DIGITTPAY SOLUTIONS LLP

This Policy establishes requirements for retaining, protecting, accessing, retrieving, archiving and securely disposing of business, customer, transaction, gift card/voucher, financial, security and operational records maintained by DIGITTPAY SOLUTIONS LLP.

• Maintain accurate and reliable business records.
• Support legal, regulatory, contractual, audit and operational requirements.
• Protect records against unauthorised access, alteration, loss or destruction.
• Ensure records remain available for legitimate business and investigation purposes.
• Avoid retaining information longer than reasonably required, subject to applicable obligations.

This Policy applies to electronic and physical records created, received, processed or maintained by the Company, including records held through authorised third-party service providers.

• Customer and account records
• Gift card / gift voucher issuance and redemption records
• Transaction, payment, refund and reversal records
• Settlement and reconciliation records
• KYC / verification records where applicable
• Fraud and transaction-monitoring records
• Complaint and grievance records
• Chargeback and dispute records
• Information-security and cyber-incident records
• Vendor and contractual records
• Financial and accounting records
• Employee and administrative records
• System logs and audit trails
• Policies, approvals and governance records

• Retain records for the period required by applicable law, regulation, contract, dispute, investigation or legitimate business need.
• Apply documented retention periods by record category where practicable.
• Protect retained records from unauthorised modification or deletion.
• Apply legal holds where records may be relevant to an investigation, dispute or proceeding.
• Dispose of records securely when retention is no longer required.

The Company shall maintain a controlled retention schedule. Actual periods shall be determined by applicable legal, regulatory, contractual, tax, accounting, dispute, security and operational requirements rather than by a single universal period.

Records shall be maintained in a manner designed to preserve accuracy, completeness, traceability and integrity. Material corrections should be traceable and appropriately authorised.

Access to records shall be based on legitimate business need and least privilege. Sensitive customer, financial, security and transaction records shall receive appropriate access restrictions.

Confidential and personal information shall be protected through appropriate technical, organisational and contractual safeguards throughout its retention period.

• Use authorised systems and repositories.
• Maintain appropriate access controls.
• Protect against unauthorised alteration or deletion.
• Maintain relevant audit trails where practical.
• Back up critical records according to applicable continuity requirements.

Where physical records are maintained, they shall be stored securely with appropriate access restrictions and protection against loss, damage or unauthorised removal.

Where records are held by vendors or service providers, contracts should address access, confidentiality, security, retention, retrieval, return and deletion requirements as appropriate.

When the Company becomes aware of a material dispute, investigation, legal proceeding, regulatory request or other circumstance requiring preservation, relevant records shall be protected from routine disposal until the hold is appropriately released.

Records should be reasonably retrievable for authorised business, audit, investigation, customer-service, dispute or legal purposes, subject to applicable access restrictions.

• Electronic records shall be securely deleted or rendered unrecoverable using appropriate methods.
• Physical records containing confidential information shall be securely destroyed.
• Third-party disposal shall be subject to appropriate contractual controls.
• Disposal shall not occur where a legal hold or other mandatory preservation requirement applies.

The Company should avoid retaining information that is no longer required for a legitimate business, legal, regulatory, contractual or security purpose, subject to applicable retention obligations.

Critical records may be archived or backed up according to business continuity and security requirements. Archived records remain subject to applicable access, confidentiality, retention and disposal controls.

For systems where traceability is important, appropriate logs or audit trails should record relevant access, changes, approvals or transaction events, subject to technical capability and applicable requirements.

Requests concerning access, correction, deletion or other rights relating to personal information shall be handled according to applicable privacy requirements, contractual commitments and the Company's Data Privacy & Protection Policy.

Loss, corruption, unauthorised access, accidental disclosure or destruction of material records shall be assessed under the Incident Response & Cyber Security Incident Management Policy and relevant privacy or fraud procedures.

The Company may periodically review retention practices, access permissions, disposal processes, record integrity and compliance with the approved retention schedule.

Relevant personnel shall receive awareness on record handling, confidentiality, retention, legal holds, secure disposal and protection of customer and transaction information.

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory, contractual or preservation requirements shall not be bypassed.

This Policy shall be reviewed at least annually and following material changes in law, business model, products, technology, record categories or audit findings.