DIGITTPAY SOLUTIONS LLP

This Policy establishes the Company's framework for responsible collection, use, access, disclosure, protection, retention and disposal of personal information and business records.

This Policy applies to personal information and records processed by or on behalf of the Company through websites, applications, customer support, gift card/voucher operations, transactions, employees, vendors and business partners, subject to applicable law and contractual obligations.

• Lawfulness, fairness and transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Security and confidentiality
• Accountability

• Customer identification and contact information
• Account and authentication information
• Order, transaction and voucher information
• Payment-related references and status information
• Customer support and complaint records
• Fraud, risk and security information
• Employee and vendor information
• Technical and usage information, where lawfully collected

Information may be processed for account and service delivery, transaction processing, gift card/voucher issuance and redemption, customer support, fraud prevention, security, dispute handling, legal compliance, record keeping, analytics and other disclosed or legally permitted purposes.

The Company shall seek to collect information that is reasonably necessary for the relevant business purpose. Sensitive information shall be handled with heightened safeguards where applicable.

Where required, appropriate privacy notices shall explain relevant categories of information, purposes, sharing arrangements, rights and other legally required information.

Where applicable, the Company shall obtain consent or rely on another lawful basis for processing as permitted by applicable law. Consent records shall be maintained where relevant.

Requests relating to access, correction, deletion, withdrawal of consent or other applicable rights shall be handled through designated channels in accordance with applicable law and verification procedures.

The Company may reasonably verify the identity of a requester before providing, changing or deleting personal information to prevent unauthorised disclosure or account takeover.

Reasonable measures shall be taken to maintain accurate and current information relevant to the purpose for which it is processed. Material inaccuracies identified by customers or personnel should be corrected where appropriate.

• Role-based access
• Least-privilege principles
• Strong authentication where appropriate
• Periodic access review
• Prompt removal or modification of access on role changes or termination

• Encryption or equivalent safeguards where appropriate
• Secure transmission
• Logging and monitoring
• Endpoint and system security
• Backup and recovery controls
• Incident detection and response

Vendors and service providers processing personal information on behalf of the Company shall be subject to proportionate due diligence, contractual safeguards, confidentiality requirements and appropriate security expectations.

Information may be shared with authorised payment partners, technology providers, merchants, service providers, professional advisers, regulators, law-enforcement authorities or other parties where necessary, contractually permitted or legally required.

Where information is processed or transferred across borders, the Company shall apply safeguards and comply with applicable legal and contractual requirements.

Suspected loss, unauthorised access, disclosure, alteration or destruction of personal information shall be escalated under the Cyber Fraud Prevention & Incident Response Policy and handled according to applicable legal and contractual requirements.

Personal information and business records shall be retained only for as long as necessary for the applicable purpose, legal obligations, contractual requirements, dispute handling, audit needs or other legitimate requirements.

Where litigation, investigation, audit, regulatory inquiry or a material dispute is reasonably anticipated or ongoing, relevant records shall not be destroyed until the applicable hold is released.

When retention is no longer required, information shall be securely deleted, destroyed, anonymised or otherwise disposed of using methods appropriate to its sensitivity and storage medium.

Material records shall be protected against unauthorised alteration or deletion and should remain retrievable for authorised audit, investigation or business purposes.

Important records and systems shall be backed up according to business continuity and information-security requirements, with appropriate access restrictions and recovery testing.

Personnel shall maintain confidentiality of personal information and Company records and shall disclose information only to authorised recipients with a legitimate need or lawful basis.

• Use personal information only for authorised purposes.
• Protect passwords, devices and access credentials.
• Do not copy or export data without authorisation.
• Report suspected privacy or security incidents promptly.
• Follow retention and secure-disposal procedures.

Relevant personnel shall receive role-appropriate privacy, confidentiality, information-security and record-management training.

The Company may conduct periodic reviews of access, data handling, vendor controls, retention, security incidents and privacy practices. Material findings shall be assigned for remediation.

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory, contractual or security requirements shall not be bypassed.

This Policy shall be reviewed at least annually and after material legal, regulatory, technology, business-model or security changes.