FINZOOPAY SOLUTIONS LLP

1. PURPOSE

This Policy establishes the framework for maintaining critical business operations and restoring technology, transaction processing, customer support and other essential services following a cyber incident, system outage, infrastructure failure, partner failure, natural event or other disruption.

2. OBJECTIVES

• Protect customers, employees, information and critical operations.
• Reduce the impact and duration of service disruption.
• Define recovery responsibilities and escalation.
• Maintain appropriate backup and recovery capability.
• Coordinate continuity with critical third parties.
• Test and improve continuity and disaster-recovery arrangements.

3. SCOPE

This Policy applies to critical business processes, websites, applications, APIs, payment integrations, transaction systems, customer support, data, infrastructure, employees, facilities and material third-party services supporting FINZOOPAY SOLUTIONS LLP.

4. BUSINESS CONTINUITY GOVERNANCE

Management shall establish appropriate continuity oversight, resources and responsibilities. Critical processes and dependencies shall be identified and periodically reviewed.

5. DISRUPTION SCENARIOS

• Cyber attack or security incident
• Application, API or database outage
• Cloud / hosting failure
• Payment gateway, bank or processor outage
• Internet, telecommunications or power disruption
• Data corruption or accidental deletion
• Natural disaster or major external event
• Critical third-party service failure
• Key-person or workforce unavailability

6. BUSINESS IMPACT ASSESSMENT

The Company shall identify critical processes, dependencies, customer impact, financial impact, operational impact and recovery priorities. Recovery requirements shall be proportionate to business criticality and risk.

7. CRITICAL BUSINESS FUNCTIONS

• Customer order and voucher processing
• Payment and transaction processing
• Voucher issuance and redemption support
• Customer support and grievance handling
• Fraud and transaction monitoring
• Finance, settlement and reconciliation
• Information security and incident response
• Critical partner coordination

8. RECOVERY PRIORITIES

Critical services shall be prioritised based on customer impact, financial exposure, security requirements, contractual obligations, data criticality and operational dependencies.

9. RECOVERY OBJECTIVES

Where appropriate, the Company shall establish recovery time and recovery point objectives for critical systems based on business requirements and available technology. Exact objectives may vary by system and service.

10. BACKUP & RESTORATION

• Critical data shall be backed up according to defined business requirements.
• Backups shall be protected against unauthorised access and corruption.
• Restoration procedures shall be documented for critical systems.
• Recovery tests shall be conducted periodically where appropriate.

11. DISASTER RECOVERY

Technology teams shall maintain appropriate recovery procedures for critical applications, databases, APIs, infrastructure and supporting services. Recovery shall include system validation before normal operations resume.

12. INCIDENT ACTIVATION & COMMAND

The continuity or disaster-recovery process may be activated by authorised management or designated incident leadership when a disruption materially affects critical operations or is expected to do so. An incident lead shall coordinate technical recovery, business operations, communications, partner coordination and management reporting.

13. COMMUNICATION

During a material disruption, communications shall be coordinated through authorised personnel. Customers, employees, partners and other stakeholders shall receive appropriate information without exposing confidential security details.

14. PAYMENT & PARTNER CONTINUITY

The Company shall maintain appropriate contingency arrangements for critical payment gateways, banks, processors, hosting providers, communication services and other essential partners, subject to contractual capabilities.

15. MANUAL / ALTERNATE PROCESS

Where feasible, documented manual or alternate processes may be used for critical activities during temporary system unavailability, subject to security, reconciliation and management controls.

16. DATA INTEGRITY & RECONCILIATION

After recovery, transaction, voucher, payment, customer and financial data shall be validated and reconciled to identify incomplete, duplicate or inconsistent records.

17. CYBER INCIDENT COORDINATION

Cyber-related disruptions shall be managed jointly with the Company's Information Security and Cyber Incident Response policies.

18. THIRD-PARTY CONTINUITY

Critical vendors and partners shall be assessed for continuity risk. Where practical, alternative providers or contingency arrangements shall be considered for material dependencies.

19. EMPLOYEE CONTINUITY

The Company shall maintain appropriate arrangements for staff availability, remote working, role substitution, emergency contact and access continuity for critical functions.

20. TESTING & EXERCISES

• Backup restoration tests
• System recovery tests
• Communication exercises
• Tabletop continuity exercises
• Partner outage scenarios
• Cyber incident recovery exercises

21. TEST RESULTS & REMEDIATION

Continuity tests shall be documented. Identified gaps shall be assigned owners, priorities and target remediation dates, with follow-up by management or designated owners.

22. POST-INCIDENT REVIEW

After a material disruption, the Company shall conduct an appropriate review to identify root causes, recovery performance, customer impact, control gaps and improvement actions.

23. RECORD KEEPING

Continuity plans, recovery procedures, test results, incident records, recovery decisions and remediation actions shall be retained according to applicable requirements.

24. SECURITY & CONFIDENTIALITY

Business continuity documentation may contain sensitive infrastructure and security information and shall be restricted to authorised personnel.

25. EXCEPTIONS

Exceptions to continuity requirements shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory and contractual obligations shall continue to apply.

26. RESPONSIBILITY MATRIX

27. REVIEW & AMENDMENT

This Policy shall be reviewed at least annually and after material incidents, significant technology or partner changes, business expansion or changes in applicable requirements.

28. APPROVAL