RANAPAY INDIA PRIVATE LIMITED

This Policy establishes operational controls for the end-to-end lifecycle of gift cards and vouchers handled by RanaPay through applicable authorised partners, from product configuration and issuance through activation, delivery, redemption, expiry, cancellation, blocking, reconciliation and closure.

• Maintain accurate product and voucher records.
• Protect customers from unauthorised or fraudulent use.
• Ensure controlled issuance and activation.
• Support accurate redemption and balance processing.
• Manage expiry, cancellation and reissue consistently.
• Maintain reconciliation and audit trails.
• Coordinate operational issues with authorised partners.

This Policy applies to gift cards, gift vouchers, virtual voucher products, related orders, codes, balances, redemption events, refunds/cancellations, partner settlement records and supporting systems/processes operated by or for RanaPay.

• Product onboarding/configuration
• Order creation
• Issuance
• Activation
• Delivery
• Customer possession/use
• Redemption
• Balance/status update
• Expiry or closure
• Cancellation/refund where applicable
• Reconciliation and record retention

A gift-card/voucher product shall be onboarded only after appropriate commercial, operational, compliance, technical and partner approvals. Product terms, denomination, validity, redemption rules and responsible partner shall be documented.

• Product name and identifier
• Denominations
• Currency
• Validity/expiry terms
• Issuer/authorised partner
• Redemption channels
• Applicable restrictions
• Customer-facing terms
• Settlement/reconciliation identifiers

1. Validate order and customer inputs.
2. Confirm product availability.
3. Generate or obtain authorised voucher credentials.
4. Record issuance reference.
5. Apply appropriate fraud/risk controls.
6. Update status and deliver through approved channel.

Voucher codes, serial numbers, tokens or equivalent identifiers shall be unique and protected against unauthorised disclosure, duplication or predictable generation.

Where activation is required, activation shall occur only through an approved process and shall be recorded with relevant timestamp, reference and status.

Voucher credentials shall be delivered only through approved customer or partner channels. Sensitive codes should not be unnecessarily exposed in logs, support tickets or internal communications.

Redemption shall be processed through the authorised issuer/merchant/partner mechanism and shall be subject to product-specific terms, balance, validity and applicable restrictions.

• Validate voucher/product status
• Validate balance or denomination
• Validate redemption eligibility
• Confirm transaction reference
• Record successful or failed redemption
• Update applicable status/balance

Where the product supports partial redemption, the remaining balance shall be accurately maintained by the authorised system or partner. Balance discrepancies shall be investigated and reconciled.

Expiry shall follow the applicable product and partner terms. Expired vouchers shall not be reactivated except where specifically authorised under applicable terms and controls.

A voucher may be blocked or suspended where fraud, compromise, duplicate use, technical error, customer protection requirement or other authorised reason is identified, subject to applicable terms and partner procedures.

Customers shall be informed of the applicable responsibility and recovery process. Replacement or reissue, where offered, shall require appropriate verification and partner confirmation.

Refunds or cancellations shall be processed according to the applicable product terms, partner agreement and Refund, Cancellation & Chargeback Policy.

Reissue or replacement shall be controlled, documented and linked to the original voucher/order reference to prevent duplicate value or double redemption.

• Velocity monitoring
• Repeated redemption detection
• Unusual purchase patterns
• Duplicate or reused code detection
• Compromised credential handling
• High-risk customer/order review
• Partner escalation

Relevant voucher issuance, activation, redemption, refund and cancellation events shall be monitored according to applicable fraud-risk and transaction-monitoring procedures.

Customer support shall verify appropriate details before disclosing voucher information, changing status, initiating replacement or discussing sensitive transaction information.

Operational issues involving an issuer, bank, merchant, payment processor, technology provider or other authorised partner shall be escalated through defined partner contacts.

Issued, redeemed, cancelled, refunded and outstanding voucher values shall be reconciled with relevant partner statements or system records at appropriate intervals.

• Unmatched redemption
• Duplicate transaction
• Incorrect denomination
• Incorrect status
• Failed activation
• Settlement mismatch
• Customer dispute
• Technical processing error

Exceptions shall be logged, investigated, resolved or escalated with supporting evidence.

Access to voucher-management systems shall follow the Access Control & API Security Policy. Privileged functions such as issuance, status changes, refunds or administrative adjustments shall be restricted and logged.

Partner APIs shall use approved authentication, authorisation, logging, error handling and secure communication mechanisms. API failures affecting customer value shall be reconciled before closure.

Customer and voucher information shall be handled according to the Data Protection, Privacy & Retention Policy.

Suspected voucher fraud, code compromise, systemic redemption errors or material service disruption shall be escalated under the Cyber Incident Response & Cyber Fraud Policy and relevant operational procedures.

Critical voucher operations shall have appropriate continuity and recovery arrangements consistent with the Business Continuity & Disaster Recovery Policy.

• Product configuration
• Orders
• Issuance records
• Activation records
• Delivery records
• Redemption records
• Refund/cancellation records
• Block/reissue records
• Partner statements
• Reconciliation records
• Customer dispute records
• Exception and incident records

Material lifecycle events shall maintain sufficient records to establish what happened, when it happened, the relevant reference and the responsible system/user or partner, where practicable.

Relevant operations, support, fraud, technology and partner-management personnel shall receive appropriate training on voucher lifecycle controls and customer protection.

Management shall periodically review operational metrics, fraud trends, reconciliation exceptions, complaints, partner performance and control weaknesses.

Operational breaches or control failures shall be investigated and corrective action shall be taken according to severity and applicable internal procedures.

Exceptions shall be documented, risk-assessed and approved by authorised personnel. Applicable legal, regulatory, contractual and product terms shall not be bypassed.

This Policy shall be reviewed at least annually and whenever there is a material change in product structure, partner arrangements, technology, redemption process or applicable requirements.