DATA PROTECTION, PRIVACY, DATA RETENTION & RECORD-KEEPING POLICY

This Policy establishes principles and controls for responsible collection, use, access, storage, sharing, retention and disposal of personal, customer, transaction and business records handled by REMPINDIA MULTITRADE PRIVATE LIMITED in connection with its gift-card and gift-voucher business.

• Protect personal and confidential information from unauthorised access, use, disclosure, alteration or loss.
• Use information only for legitimate and defined purposes.
• Maintain accurate and reliable records.
• Apply appropriate retention and secure disposal controls.
• Support customer rights and lawful requests.
• Maintain evidence needed for operational, contractual, legal and regulatory purposes.

This Policy applies to personal data, customer information, transaction records, voucher information, employee and vendor records, financial records, security logs, communications, contracts, compliance records and other business information handled by the Company or authorised processors.

• Lawfulness, fairness and transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Security and confidentiality
• Accountability

Only information reasonably required for legitimate business, contractual, customer-service, security, fraud-prevention, legal or regulatory purposes should be collected.

• Providing gift-card and voucher services
• Processing payments and transactions
• Customer support and grievance handling
• Fraud prevention and transaction monitoring
• Refunds, disputes and chargebacks
• Security and incident management
• Compliance with applicable legal and contractual requirements

Reasonable measures shall be taken to maintain accurate and relevant records. Material inaccuracies identified through customer requests or internal review should be corrected where appropriate.

Access to personal and confidential information shall be based on business need, least privilege and appropriate role-based controls. Privileged access shall be restricted and reviewed.

• Use appropriate technical and organisational safeguards.
• Protect data in transit and, where appropriate, at rest.
• Restrict unauthorised copying or disclosure.
• Maintain relevant security logs and access controls.
• Report suspected data breaches or security incidents promptly.

Information may be shared with authorised PPI issuers, banks, payment processors, merchants, service providers, technology providers, professional advisers, regulators or authorities where necessary, permitted and subject to applicable obligations.

Third parties processing personal or confidential information shall be subject to appropriate due diligence, contractual safeguards, access limitations and risk-based monitoring.

Where information is transferred outside the applicable jurisdiction or to external service providers, such transfers shall be managed according to applicable legal, contractual, security and privacy requirements.

Customer requests concerning access, correction, deletion, withdrawal or other applicable privacy rights shall be assessed and handled according to applicable law and the Company's procedures.

Privacy-related complaints shall be recorded, investigated and escalated to the designated Compliance/Privacy function as appropriate.

Suspected or confirmed personal-data breaches shall be handled under the Cyber Incident Response Policy, including containment, evidence preservation, impact assessment, remediation and any required notification.

Records shall be retained for no longer than necessary for the purpose for which they are maintained, subject to applicable legal, regulatory, contractual, tax, accounting, dispute, fraud-prevention and business requirements.

• Customer and transaction records
• Payment and settlement records
• Gift-card/voucher issuance and redemption records
• Refund, dispute and chargeback records
• Customer grievance records
• Fraud and security records
• Contracts and vendor records
• Accounting and tax records
• System and audit logs
• Compliance and regulatory records

The Company shall maintain a documented retention schedule identifying record category, responsible owner, minimum applicable retention period, storage location and disposal method. Where multiple requirements apply, the longer mandatory retention period shall normally be followed.

Where records are relevant to litigation, investigation, audit, dispute or an official request, routine deletion shall be suspended for the affected records until the hold is formally released.

Records required for audit, dispute, compliance or legal purposes shall be maintained in a manner that supports integrity, traceability and retrieval.

Electronic records shall be stored in authorised systems with appropriate access controls, backup, audit trails and protection against unauthorised alteration.

Physical records containing confidential or personal information shall be stored securely with controlled access and protected against loss, damage and unauthorised disclosure.

When retention is no longer required, records shall be securely deleted, destroyed or anonymised using methods appropriate to the medium and sensitivity of the information.

Backups shall be managed according to business continuity and security requirements. Backup copies may have different deletion cycles where necessary for system recovery, subject to applicable requirements.

Compliance with data-protection and record-keeping controls may be reviewed through access reviews, audits, security monitoring, retention reviews and control testing.

• Access information only for authorised purposes.
• Do not share credentials or confidential records.
• Use approved systems for sensitive information.
• Report suspected privacy or security incidents.
• Follow retention and secure disposal procedures.

Relevant personnel shall receive periodic training on privacy, confidentiality, secure data handling, phishing, access controls, incident reporting and record management.

Any exception shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory or contractual requirements shall not be bypassed.

This Policy shall be reviewed at least annually and whenever there is a material change in privacy law, data-processing activities, products, technology, partners or business risk.