BUSINESS CONTINUITY & DISASTER RECOVERY POLICY

This Policy establishes the framework for maintaining critical business services, protecting customers and transaction processes, and restoring operations following disruptions affecting REMPINDIA MULTITRADE PRIVATE LIMITED, its gift-card/voucher services, technology systems or critical partners.

• Maintain continuity of critical business services.
• Reduce operational and customer impact from disruptions.
• Define recovery priorities, responsibilities and escalation.
• Protect critical data and systems.
• Provide controlled recovery procedures.
• Coordinate continuity with PPI, bank, payment, merchant and technology partners.

This Policy covers critical applications, APIs, websites, transaction systems, customer support, payment and settlement processes, data, infrastructure, personnel, facilities and material third-party dependencies.

Critical processes shall be assessed for customer, financial, operational, contractual and regulatory impact. Recovery priorities shall be based on the consequences of prolonged disruption.

• Gift-card/voucher purchase and issuance
• Activation and redemption
• Payment and transaction processing
• Refunds and customer support
• Fraud and transaction monitoring
• Settlement and reconciliation
• Critical technology and API services
• Partner communication and escalation

Management shall define appropriate recovery priorities for critical services, including target recovery objectives where practicable. Dependencies on external partners shall be considered in recovery planning.

The continuity team may include Management, Operations, Technology, Information Security, Risk/Fraud, Compliance, Finance, Customer Support, Facilities/HR and relevant partner representatives depending on the incident.

• Cyber-security incident
• Cloud or hosting outage
• Application/API failure
• Power or connectivity disruption
• Natural disaster
• Fire or physical facility disruption
• Critical vendor or partner outage
• Payment/PPI service disruption
• Data corruption or system failure
• Workforce or operational disruption

1. Identify and assess the disruption.
2. Determine whether continuity activation is required.
3. Notify responsible stakeholders.
4. Prioritise critical services.
5. Implement approved continuity measures.
6. Coordinate with relevant partners.
7. Communicate internally and externally as appropriate.
8. Track recovery until normal operations resume.

Technology teams shall maintain recovery procedures for critical systems, including backup restoration, infrastructure recovery, application recovery, data validation and security verification.

• Critical data shall be backed up according to business requirements.
• Backups shall be protected against unauthorised access.
• Backup failures shall be monitored and addressed.
• Recovery procedures shall be tested periodically where appropriate.
• Critical backups should be protected from the same failure affecting production systems.

Where applicable, appropriate alternate infrastructure, cloud resources, backup environments or other recovery arrangements shall be maintained based on risk and business requirements.

Recovered data shall be checked for completeness and integrity before critical transactions are resumed. Reconciliation shall be performed where disruption may have created duplicate, missing or unmatched transactions.

During a disruption, the Company shall prioritise customer safety, transaction integrity and transparent communication. Where transactions cannot be confirmed, appropriate controls shall be applied to prevent duplicate processing or customer loss.

Critical payment, PPI, bank and settlement dependencies shall be documented. Contingency procedures shall address failed, pending, duplicated or unmatched transactions.

Material vendors and partners shall be assessed for continuity capability where appropriate. Critical contractual arrangements should include reasonable availability, incident notification and recovery expectations.

Continuity events shall use approved communication channels. Stakeholders may include employees, management, customers, merchants, PPI/bank/payment partners, vendors and authorities where applicable.

Where facilities or normal working arrangements are unavailable, the Company may implement approved remote or alternate working arrangements subject to security, access and confidentiality controls.

Critical functions shall identify primary and backup responsible personnel where practicable. Appropriate access and knowledge- transfer arrangements shall support continuity.

Material disruptions shall be escalated according to severity, customer impact, financial impact, service criticality and regulatory/contractual requirements.

Business continuity and disaster recovery arrangements shall be tested periodically through tabletop exercises, backup restoration tests, failover tests or other appropriate exercises.

Testing results shall be documented. Identified gaps shall have assigned owners and remediation timelines. Material unresolved gaps shall be escalated to management.

1. Confirm systems and facilities are stable.
2. Validate security and data integrity.
3. Reconcile transactions and financial records.
4. Restore standard operating procedures.
5. Monitor for residual issues.
6. Close continuity activation after management approval.

Material continuity events shall be reviewed to identify root causes, customer impact, recovery performance, control gaps and improvements.

Continuity plans, test results, recovery actions, incident records, communications and remediation evidence shall be retained according to applicable requirements.

Business continuity documents may contain sensitive operational information and shall be restricted to authorised personnel. Recovery environments shall follow applicable security requirements.

Exceptions to this Policy shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory or partner requirements shall not be bypassed.

This Policy shall be reviewed at least annually and after a material disruption, major technology change, new critical dependency or significant change in the Company's risk profile.