Records Retention Policy (Sarbanes-Oxley)

This Records Retention Policy ("Policy") establishes the minimum retention periods, storage standards, legal-hold procedures, and destruction protocols for records of TANQORY PTE. LTD. and its affiliates Tanqory Inc. (Delaware, USA) and Tanqory OÜ (Estonia) (together, "Tanqory" or the "Company"). The Policy is calibrated to meet retention obligations under the Sarbanes-Oxley Act of 2002 ("SOX") and complementary corporate, tax, accounting, and data-protection regimes in the jurisdictions in which Tanqory entities are organized.

0) Corporate structure and scope

Tanqory PTE. LTD. (Singapore, UEN 202448997H) is the ultimate parent and holding company of the Tanqory group, including its wholly-owned subsidiaries Tanqory Inc. (Delaware, USA) and Tanqory OÜ (Estonia). Tanqory Inc. is the contracting entity and merchant of record for every product and service Tanqory sells to merchants and customers worldwide — Tanqory PTE. LTD. itself does not contract with, bill, or hold a direct customer relationship with any merchant or customer. This document is adopted by Tanqory PTE. LTD. as the group's holding company and applies group-wide, including to Tanqory Inc.'s and Tanqory OÜ's operations, unless a section below states a narrower scope.

1) Purpose

1.1 The Company is preparing for, and anticipates becoming subject to, the reporting and internal-control obligations of an issuer registered with the U.S. Securities and Exchange Commission. In anticipation of those obligations, and to satisfy current corporate, tax, and contractual obligations in Singapore, Estonia, and Delaware, the Company maintains records in accordance with this Policy.

1.2 The objectives of this Policy are to (i) preserve records that the Company is required to maintain by law, regulation, or contract; (ii) preserve records necessary to support the Company's financial statements, internal control over financial reporting, and disclosure controls and procedures; (iii) enable cooperation with the Company's independent registered public accounting firm and with regulators; (iv) provide a defensible framework for the routine destruction of records that are no longer required; and (v) implement litigation, regulatory, and audit holds that override routine destruction.

2) Scope

2.1 This Policy applies to all records, in any medium (paper, electronic, audio, video, instant message, or other) created, received, or maintained by the Company in the conduct of its business. Records covered by the Policy include, without limitation: accounting and financial records; audit workpapers and supporting documentation; contracts and ancillary documentation; human-resources and employment records; customer personal data and transaction records; marketing records; security and system logs; corporate governance records (including board and committee minutes); regulatory filings; tax records; and internal and external communications relating to any of the foregoing.

2.2 This Policy applies to all directors, officers, employees, contractors, and agents of every Tanqory entity, and applies to records held by third parties on the Company's behalf (for example, cloud-storage providers, registrars, registered agents, banks, payroll providers, and outside counsel). Records held by such third parties remain subject to this Policy, and Company personnel responsible for those relationships must ensure that contractual terms permit the Company to enforce retention, hold, and destruction obligations.

3) Record classification

3.1 For the purpose of this Policy, records are classified into the following categories:

3.1.1 Financial records — general ledger, sub-ledgers, journal entries, trial balances, financial statements, accounts payable and receivable records, bank statements, reconciliations, invoices, receipts, expense reports, fixed asset registers, intercompany agreements and settlements, transfer-pricing documentation, and supporting schedules.

3.1.2 Audit workpapers — all documents, memoranda, correspondence, communications, other documents, and records (including electronic records) created, sent, or received in connection with an audit or review of the Company's financial statements, in the form required by SEC Regulation S-X §2-06.

3.1.3 Legal and contractual records — executed contracts and amendments, statements of work, order forms, data processing addenda, intellectual-property assignments and licenses, settlement agreements, regulatory correspondence, litigation files, and records of legal advice (subject to privilege).

3.1.4 Human resources and employment records — offer letters, employment agreements, personnel files, performance evaluations, disciplinary records, equity grants and Section 83(b) elections (where applicable to Tanqory Inc.), payroll and benefits records, immigration records, training records, and termination documentation.

