FINZOOPAY SOLUTIONS LLP

1. PURPOSE

This Policy establishes the framework for responsible collection, use, access, protection, retention, disclosure and secure disposal of personal, customer, transaction, financial, business and security information handled by FINZOOPAY SOLUTIONS LLP.

2. OBJECTIVES

• Protect personal and confidential information from unauthorised access, disclosure, alteration, loss or destruction.
• Use information only for legitimate and authorised business purposes.
• Maintain appropriate records and retention controls.
• Support applicable privacy, data-protection, contractual and legal obligations.
• Provide appropriate processes for data access, correction, deletion or other rights where applicable.

3. SCOPE

This Policy applies to personal data, customer information, transaction records, payment information, voucher records, employee information, partner information, business records, logs, communications and other information processed by the Company or on its behalf.

4. DATA GOVERNANCE

Management shall assign appropriate ownership for privacy, information security, records and data management. Data owners shall define access, retention and protection requirements appropriate to information sensitivity.

5. DATA CLASSIFICATION

• Public – approved for public disclosure.
• Internal – intended for authorised internal use.
• Confidential – business, customer, transaction or partner information requiring controlled access.
• Restricted – highly sensitive information requiring enhanced controls.

6. DATA COLLECTION

The Company shall collect information that is relevant and reasonably necessary for legitimate business, contractual, security, transaction, compliance or other authorised purposes.

7. PURPOSE LIMITATION

Personal and confidential information shall be used only for stated or otherwise lawful purposes and shall not be used in ways inconsistent with applicable requirements or the Company's documented business purposes.

8. DATA ACCURACY

Reasonable measures shall be taken to maintain accurate and relevant information. Where errors are identified, appropriate correction or updating processes shall be followed.

9. ACCESS CONTROL

Access to personal and confidential information shall be granted on a need-to-know and least-privilege basis. Access shall be reviewed periodically and removed when no longer required.

10. DATA SECURITY

• Encryption or equivalent protection where appropriate
• Secure authentication and access control
• Logging and monitoring
• Endpoint and network security
• Backup and recovery controls
• Secure disposal
• Security incident response

11. DATA SHARING & DISCLOSURE

Information may be shared with authorised employees, service providers, payment partners, banks, processors, regulators, law-enforcement agencies or other parties where necessary for legitimate business purposes, contractual obligations, legal requirements or authorised services, subject to appropriate controls.

12. CROSS-BORDER / THIRD-PARTY PROCESSING

Where data is processed by third parties or transferred across jurisdictions, the Company shall consider applicable legal requirements, contractual safeguards, security measures and vendor risk.

13. CUSTOMER PRIVACY RIGHTS

Where applicable, individuals may have rights relating to access, correction, deletion, consent withdrawal, grievance or other data rights. Requests shall be handled through designated processes subject to applicable law and lawful exceptions.

14. PRIVACY NOTICE

Where required, the Company shall provide appropriate privacy information describing relevant data collection, purposes, sharing, retention, security and applicable rights.

15. CONSENT & LAWFUL PROCESSING

Where consent is required, it shall be obtained through an appropriate mechanism. Other lawful bases may be used where permitted by applicable law.

16. DATA RETENTION PRINCIPLES

Information shall be retained only for as long as necessary for the relevant purpose, legal or regulatory requirements, contractual obligations, dispute management, security, audit or other legitimate requirements.

17. RETENTION CATEGORIES

• Customer and KYC records where applicable
• Transaction and payment records
• Voucher / gift-card records
• Accounting and financial records
• Contracts and vendor records
• Security and audit logs
• Fraud and incident records
• Customer complaints and dispute records
• Employee and administrative records

18. RECORD-KEEPING

Records shall be maintained in a manner that supports accuracy, integrity, accessibility to authorised personnel, traceability and appropriate auditability.

19. SECURE DISPOSAL

When retention requirements expire, information shall be securely deleted, destroyed, anonymised or otherwise rendered appropriately inaccessible, subject to legal holds or continuing lawful retention requirements.

20. LEGAL HOLD / INVESTIGATION

Where information is relevant to litigation, investigation, regulatory review, fraud investigation or other legal process, disposal shall be suspended to the extent required and the relevant information shall be preserved.

21. DATA BREACH & INCIDENT RESPONSE

Suspected loss, unauthorised access, disclosure or compromise of personal or confidential information shall be escalated under the Company's Cyber Incident Response & Cyber Fraud Management Policy.

22. THIRD-PARTY DATA PROCESSORS

Vendors processing personal or confidential information shall be subject to appropriate due diligence, contractual requirements, security controls, confidentiality obligations and monitoring based on risk.

23. DATA SUBJECT / CUSTOMER REQUEST HANDLING

Requests concerning personal information shall be logged, verified as appropriate, assessed under applicable requirements and responded to within applicable timelines.

24. RECORD INTEGRITY

Records shall be protected against unauthorised alteration or deletion. Material changes to records shall be traceable where appropriate.

25. ACCESS & AUDIT TRAILS

Systems containing sensitive information should maintain appropriate access logs or audit trails proportionate to risk and system capability.

26. EMPLOYEE RESPONSIBILITIES

• Use information only for authorised purposes.
• Protect passwords, devices and access credentials.
• Do not disclose confidential information without authorisation.
• Report suspected data loss, privacy incidents or unauthorised access promptly.
• Follow retention and secure-disposal requirements.

27. TRAINING & AWARENESS

Relevant personnel shall receive periodic awareness on privacy, confidentiality, data security, records management and incident reporting appropriate to their responsibilities.

28. POLICY EXCEPTIONS

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory or contractual requirements shall not be overridden.

29. RESPONSIBILITY MATRIX

30. REVIEW & AMENDMENT

This Policy shall be reviewed at least annually and after material privacy incidents, significant technology or business changes, changes in data-processing activities or applicable requirements.

31. APPROVAL