processed, stored, or transmitted through Pico's cloud computing platforms; and
• All customers, users, and account holders of Pico's services.

For the purpose of this Policy:

• "Active Status" means the cloud resource is live, usable and performing it's intended function as per the subscribed resources.
• "Customer Data" means any data, content, information, or material submitted, stored, processed, or generated by or on behalf of a customer through Pico's services.
• "Deleted Account" means the Overdue account that has not been reactivated during the Restricted Access Period.
• "Due Date" means the payment or renewal date of the customer's active subscription plan.
• "Grace Period" means a period of 30 days commencing from the immediate next date of the Due Date, during which the Customer shall have access to the subscribed resources only limited to data viewing and exporting.
• "Overdue Account" means the account that has switched to the Grace Period and continues till the end of the Restricted Access Period.
• "Restricted Access" means access that allows the customer to view the resources data only.
• "Restricted Access Period" means a period of 30 days commencing from the date when the Grace period ends.
• "Retention Period" means the period during which Pico retains Customer Data following non-renewal or termination of a subscription which shall not exceed 90 (ninety) days from the date of subscription.

Pico adheres to the following data retention principles:

• Customer Data is retained only for as long as necessary to provide services, comply with contractual obligations, meet legal or regulatory requirements, or protect Pico's legitimate business interests.
• Data retention is proportionate, transparent, and predictable.
• Data deletion is permanent, irreversible, and performed using industry-standard secure deletion methods.

Failure to Renew Subscription: If a customer fails to renew or pay the applicable subscription fees on or before the Due Date:

• The customer's account shall automatically transit to Grace Period;
• After the Grade Period, unless the customer renew the subscription, the Restricted Access Period shall commence automatically.
• At the end of the Restricted Access Period, unless the Customer renew the Subscription, the Customer data shall be deleted permanently without any liability to the CSP.

Illustration: If the Due Date is 1st January and the customer fails to renew the subscription on or before that date, the customer's account shall transition to Grace Period on 2nd January to 31st January and if during the Grace Period the Customer fails to renew the subscription, the Customer's account shall transit to the Restricted Access Period on 1st March (if leap year considered) or 2nd March.

6.1 Conditions for Reactivation during Grace Period

A customer may reactivate an overdue account at any time during the Grace Period, subject to:

• Payment of all outstanding subscription fees;
• Payment of penal interest calculated at 10% (ten percent) on the total outstanding amount.

6.2 Conditions for Reactivation during Restricted Access Period

If the Overdue account switched to the Restricted Access Period and the Customer decides to reactivate the Overdue account, the following provisions shall apply:

• Payment of all outstanding subscription fees carried forward from the previous billing period including 10% penal interest for the Grace Period and Restricted Access Period subscription fees.
• Additional penal interest calculated 1% per day starting from the 1st day of Restricted Access Period until the date of reactivation.

6.3 Effect of Reactivation

Upon successful reactivation during the Grace Period or the Restricted Access Period, the Customer's account shall be restored to full active status.

7.1 Expiry of Restricted Access Period

If the customer fails to renew the subscription and does not reactivate the account within the Restricted Access Period:

• The customer's account shall be permanently restricted and switched to Deleted Account.
• All Customer Data associated with the Deleted Account shall be permanently deleted.

7.2 Nature of Deletion

• Data deletion shall be irreversible and final.
• Pico shall not be able to recover, restore, or reconstruct any Customer Data after deletion.
• Pico shall have no liability for any loss of data resulting from non-renewal beyond the Retention Period.

7.3 Deletion of Login Credentials

Ninety (90) days after the account has been permanently deleted, all customer login credentials will be permanently deleted. Customers who wish to use Pico's cloud services thereafter must create new login credentials.

To ensure transparency and fairness, Pico shall notify customers as follows:

• Before the due date of payment, two notifications will be sent out reminding customers of upcoming subscription expiry.
• First notification will be sent out ten (10) days prior to the Due Date and the second notification will be sent out five (5) days prior to the expiration of subscription.
• Notification will bear a clear notice of the final date for reactivation and the consequences of permanent account closure and data deletion.
• Notifications may be sent via email, system alerts, or other registered communication channels.

Pico shall retain or delete Customer Data in accordance with:

• Applicable data protection and privacy laws
• Lawful requests from courts, regulators, or government authorities; and
• Contractual obligations agreed with customers.
• Where retention is required by law beyond the stated periods, access shall be restricted to the minimum extent required.

This Policy may be reviewed and updated periodically to reflect changes in law, regulatory guidance, industry standards, or Pico's business operations. Updated versions shall be made available through Pico's official channels.