THIRD-PARTY / VENDOR RISK MANAGEMENT POLICY

This Policy establishes a risk-based framework for identifying, assessing, approving, onboarding, monitoring and exiting third-party vendors and partners that support JSR ALL-IN-ONE SOLUTIONS PRIVATE LIMITED, including payment, PPI, banking, merchant, technology, cloud, security, customer-support and other service providers.

• Identify third-party risks before engagement.
• Apply enhanced due diligence to critical or high-risk vendors.
• Protect customer, transaction, voucher and confidential information.
• Ensure appropriate contractual, security, continuity and compliance controls.
• Monitor vendor performance and risk throughout the relationship.
• Provide documented escalation and exit arrangements.

This Policy applies to material vendors, service providers, consultants, contractors, technology providers, payment processors, PPI/bank partners, merchants, cloud providers, outsourced service providers and other third parties that may affect Company operations, customers, data, systems or transactions.

Each material vendor shall have an accountable business owner. Risk, Compliance, Information Security, Legal, Finance and Operations shall participate where relevant to the nature and risk of the engagement.

• Critical / High Risk – failure or compromise could materially affect customers, transactions, security, regulatory obligations or critical operations.
• Medium Risk – meaningful operational, financial, data or service impact but with manageable alternatives.
• Low Risk – limited access and limited impact to critical operations or sensitive information.

• Corporate identity and ownership information
• Business reputation and relevant experience
• Financial and operational capability
• Information-security controls
• Data protection and privacy practices
• Business continuity and disaster recovery
• Regulatory or contractual compliance capability
• Relevant licences, registrations or authorisations where applicable
• Subcontracting arrangements
• Incident history and material litigation/regulatory concerns where relevant

Critical or high-risk vendors may require enhanced assessment, including security assurance, independent certifications or reports where available, financial review, continuity testing, data-flow assessment, management references, penetration-testing information or other evidence proportionate to risk.

No material vendor shall be onboarded without approval through the Company's designated procurement, risk, compliance, legal and management process appropriate to the vendor's risk classification.

• Scope of services and service levels
• Confidentiality obligations
• Data protection and permitted use
• Information-security requirements
• Incident notification and cooperation
• Business continuity and disaster recovery
• Audit / assurance rights where appropriate
• Subcontracting controls
• Data return / deletion on termination
• Termination and exit assistance
• Compliance with applicable legal and contractual requirements

Vendor access to Company or customer information shall be limited to the minimum required. Appropriate authentication, access control, encryption, logging and security requirements shall be established according to risk.

Partners involved in payment processing, PPI, banking, gift-card issuance, merchant redemption or settlement shall be subject to appropriate due diligence and contractual arrangements within the Company's operational role.

• Service availability and performance
• Security events and incidents
• Customer complaints
• Transaction or reconciliation issues
• Service-level breaches
• Compliance issues
• Financial or operational deterioration
• Material changes in ownership or service model

Critical vendors should have documented service-level expectations and escalation procedures. Material service-level failures shall be recorded, investigated and remediated.

Vendors shall promptly notify the Company of material security incidents affecting Company systems, customer information, transactions or services, subject to applicable contractual and legal requirements.

Critical vendors should maintain appropriate continuity and recovery arrangements. The Company shall assess material dependency and concentration risks and identify alternatives or contingency measures where reasonably practicable.

Material subcontracting that could affect Company data, systems, customers or critical services shall be subject to appropriate disclosure, approval or contractual controls based on risk.

Vendor access to systems and data shall be periodically reviewed. Unnecessary, expired or unauthorised access shall be revoked promptly.

Material vendors may be reviewed for compliance with agreed contractual requirements, security controls, privacy obligations, service levels and applicable legal requirements.

Material security incidents, repeated service failures, significant financial deterioration, compliance concerns, data breaches or other serious vendor risks shall be escalated to Management and relevant control functions.

The Company may request appropriate assurance documentation, assessments, audit reports, certifications or other evidence from material vendors, subject to contractual arrangements and proportionality.

Material vendors should be recorded in a vendor risk register containing ownership, service description, risk classification, criticality, contract status, review date, key controls and open issues.

Vendor risk shall be reviewed periodically based on criticality and risk. High-risk vendors should receive more frequent review than low-risk vendors.

• Define termination triggers and notice requirements.
• Recover or securely delete Company and customer information.
• Revoke vendor access and credentials.
• Complete outstanding reconciliation and financial matters.
• Transition critical services where required.
• Preserve required records.

Management shall consider reliance on a single vendor, payment partner, cloud provider, merchant or other critical service provider. Material concentration risks should have mitigation or contingency measures where practicable.

Any exception to this Policy shall be documented, risk-assessed and approved by authorised management. Mandatory legal, regulatory and contractual requirements shall not be waived through an internal exception.

Due-diligence records, contracts, approvals, risk assessments, reviews, incidents, performance records, audit evidence and exit documentation shall be retained according to the Company's record-retention requirements.

This Policy shall be reviewed at least annually and whenever there is a material change in vendor relationships, products, technology, regulatory requirements, security risks or business operations.