RANAPAY INDIA PRIVATE LIMITED

This Policy establishes the framework for responsible collection, use, access, sharing, protection, retention and disposal of personal, customer, transaction and business information handled by RanaPay.

• Protect personal and confidential information.
• Use information only for legitimate and defined purposes.
• Apply appropriate security controls.
• Limit access to authorised personnel.
• Manage data retention and secure disposal.
• Support customer privacy and applicable legal requirements.
• Manage data incidents and third-party processing risks.

This Policy applies to personal information, customer information, transaction data, gift-card/voucher information, employee information, business records and other data processed by RanaPay through websites, applications, APIs, systems, partners, vendors and internal processes.

• Purpose limitation
• Data minimisation
• Accuracy
• Transparency
• Security and confidentiality
• Need-to-know access
• Retention limitation
• Accountability

• Customer identity/contact information
• Transaction and order information
• Gift-card/voucher information
• Payment-related references
• Support and grievance records
• Fraud/risk information
• Employee and contractor information
• Business and technical information

Sensitive or restricted information shall receive enhanced controls appropriate to its risk.

Personal information shall be collected and processed for legitimate business, contractual, legal, security, fraud-prevention, customer-support or other documented purposes, subject to applicable requirements.

Only information reasonably necessary for the stated purpose should be collected. Customer-facing notices and forms should communicate relevant collection and use information where required.

Reasonable measures shall be taken to keep information accurate and up to date for the purposes for which it is used.

RanaPay shall provide appropriate privacy information through its website, applications or other customer-facing channels and shall handle privacy requests according to applicable law and operational procedures.

Access shall be based on role, business need and least privilege. Sensitive information shall not be accessed merely for convenience.

Information may be shared with authorised PPI issuers, banks, payment processors, merchants, technology providers, service providers, professional advisers, regulators or authorities where necessary for legitimate purposes and permitted by applicable law and contractual arrangements.

Third parties handling personal or confidential information shall be subject to appropriate due diligence, contractual controls, confidentiality obligations, security requirements and monitoring under the Third-Party / Vendor Risk Management Policy.

Where information is transferred to or accessed from another jurisdiction, RanaPay shall apply the safeguards and legal requirements applicable to such transfer.

Data shall be protected through appropriate administrative, technical and physical controls consistent with the Information Security & Cyber Security Policy.

Sensitive information shall be protected during transmission using appropriate secure mechanisms. Encryption at rest shall be applied where appropriate based on risk and system capability.

Records shall be retained only for as long as necessary to fulfil the applicable business, legal, regulatory, contractual, accounting, fraud-prevention or dispute-management purpose, subject to any mandatory retention period.

When information is no longer required and no legal or operational hold applies, it shall be securely deleted, anonymised, destroyed or otherwise disposed of using methods appropriate to the medium and sensitivity.

Deletion shall be suspended where records are subject to a legal, regulatory, audit, dispute, investigation or other authorised hold.

Where applicable, customer requests relating to access, correction, deletion, consent or other privacy rights shall be received, verified, assessed and handled according to applicable law and RanaPay's documented procedures.

Reasonable verification shall be completed before disclosing, modifying or deleting sensitive customer information to reduce the risk of social engineering or unauthorised access.

Suspected loss, unauthorised access, disclosure or compromise of personal or confidential information shall be escalated under the Cyber Incident Response & Cyber Fraud Policy and applicable legal/contractual procedures.

Systems and processes should avoid collecting or retaining unnecessary information. Where possible, data fields and access should be limited to the minimum required.

Sensitive information should be masked or redacted in reports, screenshots, support communications and test environments where full values are not required.

Production customer or sensitive data should not be used in development or testing unless specifically authorised and appropriately protected.

• Use data only for authorised purposes
• Protect credentials and devices
• Do not disclose confidential data without authority
• Report suspected data incidents
• Follow retention and disposal procedures
• Complete required privacy/security training

Personnel handling customer or confidential information shall receive appropriate privacy, data-handling and information-security awareness.

Where appropriate to the scale and nature of processing, RanaPay shall maintain an inventory or documented description of major data categories, purposes, systems, recipients, retention requirements and responsible owners.

Compliance with this Policy may be assessed through access reviews, vendor reviews, data-retention checks, security assessments, internal audits or other assurance activities.

Actual or suspected non-compliance shall be investigated and may result in corrective action, access restriction, disciplinary measures or contractual action, subject to applicable requirements.

Exceptions shall be documented, risk-assessed, time-bound where appropriate and approved by an authorised person. Mandatory legal or regulatory requirements shall not be overridden.

This Policy shall be reviewed at least annually and whenever there is a material change in applicable privacy requirements, products, systems, partners or data-processing activities.