Integrated Projects Technology Inc. is committed to protecting the confidentiality, integrity, and availability of all customer and business data. This summary outlines our data classification, retention, handling, and disposal practices as part of our broader compliance with privacy and security regulations.

Data Classification. We classify data into three categories to guide appropriate protection. Confidential data includes highly sensitive information such as customer data, personally identifiable information (PII), credentials, and financial records, and is protected with strict access controls. Restricted data covers proprietary business information including internal policies, contracts, and internal communications, and is accessible based on business need. Public data consists of approved marketing materials, product descriptions, and publicly available documents.

Data Retention. We retain data only for as long as necessary to fulfill contractual and business needs, comply with legal or regulatory obligations, and resolve disputes or enforce agreements. Customer account data is retained only as long as needed and is typically deleted within 60 days of contract termination unless required longer for legal or operational reasons. Security logs and audit data are retained for one year. Customer usage data is kept to support service delivery and analytics. Personal data (PII) is deleted or anonymized when no longer required. Internal policies and records are retained in accordance with internal schedules.

Data Handling & Security. We maintain strict controls for handling and protecting data. These include encryption at rest and in transit, role-based access control, prohibition on the use of unauthorized personal devices or removable media, and secure system configurations that are regularly audited. Our systems undergo regular security assessments and we align with SOC 2 Type II and ISO 27001 standards.

Data Disposal. When data is no longer needed, electronic data is securely deleted or anonymized. Devices are wiped or physically destroyed in accordance with industry best practices. Paper records are securely shredded, and certificates of destruction are retained for one year where applicable. Third-party vendors that handle confidential or restricted data are required to meet our data disposal standards.

Sub-Processors. We work with vetted third-party service providers, or Sub-Processors, to deliver our services. A list is available upon request. Customers will be notified of material changes to Sub-Processors and may object to new ones based on valid privacy concerns.

Customer Rights. Customers have the right to request access to their data, request correction or deletion, object to or restrict processing, and submit a data-related complaint or request. To exercise these rights, contact bimit-support@integratedprojects.co.