FINZOOPAY SOLUTIONS LLP

1. PURPOSE

This Policy establishes the framework for identifying, reporting, containing, investigating, responding to and recovering from cyber-security incidents and cyber-enabled fraud affecting FINZOOPAY SOLUTIONS LLP, its customers, partners, systems or information.

2. OBJECTIVES

• Detect and report cyber incidents promptly.
• Contain and minimise operational, financial and data impact.
• Preserve evidence and maintain investigation records.
• Coordinate technical, fraud, legal, compliance and operational response.
• Restore affected services securely.
• Identify root causes and implement corrective actions.

3. SCOPE

This Policy applies to employees, contractors, vendors and systems involving Company applications, APIs, networks, cloud infrastructure, databases, payment integrations, voucher systems, endpoints, customer accounts and information assets.

4. INCIDENT TYPES

• Unauthorised access or account compromise
• Phishing, social engineering or credential theft
• Malware, ransomware or malicious code
• Data breach or unauthorised disclosure
• Payment or transaction manipulation
• Gift-card / voucher fraud
• API abuse or application attack
• Denial-of-service or service disruption
• Insider misuse
• Third-party cyber incident

5. INCIDENT SEVERITY

• Critical – significant customer, financial, security, data or service impact.
• High – material impact requiring coordinated response.
• Medium – contained impact requiring structured investigation and remediation.
• Low – limited impact that can be handled through routine controls.

6. INCIDENT REPORTING

Personnel shall promptly report suspected or confirmed security incidents through designated internal channels. Reports should include known facts, affected systems, time of occurrence and immediate actions taken where available.

7. INCIDENT RESPONSE TEAM

Management may designate an incident response team comprising Technology/Security, Risk/Fraud, Operations, Compliance/Legal, Finance, Customer Support and other relevant personnel based on the incident.

8. INITIAL TRIAGE

The response team shall assess the nature, scope, severity, affected assets, potential customer impact, financial exposure and immediate containment requirements.

9. CONTAINMENT

• Disable or restrict compromised accounts
• Block suspicious transactions or access
• Isolate affected systems where appropriate
• Revoke or rotate compromised credentials/tokens
• Restrict malicious IPs or traffic where appropriate
• Coordinate with affected vendors or payment partners

10. EVIDENCE PRESERVATION

Relevant logs, transaction records, communications, system images or other available evidence shall be preserved in a manner reasonably designed to maintain integrity and support investigation, subject to applicable law and technical feasibility.

11. INVESTIGATION

Investigations may examine authentication events, transaction history, account activity, system logs, network indicators, application events, voucher records, communications and third-party information.

12. CYBER FRAUD RESPONSE

Where cyber incidents involve financial fraud, unauthorised transactions, account takeover or voucher abuse, Fraud/Risk shall coordinate with Operations, Finance, Technology and relevant external partners.

13. CUSTOMER PROTECTION

The Company may temporarily restrict affected accounts, transactions or services where necessary to protect customers and the Company, subject to applicable requirements and internal procedures.

14. THIRD-PARTY INCIDENTS

Material cyber incidents involving payment gateways, banks, processors, cloud providers or other vendors shall be escalated through contractual and operational channels and tracked to resolution.

15. COMMUNICATION & ESCALATION

Material incidents shall be escalated to authorised management. Customer, partner, legal, regulatory or law-enforcement communications shall be coordinated through designated functions and made where required or appropriate.

16. REGULATORY / LAW-ENFORCEMENT COORDINATION

Where applicable, the Company shall coordinate with competent authorities, law-enforcement agencies, cybercrime authorities, regulators, payment partners or other authorised bodies in accordance with applicable requirements.

17. INCIDENT DOCUMENTATION

Each material incident should maintain a chronology of detection, actions, decisions, evidence, communications, containment, recovery and closure.

18. RECOVERY

Affected services shall be restored using appropriate recovery procedures. Systems shall be validated and security controls reviewed before normal operations are resumed where appropriate.

19. ROOT-CAUSE ANALYSIS

Material incidents shall be reviewed to identify root causes, control failures, contributing factors and opportunities for improvement.

20. CORRECTIVE & PREVENTIVE ACTION

Remediation actions shall be assigned owners and target dates. Material outstanding risks shall be escalated to management.

21. FRAUD LOSS & RECOVERY

Where financial loss occurs, Finance, Risk/Fraud and relevant partners may coordinate transaction tracing, reversal, recovery, reconciliation and other lawful measures.

22. CUSTOMER COMMUNICATION

Customer communications shall be accurate, timely and appropriately controlled. Sensitive investigation details shall not be disclosed where doing so could increase risk, compromise evidence or violate legal obligations.

23. CONFIDENTIALITY

Incident information shall be shared only with authorised personnel and parties with a legitimate need to know.

24. CYBER INCIDENT EXERCISES

The Company may conduct tabletop exercises, technical tests or simulations appropriate to its size, risk profile and available resources.

25. BUSINESS CONTINUITY

Cyber incident response shall coordinate with Business Continuity & Disaster Recovery arrangements for critical systems and services.

26. RECORD RETENTION

Incident records, evidence, reports, communications and remediation documentation shall be retained according to applicable legal, contractual, security and record-keeping requirements.

27. RESPONSIBILITY MATRIX

28. POLICY EXCEPTIONS

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory or contractual requirements shall continue to apply.

29. REVIEW & AMENDMENT

This Policy shall be reviewed at least annually and following material cyber incidents, response exercises, significant system changes or changes in applicable requirements.

30. APPROVAL