DIGITTPAY SOLUTIONS LLP

This Policy establishes the framework for maintaining critical business operations and recovering technology, applications, data and services following disruption, disaster, cyber incident, infrastructure failure, vendor outage or other event that materially affects DIGITTPAY SOLUTIONS LLP.

• Maintain continuity of critical gift card, gift voucher and supporting digital services.
• Protect customers, transaction records, business information and critical assets during disruption.
• Define recovery priorities, responsibilities and escalation paths.
• Enable controlled restoration of systems and services.
• Reduce operational, financial, customer and compliance impact.

This Policy applies to critical business processes, employees, technology systems, applications, APIs, databases, cloud services, networks, communication channels, vendors and other resources supporting the Company's operations.

• Protect life, safety and security where applicable.
• Prioritise critical customer and transaction services.
• Maintain integrity of transaction and voucher records.
• Use approved recovery procedures.
• Communicate material disruptions through authorised channels.
• Restore services in a controlled and secure manner.

The Company should identify critical processes, dependencies, maximum tolerable disruption, recovery priorities and key resources. Business impact assessments should be reviewed periodically and after material business or technology changes.

• Gift card / gift voucher issuance and activation
• Voucher redemption and validation
• Customer account and support services
• Transaction processing and reconciliation
• Refund and reversal processing
• Fraud and transaction monitoring
• Critical APIs and partner integrations
• Financial and operational record access

• Cyber-security incident
• Ransomware or malware
• Cloud or hosting outage
• Database failure or corruption
• Network or connectivity outage
• Power or facility disruption
• Critical vendor or payment-partner outage
• Application or API failure
• Data loss or integrity incident
• Natural disaster or other major external event

Recovery Time Objective (RTO) and Recovery Point Objective (RPO) shall be defined for critical systems based on business impact, technical capability, contractual commitments and risk. Where formal values are not yet established, management shall determine practical recovery priorities.

• Critical data should be backed up according to defined business and technical requirements.
• Backups should be protected from unauthorised access and unauthorised modification.
• Backup restoration should be tested periodically where practical.
• Backup failures should be investigated and remediated.

Disaster recovery arrangements may include alternate infrastructure, backup environments, restoration procedures, redundant services, secure configuration baselines and approved technical recovery runbooks.

Cyber incidents affecting availability or integrity shall be handled jointly under the Incident Response & Cyber Security Incident Management Policy and this Business Continuity framework.

Critical vendors should be assessed for continuity capability, service dependencies, incident notification, recovery arrangements and alternative options where proportionate to risk.

Where a facility or operational disruption affects personnel, the Company may activate alternate working arrangements, remote access, role substitution or other approved continuity measures, subject to security and access controls.

Material disruptions shall be communicated internally and, where appropriate, to customers, partners, vendors or authorities through authorised channels. Communications should be accurate and avoid disclosure of sensitive security information.

The Business Continuity Plan may be activated by authorised management or designated incident leadership when disruption materially affects critical services or is reasonably expected to do so.

Recovered systems and data shall be validated for integrity, completeness and security before being returned to normal production use, particularly for transaction, settlement, voucher and customer records.

Where appropriate, the Company may use approved manual or alternate procedures for critical activities during system disruption. Such activity shall be controlled, documented and reconciled when normal systems are restored.

Transactions, voucher issuance/redemption, refunds, reversals, settlements and other material records processed during or around a disruption shall be reconciled after recovery to identify discrepancies.

• Tabletop continuity exercises
• Backup restoration tests
• Disaster-recovery technical tests
• Communication tests
• Vendor continuity exercises where appropriate
• Post-test corrective actions

Following a material continuity or recovery event, the Company shall review the cause, impact, response effectiveness, recovery performance and lessons learned, and track corrective actions.

Business continuity plans, recovery procedures, test results, incident records, approvals, recovery decisions and corrective actions shall be retained according to applicable requirements and the Company's record-retention framework.

Relevant personnel shall receive appropriate awareness or training regarding continuity responsibilities, emergency contacts, recovery procedures, security requirements and escalation processes.

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, contractual, security or operational requirements shall continue to apply.

This Policy shall be reviewed at least annually and after material disruption, disaster-recovery exercise, major technology change, critical vendor change or significant change in applicable requirements.