Digital Liberia Inc.

Data Deletion Policy and Right to be Forgotten Procedure

1. Purpose of This Deletion Policy

The purpose of this Data Deletion and Right to be Forgotten Policy is to establish comprehensive procedures, technical safeguards, and governance mechanisms for the secure and complete deletion of personal and sensitive data handled by Digital Liberia Inc.

This policy is designed to:

• Honor individuals' right to request deletion of their personal data
• Establish clear procedures for processing deletion requests
• Define retention periods and deletion schedules
• Ensure compliance with applicable data protection laws and regulations
• Maintain technical capabilities for secure data destruction
• Balance deletion rights with legal and regulatory retention obligations
• Preserve audit trails while removing personal identifiers

This policy applies to all data processed within the Digital Liberia ecosystem, including but not limited to:

• DSSN (Digital Social Security Number) identity data
• Biometric verification data
• Financial transaction data
• Institutional verification requests
• Customer and merchant account information

2. Scope

This deletion policy applies to:

• All individuals whose data is processed by Digital Liberia
• All Digital Liberia employees and contractors handling deletion requests
• All digital platforms and infrastructure systems
• All third-party vendors and integration partners
• All cloud and on-premise data systems

The policy covers the following deletion scenarios:

• User-initiated account deletion requests
• Data subject rights requests (Right to be Forgotten)
• Automated deletion after retention period expiration
• Data correction requiring deletion of incorrect records
• Withdrawal of consent triggering deletion obligations

3. Legal Basis for Data Deletion

Digital Liberia processes deletion requests based on the following legal grounds:

3.1 Right to be Forgotten

Individuals have the right to request deletion of their personal data when:

• The data is no longer necessary for the original purpose
• Consent is withdrawn and no other legal basis exists
• The individual objects to processing and no overriding legitimate grounds exist
• The data has been unlawfully processed
• Deletion is required by law

3.2 Retention Period Expiration

Data shall be automatically deleted when the applicable retention period expires.

3.3 Withdrawal of Consent

Upon withdrawal of consent, data processing shall cease and data shall be deleted where consent was the sole legal basis.

3.4 Legal Obligation to Delete

Where applicable law requires deletion, Digital Liberia shall comply promptly.

4. Data Deletion Request Procedures

4.1 How Individuals Can Request Deletion

Individuals may request deletion of their personal data through the following channels:

Method	Details	Response Time
In-Person	Any Digital Liberia registration center	Immediate receipt
Email	deletion@digitalliberia.com	24 hours confirmation
Web Portal	Account settings → Request Deletion	Immediate
Mobile App	Profile → Delete Account	Immediate
Phone	Customer support hotline	During business hours
Written Letter	Digital Liberia headquarters address	5 business days

4.2 Required Information for Deletion Request

To process a deletion request, the individual must provide:

• Full legal name (as registered in DSSN)
• DSSN (Digital Social Security Number)
• Registered phone number or email address
• Government-issued identification for verification
• Written confirmation of deletion request (for email/letter)

4.3 Identity Verification Before Deletion

Digital Liberia shall verify the identity of the requester before processing any deletion request. Verification procedures include:

• Standard Verification: Government ID validation, biometric verification, security questions
• Enhanced Verification: In-person verification, two-factor authentication, supervisor approval
• Failed Verification: Request rejected with explanation, invitation to visit registration center, appeal process provided

5. Deletion Process Workflow

5.1 Step-by-Step Deletion Process

Step	Action	Responsible Party	Timeframe
1	Receive deletion request	Customer Support	Day 0
2	Verify requester identity	Verification Team	Within 24 hours
3	Acknowledge receipt of request	Customer Support	Within 48 hours
4	Review legal obligations	Legal/Compliance	Within 5 business days
5	Identify data to be deleted	Data Protection Officer	Within 5 business days
6	Execute technical deletion	IT/Security Team	Within 10 business days
7	Confirm deletion to requester	Customer Support	Within 15 business days
8	Document deletion in audit log	Compliance Team	Within 15 business days

5.2 Deletion Timeline

Request Type	Processing Time
Standard deletion request	15 business days
Complex deletion request	30 business days (with notification)
Emergency deletion (security risk)	72 hours
Automated retention deletion	Upon expiration date

6. Data Categories and Deletion Actions

6.1 Complete Deletion (No Exceptions)

Data Category	Deletion Method	Time to Delete
Biometric references	Cryptographic erasure	Immediate
Biometric authentication logs	Secure overwrite	Within 24 hours
Session cookies and tokens	Automated purge	Immediate
Temporary cache files	Automated deletion	Within 24 hours
Verification attempt logs (failed)	Secure erase	Within 7 days

6.2 Standard Deletion (Unless Legal Exception Applies)

Data Category	Deletion Method	Retention if Exception
Full legal name	Secure deletion	AML records (7 years)
Date of birth	Secure deletion	Age verification (7 years)
Residential address	Secure deletion	Tax records (7 years)
Phone number	Secure deletion	Fraud investigation
Email address	Secure deletion	Audit trail
Photograph	Secure deletion	Identity verification log

7. Exceptions to Deletion

7.1 Legal Exceptions

Digital Liberia may retain data despite a deletion request when required by law, including:

• Anti-Money Laundering (AML) Compliance: Transaction records for 7 years
• Fraud Prevention: Data related to confirmed fraud for 10 years
• Legal Proceedings: Data subject to court order until case resolution
• Regulatory Requirements: Data required by financial regulators per regulatory schedule
• Security Incident Response: Data related to security incidents for 5 years

8. Account Deletion vs. Data Deletion

8.1 Account Deletion Process

Step	Action	Timeframe
1	Account is immediately deactivated	Day 0
2	Login access is revoked	Day 0
3	Grace period begins (reconsideration window)	Day 0-30
4	During grace period, account can be restored	Days 1-30
5	After grace period, permanent deletion begins	Day 31
6	Data deletion completes	Day 31-45
7	Deletion confirmation sent	Day 45

9. Contact Information

For deletion requests or questions about this policy:

• Email: deletion@digitalliberia.com
• Data Protection Officer: dpo@digitalliberia.com
• In-Person: Any Digital Liberia registration center