BUSINESS CONTINUITY & DISASTER RECOVERY POLICY

This Policy establishes the framework for maintaining critical business services and recovering technology, data and operational capabilities following disruptions affecting JSR ALL-IN-ONE SOLUTIONS PRIVATE LIMITED and its gift-card/voucher business.

• Protect customers, employees, information and critical business operations during disruption.
• Identify critical services, dependencies and recovery priorities.
• Establish continuity, backup, recovery and crisis-management arrangements.
• Minimise service interruption, data loss and financial impact.
• Provide structured escalation and communication during a disruption.
• Test and improve continuity and disaster-recovery capabilities.

This Policy applies to critical business processes, websites, applications, APIs, databases, cloud services, payment integrations, gift-card/voucher systems, communication channels, facilities, employees, vendors and technology partners supporting Company operations.

Management shall provide oversight and resources for business continuity and disaster recovery. Critical functions shall have designated owners and appropriate recovery arrangements.

The Company shall periodically assess the impact of disruptions on critical services, customers, revenue, transactions, regulatory obligations, data and partner dependencies. Recovery priorities shall be based on business impact and risk.

• Gift card / voucher ordering and issuance
• Voucher delivery and customer communication
• Voucher redemption and transaction processing where applicable
• Payment and partner integrations
• Customer support and grievance handling
• Fraud and transaction monitoring
• Finance, settlement and reconciliation
• Information security and incident response

Critical services shall be assigned recovery priorities based on customer impact, financial impact, contractual obligations, security risk and operational dependency. Recovery objectives shall be documented where appropriate.

• Redundancy or failover for critical technology services where appropriate.
• Alternative communication and operational procedures.
• Defined manual workarounds for critical processes where feasible.
• Alternative personnel and delegated responsibilities.
• Vendor and partner continuity arrangements.
• Protected backup and recovery capabilities.

Disaster recovery arrangements shall support restoration of critical applications, infrastructure, databases, configurations and other technology capabilities following a major disruption.

• Critical data shall be backed up according to business and technology requirements.
• Backups shall be protected from unauthorised access and alteration.
• Backup availability and integrity shall be tested periodically based on risk.
• Backup failures shall be identified and remediated.

Where appropriate, critical systems shall have documented recovery environments, configurations or procedures. Recovery arrangements shall be reviewed after major technology changes.

Where disruption results from cyber attack or ransomware, recovery shall be coordinated with the Cyber Incident Response Policy. Systems shall not be restored to production until appropriate security validation and containment checks have been completed.

Critical PPI, bank, payment processor, merchant, cloud, technology and other service-provider dependencies shall be assessed. Material providers should maintain appropriate continuity arrangements and incident communication mechanisms.

A material disruption may require activation of a management-led crisis response. The response shall establish incident leadership, priorities, communications, business decisions, partner coordination and recovery tracking.

• Major technology outage
• Cyber attack or security incident causing material disruption
• Payment or partner service outage
• Data or system corruption
• Facility or utility disruption
• Natural disaster or other major external event
• Significant personnel unavailability
• Any event materially affecting critical customer services

Disruptions shall be assessed according to severity and escalated to Management, Operations, Technology, Information Security, Risk, Finance, Compliance, Customer Support and relevant partners as required.

During material disruptions, communications shall be controlled by authorised personnel. Customers, employees, vendors and partners shall receive accurate information appropriate to the incident. Sensitive security information shall not be unnecessarily disclosed.

• Prioritise restoration of critical customer services.
• Protect customer balances, voucher values and transaction records.
• Prevent duplicate or erroneous processing during recovery.
• Provide appropriate customer support for affected transactions.
• Coordinate refunds or reversals where required.

After recovery, transaction, voucher, payment, settlement and customer records shall be reconciled where appropriate to identify duplicate, missing, inconsistent or incomplete records before normal processing resumes.

1. Confirm threat or disruption is contained.
2. Validate system and data integrity.
3. Restore services in approved priority order.
4. Perform transaction and operational reconciliation.
5. Monitor services for abnormal behaviour.
6. Close the continuity event after management approval.

• Backup restoration testing
• Application and infrastructure recovery testing
• Failover or continuity testing where applicable
• Cyber incident and ransomware exercises
• Tabletop crisis exercises
• Partner continuity testing where appropriate

Testing shall produce documented results, identified gaps, responsible owners and corrective actions. Material weaknesses shall be escalated and tracked until remediation or formally accepted risk.

Relevant personnel shall be trained on continuity responsibilities, escalation, communication, manual workarounds, incident reporting and recovery procedures appropriate to their roles.

Continuity plans, recovery procedures, critical contacts and escalation information shall be maintained and updated after material organisational, technology or partner changes.

Business continuity assessments, recovery tests, incident records, backup tests, exercise results, approvals and remediation evidence shall be retained according to the Company's record-retention requirements.

Exceptions to this Policy shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory and contractual obligations shall continue to apply.

This Policy shall be reviewed at least annually and following a material disruption, major technology change, significant partner change or material change in business risk.