3.1.5 Customer personal data and transaction records — personal data collected from or about merchants, end-users, and developers; processed in accordance with the Tanqory Data Retention Policy (apps/legal/tanqory_legal/en/data-protection/data-retention-policy.md), which sets retention periods on a per-data-category basis under GDPR, PDPA, CCPA/CPRA, and similar regimes.

3.1.6 Marketing records — campaign records, consent records, content assets, analytics extracts, and advertising attestations.

3.1.7 Security and system logs — authentication logs, authorization-change logs, administrative-action logs, network logs, endpoint logs, application logs, and security-incident records.

3.1.8 Corporate governance records — certificates of incorporation, charters, bylaws, written resolutions, minutes of board and committee meetings, shareholder registers, capitalization tables, stock ledgers, transfer records, and statutory registers.

3.1.9 Tax records — corporate income tax returns and supporting workpapers, GST/VAT/sales-tax filings, withholding returns, transfer-pricing files, country-by-country reporting, and correspondence with tax authorities.

3.1.10 Internal and external communications — emails, instant messages, and other written communications, to the extent they constitute records under this Policy. Communications relating to financial reporting, audits, transactions, contracts, or regulatory matters are records and are retained accordingly.

4) Retention schedule

4.1 The retention periods set forth below are minimum periods. Where a longer period is required by law, regulation, contract, or litigation hold, the longer period applies. Where multiple periods overlap, the longest applicable period controls.

4.1.1 Financial records — 7 years from the end of the fiscal period to which the record relates. This period satisfies SOX §802 record-keeping expectations, the 7-year requirement under SEC Regulation S-X §2-06 for related materials, IRS retention practice, the 5-year minimum under Singapore Companies Act §199 (extended to 7 years for consistency across the group), and the 7-year minimum under Estonian Accounting Act §12.

4.1.2 Audit workpapers — 7 years from the conclusion of the audit or review, as required by SEC Regulation S-X §2-06 with respect to issuers and their registered public accounting firms. Tanqory will preserve workpapers and supporting documentation supplied to its auditors in a manner consistent with the auditors' own retention obligations under that rule.

4.1.3 Contracts — term of the contract plus 7 years following the later of expiration, termination, or final performance, to align with statute-of-limitations periods for breach-of-contract claims in the relevant jurisdictions and with the financial-records retention period for invoices and other records arising under the contract.

4.1.4 Human resources and employment records — 7 years from the end of the individual's employment or engagement. Tanqory recognizes that statutory minimums vary by jurisdiction; the 7-year period is adopted as a group-wide floor. Retention periods are adjusted for jurisdiction-specific legal minimums and overrides — for example, Singapore Employment Act recordkeeping (2 years current plus 1 year post-termination minimum), the Estonian Employment Contracts Act, and US federal and state requirements (such as Form I-9 retention of 3 years from hire or 1 year from termination, whichever is later) — applying the longer of the group-wide floor or the applicable local requirement.

4.1.5 Customer personal data — as set out in the Tanqory Data Retention Policy, calibrated to the GDPR storage-limitation principle, PDPA, CCPA/CPRA, and the lawful basis and purpose of processing. The retention periods in this Section do not extend the period during which personal data is retained where retention is no longer lawful under data-protection law.

4.1.6 Security logs — 1 year minimum, extended to 3 years for logs supporting investigations, regulatory inquiries, or contractual commitments. The 1-year floor reflects PDPA-aligned guidance for security event logs in Singapore; the practical operating baseline aligns with NIST SP 800-92 recommendations for audit-log retention sufficient to support forensic review and incident response.

4.1.7 Board minutes and minute books — permanent, as required by Singapore Companies Act §188 (and consistent with Delaware General Corporation Law and Estonian Commercial Code practice for the preservation of minute books and statutory registers).

