FINZOOPAY SOLUTIONS LLP

1. PURPOSE

This Policy establishes the framework for maintaining critical business operations and restoring technology, information and operational services following disruptions, disasters, cyber incidents, infrastructure failures, third-party outages or other events affecting FINZOOPAY SOLUTIONS LLP.

2. OBJECTIVES

• Protect customers, employees, information and critical business resources.
• Maintain continuity of critical services to the extent reasonably practicable.
• Define recovery priorities, responsibilities and escalation procedures.
• Minimise financial, operational, technology and reputational impact.
• Restore critical systems and services in a controlled and secure manner.

3. SCOPE

This Policy covers critical business processes, applications, APIs, payment integrations, voucher systems, databases, cloud services, networks, personnel, vendors and facilities supporting the Company's operations.

4. BUSINESS CONTINUITY GOVERNANCE

Management shall establish continuity responsibilities, approve recovery priorities and provide appropriate resources. Business and technology owners shall maintain continuity arrangements appropriate to their risk.

5. BUSINESS IMPACT ANALYSIS

Critical business processes and supporting systems should be assessed for operational impact, dependencies, customer impact, financial impact and recovery requirements.

6. CRITICAL SERVICES

• Customer-facing transaction services
• Payment and settlement-related integrations
• Gift card / voucher issuance and redemption systems
• Customer support and grievance channels
• Core databases and application services
• Security monitoring and access services
• Financial and reconciliation processes

7. RECOVERY PRIORITIES

Critical services shall be assigned recovery priorities based on customer impact, transaction dependency, regulatory or contractual requirements, financial exposure and operational importance.

8. RECOVERY OBJECTIVES

Where appropriate, business and technology owners should define Recovery Time Objectives (RTO) and Recovery Point Objectives (RPO) for critical services based on risk, technical capability and business requirements.

9. DISASTER SCENARIOS

• Cyber attack or ransomware
• Cloud or hosting outage
• Database failure or corruption
• Network or telecommunications failure
• Power or facility disruption
• Payment gateway / banking partner outage
• Critical vendor failure
• Natural disaster
• Major operational or staffing disruption

10. BUSINESS CONTINUITY PROCEDURES

Business owners shall maintain practical procedures for continuing critical activities during disruptions, including alternative communication, manual workarounds, prioritisation of essential activities and controlled customer communication where appropriate.

11. DISASTER RECOVERY

Technology teams shall maintain recovery arrangements for critical systems, including backups, restoration procedures, infrastructure recovery, access recovery, configuration restoration and validation.

12. BACKUP POLICY

• Critical data shall be backed up according to business and technical requirements.
• Backups shall be protected against unauthorised access and accidental deletion.
• Backup restoration shall be tested periodically where feasible.
• Critical backup dependencies shall be documented.

13. REDUNDANCY & RESILIENCE

Where justified by risk and business requirements, redundancy, failover, multiple service dependencies or other resilience measures may be implemented for critical systems.

14. THIRD-PARTY CONTINUITY

Critical vendors and service providers shall be assessed for continuity capability based on risk. Relevant contracts should include appropriate service, incident, continuity and recovery provisions where appropriate.

15. COMMUNICATIONS

During a major disruption, communications shall be coordinated through designated personnel. Customers, partners, employees and other stakeholders shall receive accurate information appropriate to the situation.

16. INCIDENT ESCALATION

Major disruptions shall be escalated to authorised management. Cyber-related disruptions shall also follow the Cyber Incident Response & Cyber Fraud Management Policy.

17. CRISIS MANAGEMENT

For significant disruptions, Management may establish a crisis-management structure to coordinate operational decisions, resources, communications, vendor coordination and recovery priorities.

18. ALTERNATIVE WORK ARRANGEMENTS

Where appropriate, the Company may activate remote work, alternate facilities, alternate communication channels or other practical arrangements to maintain essential operations.

19. MANUAL PROCESS CONTINUITY

Where technology services are unavailable, approved manual or alternative procedures may be used for critical activities, subject to reconciliation and appropriate controls after systems are restored.

20. DATA INTEGRITY DURING RECOVERY

Recovered systems and restored data shall be validated for integrity and consistency before full operational use where practicable.

21. SYSTEM RESTORATION

Restoration shall follow a controlled sequence based on service dependencies and criticality. Security controls shall be re-established before or during restoration as appropriate.

22. TESTING & EXERCISES

Continuity and disaster-recovery arrangements should be tested periodically through tabletop exercises, backup restoration tests, failover tests or other suitable methods.

23. LESSONS LEARNED

After significant disruptions or exercises, the Company should document lessons learned, control gaps and corrective actions.

24. EMPLOYEE AWARENESS

Relevant employees shall understand their continuity responsibilities, escalation contacts and procedures appropriate to their roles.

25. RECORD KEEPING

Business continuity plans, recovery procedures, test results, incident records, approvals and corrective actions shall be maintained according to applicable record-keeping requirements.

26. POLICY EXCEPTIONS

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory and contractual requirements shall continue to apply.

27. RESPONSIBILITY MATRIX

28. REVIEW & AMENDMENT

This Policy shall be reviewed at least annually and following material disruptions, recovery exercises, major technology changes, critical vendor changes or changes in applicable requirements.

29. APPROVAL