Incident Response & Security Breach Notification Policy

The Incident Response & Security Breach Notification Policy ("Policy") sets out the framework followed by ZynReach, owned and operated by Zyntra Digital ("ZynReach," "the Company," "we," or "us") for handling security incidents, suspected data breaches, and cyber incidents that may affect ZynReach's systems or the data processed through them.

This Policy aims to establish a structured framework for:

• Detecting and reporting security incidents.
• Assessing the nature, scope, and impact of an incident.
• Containing incidents and limiting their effects.
• Investigating the causes and potential impacts.
• Preserving relevant evidence.
• Safely restoring systems and services.
• Determining whether an incident constitutes a Security Breach or a Personal Data Breach under applicable law.
• Carrying out notifications required by law or contract.
• Communicating appropriately with affected customers and individuals.
• Taking corrective action to prevent recurrence of the incident.

This Policy applies to incidents that may affect the ZynReach website and platform and their related systems and services, and to incidents arising from a range of sources, as follows:

• The ZynReach website.
• The ZynReach platform.
• Technical infrastructure.
• Databases.
• Storage systems.
• Administrative accounts.
• User accounts.
• API interfaces.
• Third-party services.
• Sub-processors, as applicable.
• Email and communication systems.
• Backups.
• Internal systems related to service delivery.
• Cyberattacks.
• Unauthorized access.
• Data leakage.
• Data loss.
• Accidental data exposure.
• Malicious software.
• Phishing.
• Account compromise.
• Misuse of privileges.
• Human error.
• Software errors.
• System misconfiguration.
• Security vulnerabilities.
• Incidents at service providers.
• Any other event that may materially affect the confidentiality, integrity, or availability of information.

Security Incident: Any event or set of events that may affect the confidentiality, integrity, or availability of systems, information, or services.

Security Breach: A security incident that has resulted, or could potentially result, in unauthorized access to, disclosure of, alteration of, loss of, or destruction of information or systems.

Personal Data Breach: A security breach that results in the destruction, loss, alteration, disclosure of, or unauthorized access to personal data, to the extent this definition applies under applicable law.

Customer Data: Data that the customer enters, uploads, stores, or processes through ZynReach's services.

Incident Response Team: The individuals or teams designated by ZynReach to manage and respond to security incidents.

Containment: The actions taken to contain an incident and prevent it from spreading or to limit its impact.

Recovery: The procedures for restoring systems, data, and services to a safe operating state.

ZynReach follows the following principles:

Speed: The Company seeks to detect and respond to incidents as promptly as practically possible.

Accuracy: Final conclusions are not issued before sufficient information is available, where the nature of the incident allows.

Harm Minimization: Priority is given to containing the incident and reducing its impact.

Evidence Protection: ZynReach seeks to preserve the technical information and evidence necessary for investigation.

Confidentiality: Information related to incidents is restricted on a need-to-know basis.

Compliance: Incidents are managed in accordance with applicable legal, regulatory, and contractual obligations.

ZynReach follows an incident response lifecycle that may include:

Detection → Triage → Assessment → Containment → Investigation → Eradication → Recovery → Notification → Post-Incident Review

Certain stages may be bypassed or merged depending on the nature of the incident.

Incidents may be detected through:

The creation of an Alert or the detection of unusual activity does not necessarily mean that a Security Breach has actually occurred.

• Monitoring systems.
• Security Monitoring.
• Audit Logs.
• Alerts.
• Vulnerability Detection.
• Employee reports.
• Customer reports.
• User reports.
• Service providers.
• Sub-processors.
• Security researchers.
• Government or regulatory authorities.
• Other trusted sources.

ZynReach encourages employees, users, customers, and service providers to report suspicious security activity as promptly as practically possible.

Indicators may include:

• Unrecognized logins.
• Loss of credentials.
• Phishing messages.
• Unauthorized access.
• Accidental data exposure.
• Abnormal system behavior.
• Loss of a device containing sensitive information.
• Suspicious software activity.
• Unauthorized changes.
• Suspected security vulnerabilities.

Upon receiving a report or detecting an incident, ZynReach assesses, as applicable:

• The nature of the event.
• The systems affected.
• The data affected.
• Whether the data is personal data.
• Whether it is Customer Data.
• The extent of unauthorized access.
• The number of users or customers potentially affected.
• The likelihood of harm.
• Whether the incident is ongoing.
• The need for immediate containment.
• Potential legal or contractual obligations.

ZynReach may classify incidents according to their severity level.

Level 1 — Low: A limited incident that does not materially affect systems or data. Examples include:

Level 2 — Medium: An incident with a limited impact on a specific system, service, or set of accounts.

