DATA PROTECTION, PRIVACY, RETENTION & RECORD-KEEPING POLICY

This Policy establishes the Company's framework for responsible collection, use, access, storage, disclosure, protection, retention and disposal of personal, customer, transaction, voucher and business information handled by JSR ALL-IN-ONE SOLUTIONS PRIVATE LIMITED.

• Protect personal and confidential information from unauthorised access, use, disclosure, alteration or loss.
• Process information for legitimate and authorised business purposes.
• Apply appropriate security and privacy safeguards.
• Define retention and secure disposal requirements.
• Maintain accurate and auditable records.
• Support applicable legal, regulatory, contractual and partner requirements.

This Policy applies to customer information, employee and contractor information, transaction and payment-related records, gift-card/voucher information, business records, communications, system logs, security records and information processed by employees, contractors and authorised third parties.

• Purpose limitation – information shall be collected and used for specified legitimate purposes.
• Data minimisation – only information reasonably required for the relevant purpose should be collected.
• Accuracy – reasonable measures should be taken to maintain accurate information.
• Security – appropriate technical and organisational safeguards shall be applied.
• Retention limitation – information shall not be retained longer than required by applicable requirements or legitimate business need.
• Accountability – processing and controls should be appropriately documented.

• Public information
• Internal business information
• Confidential business information
• Personal / customer information
• Transaction and payment-related information
• Gift-card / voucher information
• Restricted security information

Personal and customer information shall be collected through authorised channels and used only for legitimate purposes such as account management, gift-card/voucher issuance or servicing, transaction processing, customer support, fraud prevention, compliance, security, reconciliation and other disclosed or legally permitted purposes.

Where applicable, customers shall be provided appropriate privacy information regarding the categories of information collected, purposes, relevant disclosures, retention principles and available rights or contact mechanisms.

Access to personal and confidential information shall be based on business need and least privilege. Access shall be reviewed periodically and removed when no longer required.

• Encryption or equivalent safeguards should be used where appropriate.
• Sensitive data shall not be unnecessarily copied or transferred.
• Credentials and security secrets shall be protected.
• Secure storage and transmission controls shall be maintained.
• Security incidents involving information shall be handled under the Cyber Incident Response Policy.

Information may be shared with authorised employees, vendors, payment/PPI/banking partners, merchants, technology providers, professional advisers, regulators or law-enforcement authorities where permitted or required, and subject to appropriate safeguards and contractual controls.

Third parties processing information on behalf of the Company shall be subject to appropriate due diligence, contractual confidentiality, security, privacy, access, incident-reporting and data-return/deletion requirements according to risk.

Where information is processed, stored or transferred outside the Company's primary operating environment, applicable legal, contractual and security requirements shall be assessed and appropriate safeguards implemented.

Reasonable processes shall be maintained to identify and correct materially inaccurate or incomplete customer or business information where correction is required for the relevant purpose.

Requests relating to access, correction, deletion, consent or other applicable privacy rights shall be handled through designated channels and assessed according to applicable law, contractual requirements and operational procedures.

Suspected or confirmed unauthorised access, disclosure, loss, alteration or destruction of personal or confidential information shall be escalated and managed under the Company's Cyber Incident Response Policy, including assessment of notification obligations where applicable.

Records shall be retained for the period required by applicable law, regulation, contractual obligation, legitimate business need, dispute requirements, security needs or audit requirements, as applicable.

• Customer and account records
• Transaction and payment records
• Gift-card / voucher issuance and redemption records
• Refund, cancellation and dispute records
• KYC / verification records where applicable
• Fraud and AML/CFT records where applicable
• Security and incident records
• Vendor and contractual records
• Financial and accounting records
• Corporate and governance records

Where records are relevant to litigation, investigation, regulatory review, dispute or other legal requirement, normal deletion shall be suspended to the extent necessary and authorised.

At the end of the applicable retention period, information shall be securely deleted, destroyed, anonymised or otherwise disposed of using methods appropriate to its sensitivity and storage medium, subject to legal holds and continuing obligations.

Backup copies shall be managed consistently with business continuity and security requirements. Expired data in backups shall be handled through appropriate backup lifecycle processes where technically feasible.

Material business and transaction records shall be protected against unauthorised alteration or deletion. Where appropriate, records shall maintain traceability, timestamps and audit information.

Systems handling material customer, transaction or security information should maintain appropriate logs and audit trails to support security, operational review, investigation and reconciliation.

• Use customer and Company information only for authorised purposes.
• Do not disclose confidential information without authority.
• Protect credentials and devices.
• Report suspected data leakage or privacy incidents immediately.
• Follow approved retention and disposal procedures.

Relevant personnel shall receive periodic training on data protection, privacy, secure handling, phishing, confidentiality, incident reporting and records management.

The Company may conduct access reviews, data-flow reviews, vendor assessments, security assessments, retention reviews and other assurance activities to evaluate compliance with this Policy.

Exceptions shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory and contractual requirements shall continue to apply.

Evidence of privacy notices, consent or preference records where applicable, access reviews, incidents, vendor assessments, retention decisions, disposal records and other relevant controls shall be retained according to applicable requirements.

This Policy shall be reviewed at least annually and whenever there is a material change in applicable privacy/data requirements, products, technology, data processing, vendors or business operations.