Data Deletion Policy

This Data Deletion Policy describes how MiseCentral LLC ("MiseCentral," "we," "us," or "our") deletes or returns Customer Data, including Personal Data, upon Customer request or upon termination of the Agreement. This policy supplements the Data Processing Agreement ("DPA"), Data Retention Policy, and Agreement.

1. Scope

1.1. This policy applies to Customer Data stored in the Services, including operational, quality, food-safety, traceability, workforce, audit, and support records.

1.2. This policy does not govern deletion from Customer-controlled systems, Connected Services, or local devices outside MiseCentral's control.

2. Customer-Initiated Deletion During Subscription

2.1. In-Product Deletion. Where the Services provide administrative or self-service deletion controls, Customer may delete Customer Data directly. Deletion may be irreversible. Customer is responsible for confirming that deletion aligns with Customer's regulatory and business recordkeeping requirements before using deletion controls.

2.2. User Deactivation. Customer administrators may deactivate Authorized Users. Deactivation restricts access but may retain associated Operational Evidence and audit records as described in the Data Retention Policy.

2.3. Written Requests. Customer may submit written deletion requests to privacy@misecentral.com specifying the scope of data to be deleted. MiseCentral will verify the requester's authority and respond within a reasonable period consistent with applicable Data Protection Laws.

3. Deletion Upon Termination

3.1. Upon termination or expiration of the Agreement, Customer may export Customer Data during any post-termination access window specified in the Agreement or Order Form.

3.2. Within thirty (30) days after the end of the export window, or within thirty (30) days after termination if no export window applies, MiseCentral will delete Customer Data from production systems unless Customer requests earlier deletion or return.

3.3. Return Option. If Customer requests return instead of deletion before processing begins, MiseCentral will provide Customer Data in a standard export format available in the Services at the time of request.

4. Deletion Method and Verification

4.1. MiseCentral deletes Customer Data using industry-standard methods designed to render the data inaccessible from active production systems, including logical deletion and cryptographic erasure where applicable.

4.2. Residual copies in backup systems are purged through normal backup rotation as described in the Data Retention Policy, typically within ninety (90) days.

4.3. Upon Customer's written request following completion of deletion from production systems, MiseCentral will provide a written confirmation of deletion, subject to verification of request authority and any legal retention exceptions.

5. Exceptions and Delayed Deletion

5.1. MiseCentral may delay or limit deletion where:

(a) applicable law requires retention; (b) data is necessary to establish, exercise, or defend legal claims; (c) data resides in immutable audit or security logs that cannot be selectively removed without disproportionate impact on other Customers or system integrity; or (d) an outstanding fee dispute or security investigation requires limited retention.

5.2. Data retained under exceptions remains subject to the Agreement and DPA and is not used for unrelated purposes.

6. Aggregated Data

6.1. After termination, MiseCentral may retain Aggregated Data derived from Customer Data that cannot reasonably identify Customer or any individual, as permitted in the Agreement.

7. Subprocessors

7.1. MiseCentral instructs Subprocessors to delete Customer Data in accordance with this policy and contractual flow-down obligations. Deletion timelines for Subprocessor systems align with MiseCentral's production and backup schedules.

8. Personal Data and Data Subject Requests

8.1. Requests from individuals to delete Personal Data should be directed to Customer as Controller. MiseCentral will assist Customer as described in the DPA.

8.2. If MiseCentral receives a deletion request directly from an individual, MiseCentral will redirect the request to Customer unless prohibited by law.

9. Contact

MiseCentral LLC Attn: Privacy 8 The Green, Suite A Dover, DE 19901 United States privacy@misecentral.com