4.1.8 Tax records — 7 years from the date of filing of the relevant return, with longer retention where the period for assessment remains open (for example, in cases of substantial omission of income or fraud).

4.1.9 Marketing records — 3 years from the close of the campaign or from withdrawal of consent (whichever is later), subject to the consent-records retention period in the Data Retention Policy.

4.1.10 Corporate governance and statutory registers — permanent, in the registered office or as otherwise required by the law of the entity's jurisdiction of incorporation.

4.2 Cross-reference. Where this Policy and the Data Retention Policy address the same record, the Data Retention Policy controls for personal-data minimization and deletion timing, and this Policy controls for SOX-scoped financial and audit records. In cases of conflict, the document imposing the stricter retention (longer period for SOX-scoped records, shorter period for personal data subject to storage-limitation principles) prevails for its respective subject matter.

5) Litigation, regulatory, and audit holds

5.1 Trigger. A litigation or regulatory hold ("Hold") is triggered when the Company reasonably anticipates litigation, regulatory investigation, audit inquiry, subpoena, or other formal proceeding. The duty to preserve attaches when litigation or investigation is reasonably foreseeable, which may be before formal proceedings commence.

5.2 Override. A Hold overrides routine destruction under this Policy. Records within the scope of a Hold must be preserved in their original form and metadata until the Hold is formally released in writing by the General Counsel or outside counsel acting on behalf of the Company.

5.3 Hold notice. Holds are issued in writing by the General Counsel or designee. Each Hold notice identifies the matter, the categories of records to be preserved, the custodians subject to the hold, the systems implicated, and the contact for questions. Recipients of a Hold notice must acknowledge receipt and confirm preservation in accordance with the notice.

5.4 Release. A Hold is released only by written notice from the General Counsel or designee. On release, routine retention and destruction under this Policy resumes.

5.5 Audit cooperation. Personnel who interact with the Company's independent registered public accounting firm are reminded that SOX §1102 (codified at 18 U.S.C. §1512(c)) makes it a federal crime to corruptly alter, destroy, mutilate, or conceal a record, document, or other object with the intent to impair the object's integrity or availability for use in an official proceeding, or to obstruct, influence, or impede any official proceeding.

6) Anti-spoliation and criminal liability

6.1 SOX §802 (codified at 18 U.S.C. §1519) makes it a federal crime, punishable by fine and/or imprisonment of up to twenty (20) years, to knowingly alter, destroy, mutilate, conceal, cover up, falsify, or make a false entry in any record, document, or tangible object with the intent to impede, obstruct, or influence the investigation or proper administration of any matter within the jurisdiction of any department or agency of the United States, or any case filed under title 11, or in relation to or contemplation of any such matter or case.

6.2 Personnel must not destroy, alter, conceal, or fail to preserve records when they know, or reasonably should know, that the records are relevant to a current or anticipated investigation, audit, or proceeding. Concerns about possible spoliation should be reported immediately to the General Counsel or via the Whistleblower channel (apps/legal/tanqory_legal/en/governance/whistleblower-policy.md).

6.3 Violations of this Policy or of applicable record-preservation laws may result in disciplinary action up to and including termination of employment or engagement, and may result in referral to law-enforcement authorities.

7) Email retention

7.1 Email communications constituting records under Section 3 are subject to the retention periods applicable to the underlying record category. Email used solely for transient operational coordination, with no record-quality content, is not separately retained beyond the operating mailbox lifecycle.

7.2 The Company maintains the technical ability to apply Holds at the mailbox or organizational level. Personnel must not use personal email or unauthorized messaging tools to conduct Company business in a manner that places records outside Company custody. Where business communications occur on approved messaging platforms (for example, an internal collaboration platform), the same retention rules apply.

8) Backup retention vs. primary retention

8.1 Backups are intended for disaster recovery and operational resilience, not as the system of record for long-term retention. Backup-tape and snapshot retention is governed by the Backup Policy (apps/legal/tanqory_legal/en/trust-and-security/backup-policy.md) and reflects operational recovery-time objectives rather than the retention periods in this Policy.

