DIGITTPAY SOLUTIONS LLP

This Policy establishes the framework through which DIGITTPAY SOLUTIONS LLP identifies, reports, assesses, contains, investigates, resolves and learns from information-security and cyber-security incidents affecting its systems, applications, APIs, data, customers, employees, vendors or business operations.

• Provide a structured and timely response to cyber-security incidents.
• Minimise customer, financial, operational, legal and reputational impact.
• Protect information, systems and gift card/voucher services.
• Preserve evidence and maintain appropriate investigation records.
• Ensure material incidents are escalated to authorised management and relevant stakeholders.
• Restore affected services safely and implement corrective actions.

This Policy applies to all Company-owned or Company-controlled systems, applications, websites, APIs, cloud environments, databases, endpoints, networks, customer information, transaction information, gift card/voucher systems, employee accounts and relevant third-party technology services.

A cyber-security incident includes an actual or suspected event that may compromise the confidentiality, integrity or availability of information or systems, or may result in unauthorised access, fraud, data exposure, malware, account compromise, service disruption or other security impact.

• Unauthorised access or account compromise
• Data breach or suspected data leakage
• Malware, ransomware or malicious code
• Phishing, credential theft or social engineering
• API or application-security compromise
• Website or service disruption
• Gift card / voucher system abuse or compromise
• Payment or transaction-security incident
• Cloud, infrastructure or database security incident
• Third-party/vendor security incident
• Insider misuse or unauthorised activity

All employees, contractors and relevant vendors shall promptly report suspected security incidents through designated internal channels. Personnel shall not suppress, alter or destroy relevant evidence.

The Company may constitute an incident response team appropriate to the nature and severity of an incident. Participants may include Information Security, Technology, Risk/Fraud, Operations, Compliance/Legal, Finance, Customer Support and Management.

• Detection and reporting
• Initial triage
• Severity classification
• Containment
• Evidence preservation
• Investigation and root-cause analysis
• Eradication / remediation
• Recovery and service restoration
• Post-incident review
• Corrective-action tracking

Security alerts, monitoring systems, user reports, vendor notifications, transaction anomalies and other indicators shall be assessed to determine whether an incident has occurred and its potential severity.

Where appropriate, authorised personnel may isolate systems, disable accounts, revoke credentials, block malicious traffic, suspend affected services, restrict transactions or take other proportionate measures to contain the incident.

Relevant logs, system records, transaction information, communications, files, screenshots and other evidence shall be preserved in a manner designed to maintain integrity and support investigation, dispute handling, audit or lawful requests.

Investigations shall determine the nature, scope, affected assets, affected data, attack vector, customer or transaction impact, root cause and required remediation, subject to available evidence and applicable access restrictions.

Where an incident may involve personal, confidential, financial or transaction information, the Company shall assess the nature and extent of exposure and take appropriate containment, investigation, remediation and notification steps as required by applicable law, contracts and risk assessment.

Where an incident affects customers or transactions, appropriate controls may include transaction holds, account restrictions, credential resets, enhanced verification, voucher suspension, refund/reversal coordination or other protective measures.

Vendors and partners shall be required, where appropriate, to notify the Company of material security incidents affecting Company systems, data, customers or services. The Company shall coordinate investigation and remediation with relevant third parties.

Incident communications shall be controlled and factual. External communications, customer notifications, regulatory communications, law-enforcement communications and media statements shall be handled by authorised personnel.

Where notification, reporting or cooperation with a competent authority, law-enforcement agency, regulator, bank, payment partner or network is required or appropriate, the Company shall coordinate through authorised functions and applicable procedures.

Incidents involving fraud, account takeover, voucher abuse, payment manipulation or other financial crime indicators shall also be handled under the applicable Fraud Prevention, Transaction Monitoring, AML/KYC and Unauthorised Transaction policies.

Where an incident causes service disruption, recovery shall be coordinated with the Business Continuity & Disaster Recovery framework. Systems shall be restored using approved recovery procedures and appropriate security validation.

Material incidents shall be reviewed after containment and recovery to identify root causes, control gaps, lessons learned and corrective actions.

• Patch or remediate vulnerabilities
• Strengthen access controls
• Update security rules or monitoring
• Improve customer protection controls
• Update procedures or technical configurations
• Conduct additional training
• Review relevant vendor controls

The Company shall maintain appropriate records of reported incidents, classification, actions taken, evidence, communications, decisions, recovery and corrective actions according to applicable retention requirements.

Incident information shall be shared only with authorised personnel and stakeholders who have a legitimate need to know, subject to legal, contractual and security requirements.

Relevant personnel shall receive periodic awareness or training on incident reporting, phishing, credential security, social engineering, secure data handling and response responsibilities.

The Company may periodically test incident-response procedures through tabletop exercises, simulations, technical testing or other appropriate methods based on risk and operational capacity.

Exceptions shall be documented, risk-assessed and approved by authorised management. No exception may override mandatory legal, regulatory, contractual or security requirements.

This Policy shall be reviewed at least annually and following material cyber incidents, significant system changes, audit findings or changes in applicable requirements.