DIGITTPAY SOLUTIONS LLP

This Policy establishes a risk-based framework for identifying, assessing, onboarding, contracting, monitoring and exiting third-party vendors and service providers used by DIGITTPAY SOLUTIONS LLP.

• Identify and manage risks arising from third-party relationships.
• Apply appropriate due diligence before onboarding vendors.
• Protect customer, transaction, voucher and Company information.
• Establish contractual security, confidentiality and service requirements.
• Monitor critical vendors and manage incidents or service failures.
• Ensure orderly termination and data return/deletion.

This Policy applies to vendors, suppliers, technology providers, cloud providers, payment or transaction partners, API providers, consultants, outsourced service providers and other third parties whose services may affect Company operations, customers, data, technology or business continuity.

The Company should maintain an inventory of material vendors including service description, owner, risk classification, contract status, data access, criticality and review status.

• Legal entity and ownership information
• Business registration and relevant licences where applicable
• Service capability and experience
• Information-security controls
• Privacy and data-protection practices
• Financial and operational stability
• Business continuity and disaster-recovery capability
• Relevant adverse history or material incidents where reasonably identifiable
• Subcontractor / fourth-party dependencies where relevant

Vendors with access to Company systems, personal information, customer data, transaction information or critical infrastructure shall be assessed for appropriate security and privacy controls proportionate to risk.

• Scope of services and service levels
• Confidentiality obligations
• Information-security requirements
• Data protection and permitted use
• Incident notification and cooperation
• Access control and least privilege
• Business continuity and recovery
• Audit / assurance rights where appropriate
• Subcontractor controls
• Data return and secure deletion
• Termination and transition assistance

Critical or material vendors should have defined service levels, availability expectations, support arrangements, incident response contacts and escalation procedures appropriate to the service.

Third-party access shall be granted on a need-to-use and least-privilege basis. Access should be reviewed periodically and removed promptly when no longer required.

Vendors shall receive only the information reasonably necessary for authorised services. Sensitive information shall be protected through appropriate technical, contractual and organisational controls.

Material subcontracting or fourth-party dependencies should be disclosed or controlled where appropriate. Vendors remain responsible for meeting their contractual obligations for authorised subcontractors.

• Service performance
• Security incidents
• Privacy incidents
• Material control changes
• Compliance concerns
• Business continuity capability
• Contract and SLA performance
• Customer-impacting service issues

Critical and high-risk vendors shall be reassessed periodically based on risk. Reassessment may include updated due diligence, security evidence, financial information, service performance and incident history.

Material vendor security or service incidents shall be escalated to the Company promptly in accordance with contractual arrangements and the Company's Incident Response and Business Continuity policies.

Critical vendors should maintain appropriate continuity and recovery arrangements. The Company should consider dependency concentration and available alternatives when assessing material vendor risk.

Where vendors handle funds, transaction processing, gift card issuance/redemption, refunds or other financially sensitive activities, appropriate financial controls, reconciliation, fraud monitoring and risk safeguards shall be applied.

Where proportionate, the Company may request relevant assurance reports, security certifications, control questionnaires, audit evidence or other documentation from material vendors.

Vendor performance shall be monitored against agreed service levels, operational requirements, security expectations and material customer-impact indicators.

Vendor termination shall include appropriate access revocation, data return or deletion, transition of services, credential removal, outstanding reconciliation and preservation of records where required.

For critical dependencies, the Company should maintain proportionate exit or contingency arrangements, including alternative suppliers, internal fallback procedures or recovery options where practical.

Vendor due diligence, approvals, contracts, assessments, incidents, reviews, performance records and termination documentation shall be retained according to applicable requirements.

Relevant personnel responsible for vendor onboarding, monitoring, security, procurement, operations or contract management shall receive appropriate awareness on vendor-risk requirements.

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory, contractual and security requirements shall not be bypassed.

This Policy shall be reviewed at least annually and following material vendor incidents, major changes in vendor dependencies, audit findings or changes in applicable requirements.