Data Retention, Archival and Data Deletion Policy

1. INTRODUCTION

This Data Retention, Archival and Data Deletion Policy ("Policy") has been formulated and adopted by PROSPER PROFESSIONAL DEVELOPMENT LIFE PRIVATE LIMITED ("PROSPER", "Company", "We", "Us", or "Our"), a technology-enabled B2B financial services and fintech company incorporated under the Companies Act, 2013, providing digital payment services, financial inclusion services, business correspondent services, payment processing solutions, and various value-added financial services through its network of agents, distributors, merchants, and regulated financial partners.

PROSPER recognizes the importance of maintaining, protecting, archiving, and securely disposing of customer information, financial records, business records, transaction data, and regulatory information in accordance with applicable laws and regulatory requirements.

This Policy establishes the principles, procedures, controls, responsibilities, retention periods, archival mechanisms, and secure destruction procedures applicable to all information assets maintained by PROSPER.

The objective of this Policy is to ensure that information is retained only for as long as required for legitimate business, operational, legal, regulatory, contractual, audit, security, and compliance purposes, and that such information is securely archived and destroyed when no longer required.

2. OBJECTIVES OF THE POLICY

The objectives of this Policy are:

• To establish a standardized framework for data retention and disposal;
• To ensure compliance with regulatory requirements;
• To protect customer information and privacy;
• To maintain audit trails and business records;
• To support legal and regulatory investigations;
• To reduce operational and compliance risks;
• To implement secure archival procedures;
• To ensure secure deletion and destruction of data;
• To support business continuity and disaster recovery requirements.

3. REGULATORY FRAMEWORK

This Policy has been formulated in accordance with:

• Digital Personal Data Protection Act, 2023 (DPDP Act);
• Information Technology Act, 2000;
• Prevention of Money Laundering Act, 2002 (PMLA);
• Prevention of Money Laundering Rules, 2005;
• Payment and Settlement Systems Act, 2007;
• Companies Act, 2013;
• Reserve Bank of India (RBI) Master Directions on KYC;
• RBI Payment Aggregator Guidelines;
• RBI Cyber Security Framework;
• NPCI Guidelines;
• FIU-IND Reporting Requirements;
• Aadhaar Act, 2016;
• UIDAI Regulations;
• Income Tax Act, 1961;
• CERT-In Directions;
• Other applicable laws and regulations.

4. SCOPE OF THE POLICY

This Policy applies to all information collected, processed, stored, transmitted, archived, or maintained by PROSPER, including:

• Customer data;
• Agent and distributor data;
• Merchant data;
• Employee records;
• Financial records;
• Transaction records;
• KYC records;
• AML/CFT records;
• Audit records;
• Security logs;
• Complaint records;
• Communication records;
• Technical logs;
• Digital evidence;
• Legal records;
• Business records;
• Backup and archival records.

This Policy applies to:

• Physical records;
• Electronic records;
• Cloud-based records;
• Databases;
• Emails;
• Audio/video recordings;
• System logs;
• Documents and files.

5. DEFINITIONS

6. DATA RETENTION PRINCIPLES

PROSPER shall adhere to the following principles:

7. CUSTOMER KYC RECORD RETENTION

Customer KYC records shall be retained in accordance with RBI and PMLA requirements.

KYC information shall remain accessible for regulatory inspection.

8. TRANSACTION RECORD RETENTION

All financial transaction records shall be maintained as follows:

Transaction records shall include:

• Transaction IDs;
• UTR numbers;
• Amounts;
• Timestamps;
• IP addresses;
• Device information;
• Audit trails.

9. AML/CFT RECORD RETENTION

In accordance with PMLA requirements:

10. AGENT, DISTRIBUTOR AND MERCHANT RECORDS

The following records shall be maintained:

11. CUSTOMER SUPPORT AND COMPLAINT RECORDS

The following records shall be retained:

12. INFORMATION SECURITY RECORDS

Security-related information shall be retained as follows:

13. EMPLOYEE RECORD RETENTION

Employee-related records shall be retained as follows:

14. LEGAL AND LITIGATION RECORDS

Legal records shall be retained as follows:

15. FINANCIAL AND ACCOUNTING RECORDS

In accordance with Companies Act and tax laws:

16. DATA ARCHIVAL POLICY

Data may be archived when:

• Business usage declines;
• Regulatory retention remains applicable;
• Litigation is ongoing;
• Historical preservation is necessary.

Archived information shall:

• Be encrypted;
• Be access-controlled;
• Be regularly backed up;
• Maintain audit trails.

17. DATA DELETION AND DESTRUCTION

Upon expiry of retention periods, data shall be:

Deletion shall ensure that information cannot be reconstructed.

18. CUSTOMER DATA DELETION REQUESTS

Customers may request deletion of personal information by contacting PROSPER.

However, deletion requests may be denied where retention is required due to:

• Regulatory obligations;
• AML investigations;
• Court proceedings;
• Audit requirements;
• Law enforcement investigations.

19. LEGAL HOLD

Where litigation, investigations, audits, or regulatory proceedings are anticipated or ongoing:

• Data deletion shall be suspended;
• Relevant records shall be preserved;
• Legal hold procedures shall apply.

Legal holds shall remain effective until formally released.

20. BACKUP RETENTION

Backup records shall be retained as follows:

Backup data shall be encrypted and protected.

21. DATA SECURITY CONTROLS

Retained data shall be protected through:

• AES-256 encryption;
• TLS 1.2+ encryption;
• Multi-factor authentication;
• Role-based access controls;
• Audit trails;
• Security monitoring;
• Backup and disaster recovery controls.

22. RESPONSIBILITIES

The following stakeholders shall ensure compliance:

• Board of Directors;
• Compliance Officer;
• Data Protection Officer;
• Information Security Officer;
• Legal Department;
• Internal Audit Team;
• Technology Team;
• Operations Team.

23. AUDIT AND REVIEW

The Company shall conduct:

• Annual policy reviews;
• Internal audits;
• Regulatory compliance audits;
• Data retention assessments;
• Security reviews.

24. NON-COMPLIANCE

Failure to comply with this Policy may result in:

• Disciplinary action;
• Suspension;
• Termination;
• Regulatory reporting;
• Legal action.

25. GRIEVANCE AND DATA REQUESTS

26. GOVERNING LAW AND JURISDICTION

This Policy shall be governed by the laws of India.

All disputes arising under this Policy shall be subject to the exclusive jurisdiction of the courts situated at Lucknow, Uttar Pradesh.

27. EFFECTIVE DATE

This Policy shall come into force on 01 July 2026 and remain valid until amended, replaced, or withdrawn by PROSPER PROFESSIONAL DEVELOPMENT LIFE PRIVATE LIMITED.

28. DECLARATION

This Data Retention, Archival and Data Deletion Policy has been approved by the management of PROSPER PROFESSIONAL DEVELOPMENT LIFE PRIVATE LIMITED and shall be binding upon all employees, agents, distributors, merchants, contractors, service providers, and business partners.