Level 3 — High: An incident that may affect important data or a service, or a number of customers.

Level 4 — Critical: A broad-scale or material incident that may affect:

The classification may be revised during the investigation as new information emerges.

• An unconfirmed security alert.
• A failed access attempt.
• Suspicious activity that was contained without known impact.
• Customer Data.
• Personal Data.
• The confidentiality or integrity of data.
• The availability of the service to a significant degree.
• A large number of customers.
• Core infrastructure.

ZynReach may form an incident response team appropriate to the nature of the incident, which may include:

The Company may engage external experts or consultants when needed.

• Security.
• Engineering.
• Infrastructure / DevOps.
• IT.
• Privacy.
• Legal.
• Management.
• Customer Success.
• Communications.

The response team may, to the extent necessary and authorized, take actions such as:

Containment measures may temporarily affect certain services where necessary to protect systems or data.

• Disabling an account.
• Terminating sessions.
• Changing credentials.
• Isolating a system.
• Restricting access.
• Blocking suspicious traffic.
• Temporarily suspending an affected service.
• Applying emergency security measures.
• Restoring a system.
• Requesting external support.

ZynReach seeks to contain incidents through measures appropriate to their nature.

These may include:

The measure selected depends on the risks and circumstances involved.

• Isolating systems.
• Disabling compromised accounts.
• Rotating access keys.
• Terminating sessions.
• Blocking malicious addresses or sources.
• Restricting privileges.
• Shutting down an affected component.
• Applying additional security rules.

Following initial containment, ZynReach may conduct an investigation to determine:

It may not be possible to determine all details of the incident immediately.

• How the incident began.
• When it began.
• The systems affected.
• The data potentially exposed.
• The scope of access.
• The duration of exposure.
• Whether the attacker still has access.
• The actions taken.
• The measures required to prevent recurrence.

Where appropriate, ZynReach seeks to preserve relevant evidence, such as:

Evidence is handled in a manner appropriate to the nature of the incident and applicable legal requirements.

• Logs.
• Audit Trails.
• System Events.
• Network Information.
• Authentication Records.
• System files.
• Indicators of compromise.
• Information related to affected accounts.

After understanding the root cause, ZynReach works, to the extent possible, to remove or address the source of the incident.

Actions may include:

• Fixing the vulnerability.
• Updating the system.
• Revoking inappropriate privileges.
• Changing keys or credentials.
• Removing malicious software.
• Modifying security settings.
• Updating monitoring rules.
• Improving technical controls.

After the incident is contained and its cause eradicated, ZynReach works to restore systems safely.

The recovery process may include:

• Verifying the integrity of systems.
• Confirming the threat is no longer active.
• Restoring data as needed.
• Testing services.
• Gradually reactivating systems.
• Increasing monitoring following recovery.

Not every Security Incident constitutes a Personal Data Breach.

ZynReach assesses whether an incident has resulted, or may result, in:

The legal classification is determined in accordance with the law and the actual circumstances of the incident.

• Unauthorized access to personal data.
• Unauthorized disclosure.
• Loss of data.
• Unauthorized alteration.
• Destruction of data.
• Impact on the rights or freedoms of individuals, where that is a criterion under applicable law.

Where ZynReach is contractually or legally obligated to notify a customer of a breach relating to Customer Data, the Company seeks to provide notice in accordance with the timeframe and mechanism set out in the DPA or the applicable agreement.

The notification may include, to the extent available:

• A general description of the incident.
• The date or period during which the incident occurred, if known.
• The date the incident was discovered.
• The systems affected.
• The categories of data affected.
• The nature of the known impact.
• The containment measures taken.
• The corrective actions taken.
• The proposed protective steps.
• A point of contact for inquiries.

Not all information related to an incident may be available at the time of its discovery.

ZynReach may therefore send an initial notice containing the information available at that time, followed by subsequent updates as additional material information becomes available, where required by law or contract or appropriate under the circumstances.

It is not necessary to wait for the investigation to be completed before sending a notification where early notification is legally or contractually required.

ZynReach ensures that notifications are:

A notification may not include detailed information that could:

• As accurate as possible.
• Clear.
• Based on the information available.
• Proportionate to the nature of the incident.
• Free of unconfirmed speculation.
• Compromise the security of systems.
• Disclose trade secrets.
• Assist the attacker.
• Disclose information relating to other customers.
• Impede the investigation.
• Be legally prohibited.

ZynReach complies with the deadlines imposed by applicable law or relevant agreements where such deadlines apply.

Where no specific deadline exists, the Company seeks to provide notice within a reasonable period, having regard to:

• The nature of the incident.
• The extent of the impact.
• The level of certainty available.
• The need for containment.
• Legal requirements.
• Contractual obligations.