8.2 Where a Hold is in effect, backups containing in-scope data must not be overwritten or rotated in a manner that would destroy data subject to the Hold; the Hold notice will identify any backup-retention adjustments required.

8.3 Restoration of data from backups for routine operational purposes does not reset the retention clock applicable to the primary record. Restoration of records subject to a Hold is logged and the restored data placed under the same controls as the primary record.

9) Destruction procedures

9.1 Records that have reached the end of their retention period and that are not subject to a Hold are eligible for destruction. Destruction is carried out in a manner appropriate to the medium and the sensitivity of the record.

9.2 Electronic records are destroyed by secure deletion methods appropriate to the storage medium (for example, cryptographic erasure for encrypted volumes, multi-pass overwrites for spinning media, or NIST SP 800-88 sanitization for media being decommissioned).

9.3 Paper records are destroyed by cross-cut shredding or by engagement of a contracted shredding service. Where required, destruction is witnessed and a certificate of destruction is obtained from the service provider.

9.4 Portable and removable media are destroyed by physical destruction (shredding or degaussing) or by cryptographic erasure where the medium remains in service after deletion.

9.5 A destruction log is maintained recording, for each destruction event: the category of records destroyed, the volume or identifiers (to the extent recordable), the retention rule under which destruction was authorized, the method of destruction, the date, and the personnel responsible. The destruction log is itself a record subject to this Policy.

9.6 Destruction of records is suspended for any record subject to a Hold under Section 5 until the Hold is released.

10) Records inventory

10.1 The Company maintains (and is formalizing) a records inventory identifying the categories of records described in Section 3, the systems of record in which they reside, the responsible owner, and the applicable retention period. The inventory is maintained by the senior officer designated by management to oversee records management and is reviewed and updated periodically, on a risk-based basis and no less than annually.

10.2 The records inventory supports legal-hold execution, audit response, regulatory inquiries, and routine destruction. The inventory is reviewed at least annually and updated on the introduction or decommissioning of any system that holds records of material categories.

11) Annual review and policy maintenance

11.1 The General Counsel (or designee), with the assistance of the Audit Committee where appropriate, reviews this Policy at least annually. Reviews assess (i) the adequacy of retention periods against current legal and regulatory requirements; (ii) the effectiveness of Hold procedures; (iii) the completeness of the records inventory; (iv) the operation of destruction processes; and (v) the integration of this Policy with the Data Retention Policy.

11.2 Material changes to this Policy are reviewed and approved in accordance with the Company's governance structure and are communicated to personnel through internal channels. Versions are tracked with change logs and approval records; superseded versions are archived for audit.

12) Cross-references

12.1 This Policy should be read together with:

12.1.1 Data Retention Policy (apps/legal/tanqory_legal/en/data-protection/data-retention-policy.md) — for personal-data minimization and deletion.

12.1.2 Whistleblower Policy (apps/legal/tanqory_legal/en/governance/whistleblower-policy.md) — for reporting suspected destruction or alteration of records.

12.1.3 Disclosure Controls Policy (apps/legal/tanqory_legal/en/governance/disclosure-controls-policy.md) — for records supporting public disclosures.

12.1.4 Audit Committee Charter (apps/legal/tanqory_legal/en/governance/audit-committee-charter.md) — for oversight of records-retention compliance in the context of financial reporting.

12.1.5 Backup Policy (apps/legal/tanqory_legal/en/trust-and-security/backup-policy.md) — for backup-retention distinctions.

12.1.6 Data Classification Policy (apps/legal/tanqory_legal/en/data-protection/data-classification-policy.md) — for handling rules applicable during retention.

13) Contact

13.1 Questions concerning this Policy, requests for clarification on retention periods, or notifications of potential Holds should be directed to legal@tanqory.com (with copy to compliance@tanqory.com for SOX-scoped matters).