FINZOOPAY SOLUTIONS LLP

1. PURPOSE

This Policy establishes the framework for identifying, reporting, containing, investigating, responding to and recovering from cyber-security incidents, suspected fraud, account compromise, payment abuse, voucher misuse, data compromise and other technology-enabled threats affecting FINZOOPAY SOLUTIONS LLP.

2. OBJECTIVES

• Detect and report cyber and fraud incidents promptly.
• Contain incidents and minimise customer, financial and operational impact.
• Preserve relevant evidence and maintain investigation records.
• Coordinate technical, operational, financial, legal and compliance responses.
• Protect customer and transaction information.
• Support appropriate communication, recovery and post-incident improvement.

3. SCOPE

This Policy applies to employees, contractors, systems, applications, APIs, websites, customer channels, payment integrations, voucher systems, databases, endpoints, cloud services and material third parties supporting the Company's operations.

4. INCIDENT TYPES

• Unauthorised account access or credential compromise
• Phishing, malware or ransomware
• Payment or transaction fraud
• Gift-card / voucher misuse or abuse
• Data leakage or unauthorised disclosure
• Application, API or infrastructure compromise
• Business-email compromise or impersonation
• Suspicious transaction or coordinated fraud activity
• Third-party security incident affecting Company operations

5. INCIDENT SEVERITY

Incidents shall be classified according to customer impact, financial impact, data sensitivity, service disruption, security severity, legal or regulatory exposure and likelihood of further harm. Critical incidents shall receive immediate management escalation.

6. INCIDENT REPORTING

Employees, contractors, customers and relevant partners shall use designated channels to report suspected cyber incidents or fraud. Reports should include available facts such as date/time, affected service, transaction details, suspicious activity and supporting evidence.

7. INCIDENT RESPONSE TEAM

Depending on the nature of the incident, management may designate representatives from Technology / Information Security, Operations, Risk / Fraud, Finance, Compliance / Legal and Customer Support to coordinate response activities.

8. RESPONSE LIFECYCLE

• Identification and initial assessment
• Containment
• Evidence preservation
• Investigation and root-cause analysis
• Eradication / remediation
• Recovery and validation
• Customer / partner communication where appropriate
• Post-incident review and corrective actions

9. CONTAINMENT

Appropriate immediate measures may include disabling compromised accounts, restricting access, blocking suspicious transactions, isolating affected systems, rotating credentials, suspending vulnerable integrations or applying other controls proportionate to the incident.

10. FRAUD RESPONSE

Suspected fraud shall be assessed using available transaction, customer, device, account, payment, voucher and behavioural information. Appropriate actions may include transaction review, temporary restrictions, verification, escalation, recovery efforts and partner coordination.

11. CUSTOMER PROTECTION

Where an incident may affect customers, the Company shall take reasonable measures to protect affected accounts, transactions and information and shall provide appropriate support and communication consistent with applicable requirements.

12. PAYMENT & TRANSACTION INCIDENTS

Payment-related incidents shall be coordinated with relevant banks, payment gateways, processors or other authorised partners where necessary. Transaction records, references, amounts, timestamps and reconciliation information shall be preserved for investigation.

13. EVIDENCE PRESERVATION

Relevant logs, transaction records, communications, system alerts, access records, screenshots, device information and other evidence shall be preserved where appropriate. Evidence shall be handled in a manner that supports integrity and traceability.

14. DATA BREACH MANAGEMENT

Suspected personal or confidential data compromise shall be escalated to the appropriate security, compliance and legal functions. Assessment, containment, documentation and any required notifications shall be performed according to applicable requirements.

15. THIRD-PARTY INCIDENTS

Material incidents originating at or involving vendors, payment partners, hosting providers or other third parties shall be escalated through the vendor and incident-management processes and tracked until appropriate resolution.

16. LAW ENFORCEMENT / AUTHORITIES

Where appropriate or legally required, the Company may coordinate with law-enforcement, cybercrime authorities, regulators, financial institutions or other competent authorities.

17. COMMUNICATIONS

Incident communications shall be coordinated by authorised personnel. Public or customer communications shall be accurate, appropriately timed and shall avoid disclosure of sensitive security information that could increase risk.

18. RECOVERY

Affected systems and services shall be restored through controlled recovery procedures. Recovery shall include validation of system integrity, transaction status, access controls and monitoring before normal operations resume.

19. POST-INCIDENT REVIEW

Material incidents shall be reviewed to identify root causes, control failures, customer impact, financial impact, response effectiveness and corrective actions.

20. CORRECTIVE & PREVENTIVE ACTION

Remediation actions shall be documented with an owner and target completion date. Actions may include technical fixes, process changes, access changes, monitoring improvements, vendor remediation and staff awareness.

21. INCIDENT RECORDS

Incident records shall include relevant chronology, severity, affected systems, actions taken, evidence, decisions, communications, recovery steps and closure status, subject to applicable confidentiality requirements.

22. CONFIDENTIALITY

Incident information shall be shared only with authorised personnel and parties having a legitimate need to know. Sensitive investigation information shall be protected against unauthorised disclosure.

23. TESTING & DRILLS

The Company may conduct tabletop exercises, phishing awareness exercises, cyber simulations or other response tests appropriate to risk and operational requirements.

24. FRAUD PREVENTION COORDINATION

This Policy shall operate together with the Company's Fraud Prevention & Transaction Monitoring, Unauthorised Transaction, AML/KYC where applicable, and Transaction Risk policies.

25. RESPONSIBILITY MATRIX

26. REVIEW & AMENDMENT

This Policy shall be reviewed at least annually and after material cyber incidents, major fraud events, significant technology changes or changes in applicable requirements.

27. APPROVAL