Where ZynReach acts as a Processor on behalf of the customer, the customer may be the party legally responsible for notifying:

ZynReach does not notify data subjects or regulatory authorities on behalf of the customer except where:

• Data subjects.
• Regulatory authorities.
• Government authorities.
• It is legally required; or
• It is contractually authorized; or
• The customer requests it and the circumstances and applicable laws permit it.

Where ZynReach is the party legally responsible for reporting to a regulatory or government authority, the Company assesses the reporting requirements under applicable law.

The following are determined:

Based on the jurisdiction and the nature of the incident.

• The competent authority.
• The type of notification.
• The deadline.
• The information required.
• The submission mechanism.

Where ZynReach is legally obligated to notify data subjects directly, the following is assessed:

Individuals are not notified in cases where the law does not require it, unless ZynReach considers notification appropriate or necessary under particular circumstances.

• The level of risk.
• The nature of the data.
• The likelihood of harm.
• Legal requirements.
• Available means of communication.

Public statements regarding a security incident may only be issued through persons or bodies authorized to do so.

Coordination may take place with:

The disclosure of information that could expose ZynReach or its customers to further risk must be avoided.

• Management.
• The Legal Department.
• The Security Team.
• The Privacy Team.
• The Communications Team.

ZynReach treats security investigations as sensitive information.

Access may be restricted to:

On a need-to-know basis.

• Incident details.
• Evidence.
• The names of affected individuals.
• Customer information.
• System details.
• Preliminary investigation findings.

Where a security incident occurs at a Sub-processor that affects, or may affect, data processed on behalf of ZynReach or its customers, ZynReach works to:

The management of such cases is also subject to the Sub-processor Policy.

• Obtain the available information.
• Assess the impact.
• Identify the data affected.
• Assess the risks.
• Take appropriate containment measures.
• Carry out the notifications required under the DPA and applicable law.

Where a user account is compromised or suspected of being compromised, ZynReach may take actions such as:

• Suspending the account.
• Terminating active sessions.
• Resetting login credentials.
• Enforcing additional authentication.
• Requesting identity verification.
• Reviewing activity.
• Notifying the user when necessary.

The customer is responsible for:

ZynReach bears no responsibility for an incident resulting exclusively from the conduct of the customer or its users, to the extent permitted by law and the contract.

• Protecting its own login credentials.
• Managing its users.
• Using strong passwords.
• Using MFA where available.
• Not sharing login credentials.
• Reporting suspicious activity.
• Complying with the platform's security instructions.

Where an incident affecting Customer Data occurs, ZynReach provides, to a reasonable and available extent and in accordance with the DPA:

ZynReach is not obligated to provide confidential information, trade secrets, or sensitive security information that is not required to be provided under law or contract.

• Information about the incident.
• Appropriate technical cooperation.
• The information necessary for compliance.
• Assistance in understanding the nature of the incident.
• Material updates as they become available.

Each party bears the response costs falling within its responsibility under the law and the contract.

ZynReach does not bear the costs of special measures or additional investigations requested by the customer where these are not required under the contract or the law, unless otherwise agreed.

ZynReach may engage:

Where the Company considers it appropriate to the nature of the incident.

• Cybersecurity experts.
• Legal advisors.
• Forensic Specialists.
• Incident response service providers.
• Specialized technology firms.

ZynReach may cooperate with government authorities or law enforcement agencies where:

The information provided may be limited to the extent legally required.

• It is legally required.
• It is necessary for the investigation.
• It is appropriate to protect customers or users.
• The law permits it.

ZynReach may assess:

The existence of an Incident does not mean that actual harm has occurred to all individuals or customers potentially affected.

• The number of individuals affected.
• The types of data.
• The sensitivity of the data.
• The duration of exposure.
• The likelihood of misuse.
• The impact on the service.
• Legal risks.
• Operational risks.

Following the conclusion of an incident, ZynReach may implement actions such as:

• Fixing vulnerabilities.
• Updating systems.
• Adjusting privileges.
• Improving monitoring.
• Strengthening authentication.
• Improving backup procedures.
• Updating policies.
• Training employees.
• Improving vendor management.
• Improving response procedures.

Following significant incidents, ZynReach may conduct a post-incident review to determine:

• What happened?
• Why did it happen?
• What was discovered?
• How was the response carried out?
• What worked well?
• What needs improvement?
• What corrective actions are required?
• What lessons were learned?

ZynReach may maintain incident records that include, as applicable:

These records are subject to the applicable data retention policies.

• The date of the incident.
• The source of the report.
• The classification.
• The systems affected.
• The containment measures.
• The investigation findings.
• The notifications issued.
• The corrective actions.

