DATA STORAGE & RETENTION POLICY

TIMU CORP d/b/a Paws Impérial

Document PI-OPS-007 | Effective: March 2026 | Next Review: March 2027

This Data Storage & Retention Policy establishes standards for how TIMU CORP d/b/a Paws Impérial collects, stores, protects, retains, and disposes of all business data and personal information. This policy explains how we handle your personal data and governs our internal data practices. It supplements our Privacy Policy available at pawsimperial.com/privacy | Terms of Service: pawsimperial.com/terms.

All Company data is classified into the following categories:

Confidential Data — Highest Protection Required

• Client personal information: names, addresses, phone numbers, email addresses
• Client pet information: health records, behavioral history, vaccination records
• Client payment information: card data, payment method details
• Pet Logistics Data: home access instructions, pickup/drop-off addresses, GPS route data, scheduling preferences
• E-commerce & Order Data: order history, purchased items, shipping addresses, delivery preferences
• Business financial records: bank accounts, tax filings, revenue data
• Legal documents: contracts, service agreements, incident reports, insurance claims

Internal Data — Standard Protection Required

• Operational logs: Trip Logs, Driver Hours Logs, Incident Logs, Training Logs
• GPS and location data collected during services

Public Data — No Special Protection Required

• Published marketing materials and social media posts
• Website content approved for public display
• General business information (company name, address, phone)

Data must be retained for the minimum periods specified below. Data must not be deleted before its retention period expires without management authorization.

A data breach includes: unauthorized access to, disclosure of, or loss of Confidential data; loss or theft of a device containing Company data; ransomware or malware attack; or accidental transmission of Confidential data to an unauthorized party.

Immediate Steps

• Upon discovery of any suspected or confirmed data breach, we act immediately
• We contain and investigate the breach under management direction
• All evidence related to the breach is preserved

Notification Requirements

• NY residents: notification required "in the most expedient time possible" per NY Gen. Bus. Law §899-aa
• NJ residents: notification required within 30 days per NJ Rev. Stat. §56:8-163
• Applicable regulatory authorities must be notified as required by law
• Management must consult legal counsel before issuing breach notifications

Even if a breach is later determined to be harmless, the initial report must still be made. The cost of late or non-notification far exceeds the cost of prompt disclosure.

We collect and use your personal data only for the following specific purposes:

• Service delivery: scheduling and delivering dog walking, pickup, and drop-off services
• Payment processing: processing payments for services and products through PCI-DSS compliant processors
• Order fulfillment: shipping products purchased through our online store
• Communications: confirming service details, sending walk updates, and responding to inquiries
• GPS & safety tracking: monitoring handler locations during service for animal safety and insurance compliance
• Legal & regulatory compliance: complying with USDA Class T, NYC DOHMH, USDA AWA, and applicable NY/NJ regulations
• Marketing (opt-in only): improving our services and communicating relevant offers (only with your consent)

We do not use your data for automated decision-making or profiling. We do not share your data with third parties except as required to deliver services (e.g., payment processors) or as required by law.

TIMU CORP d/b/a Paws Impérial does not sell, rent, or trade your personal information to any third party for monetary or other valuable consideration. This applies to all categories of personal information we collect, including client contact details, pet health records, payment information, GPS data, and order history.

• Right to Know — request details about what personal data we have collected about you and how it is used
• Right to Delete — request deletion of your personal data, subject to legal retention requirements
• Right to Correct — request correction of inaccurate personal information
• Right to Portability — request a copy of your data in a portable format
• Right to Opt Out — opt out of any future marketing communications at any time
• Right to Non-Discrimination — exercising your privacy rights will not affect the quality or availability of our services

These rights apply to California residents under CCPA, New Jersey residents under NJ Data Privacy Act, and all clients as a matter of Company policy. To exercise any right, contact us at info@pawsimperial.com with subject line "Data Request."