ZynReach may test its incident response procedures through:

The results of these tests are used to improve response procedures where needed.

• Tabletop Exercises.
• Recovery tests.
• Security testing.
• Incident simulations.
• Business continuity testing.

This Policy complements ZynReach's Business Continuity and Disaster Recovery procedures.

While this Policy focuses on responding to security incidents, business continuity and disaster recovery plans may focus on:

• Restoring services.
• Restoring data.
• Minimizing downtime.
• Maintaining continuity of operations.

ZynReach does not guarantee:

The effectiveness of the response also depends on the nature of the threat, the systems affected, third-party information, and the cooperation available.

• The prevention of all security incidents.
• The detection of all incidents immediately upon occurrence.
• The immediate determination of all incident details.
• The prevention of all effects of incidents.
• The elimination of all cyber risks.

No notification, cooperation, or action taken by ZynReach in connection with a security incident constitutes:

Liability is determined in accordance with the facts, the contract, and applicable law.

• An admission of legal liability.
• An admission of negligence.
• A waiver of any legal defense.
• A waiver of any contractual right.
• An admission that all data was accessed or disclosed.

ZynReach may withhold or limit the disclosure of certain incident-related information where such disclosure could:

• Expose systems to further risk.
• Reveal unaddressed vulnerabilities.
• Assist in repeating the attack.
• Disclose trade secrets.
• Disclose information relating to other parties.
• Impede the investigation.
• Violate the law.

Not every security vulnerability constitutes a security incident or a data breach.

ZynReach assesses vulnerabilities according to their risk level, exploitability, and potential impact.

This may involve:

• Logging the vulnerability.
• Classifying it.
• Prioritizing it.
• Applying a fix.
• Monitoring it.
• Notifying affected parties where required.

ZynReach encourages security researchers to responsibly report vulnerabilities that may affect its services.

The Company may publish or operate a separate vulnerability reporting program, including specific requirements regarding testing scope, communication methods, and disclosure.

Employees and contractors must:

• Promptly report suspected incidents.
• Refrain from investigating in a manner that could destroy evidence.
• Refrain from sharing incident details with unauthorized parties.
• Follow the instructions of the response team.
• Protect customer data.
• Comply with security and privacy policies.

This Policy is reviewed periodically or upon the occurrence of:

• A material change in technical architecture.
• A material change in services.
• A significant security incident.
• A change in laws.
• A change in customer requirements.
• A change in the risk model.

ZynReach may amend this Policy from time to time to reflect:

The updated version is published through appropriate channels.

• Technical developments.
• Legal changes.
• Security improvements.
• Lessons learned from incidents.
• Operational changes.

In the event of a conflict between this Policy and any signed written agreement, the provisions of the agreement shall govern, unless mandatory law provides otherwise.

With respect to Customer Data, the Data Processing Agreement (DPA) is the primary reference regarding:

• The parties' responsibilities.
• Incident notification.
• Deadlines.
• Cooperation.
• Data processing.
• Breach-related obligations.

To report a security incident or suspected data breach to ZynReach, the official security or legal contact channels designated by the Company on its website or in the agreement concluded with the customer must be used.

To the extent possible, the report should include:

Passwords, API keys, or confidential credentials should not be sent in the report message.

• The name of the entity or customer.
• Contact details.
• The nature of the incident.
• The approximate date and time.
• The account or service affected.
• The data believed to be affected.
• Any available evidence or information.

The table below sets out this document's record details:

• Document Name — Incident Response & Security Breach Notification Policy
• Company — Zyntra Digital
• Platform — ZynReach
• Website — zynreach.com
• Version — 1.0
• Effective Date — August 31, 2026
• Classification — Public / Legal / Security / Compliance
• Owner — Security / Legal / Privacy
• Review — Periodically or upon a material change
• Related Documents — DPA / Privacy Policy / Security & Trust Policy / Sub-processor Policy / Data Retention & Deletion Policy / Business Continuity & Disaster Recovery

This document represents the general framework used by ZynReach to manage, respond to, and provide notification of security incidents.

This Policy does not, in itself, constitute a guarantee that ZynReach will detect, prevent, or contain all security incidents, nor does it constitute an admission that any particular incident constitutes a legal data breach.

Notification obligations vary depending on:

Accordingly, the final obligation to notify, along with its content and timing, is determined in accordance with the law, the agreement, and the facts available in the relevant case.

• The jurisdiction.
• The nature of the data.
• ZynReach's role as Controller or Processor.
• The type of incident.
• The nature of the risks.
• The agreement concluded with the customer.
• Legal and regulatory requirements.