FIDDLEFITT LIFE PRIVATE LIMITED

(carrying on business as “FiddleFitt Life”)

1. PURPOSE AND SCOPE

   1. This Data Breach Response Plan (the “Plan”) establishes how Fiddlefitt Life Private Limited (the “Company”) detects, contains, assesses, reports and remediates breaches of personal data and other information security incidents. It gives effect to the Company’s obligations under the Information Technology Act, 2000 and the directions issued by the Indian Computer Emergency Response Team (“CERT-In”) under Section 70B (6) of that Act, and to the intimation obligations under the Digital Personal Data Protection Act, 2023 and Rule 7 of the Digital Personal Data Protection Rules, 2025 (together, the “DPDP Law”) as those provisions come into force.

   2. This Plan applies to every director, employee, intern and independent contractor of the Company and to every vendor acting on its behalf (each, a “Covered Person”), and forms part of the Company’s Information Security Policy.

   3. Definitions: In this Plan, “Personal Data Breach” means any unauthorised processing of personal data, or accidental disclosure, acquisition, sharing, use, alteration, destruction or loss of access to personal data, that compromises its confidentiality, integrity or availability; “Health Information” has the meaning given in the Privacy Policy; “Incident” means a Personal Data Breach or any other event that compromises or threatens the security of the Company’s information or systems, including malware, unauthorised access, phishing, loss or theft of a device, and misdirected communication; and “Response Team” has the meaning given in Section 3.1.

2. DETECTION AND REPORTING WITHIN THE COMPANY

   1. Every Covered Person shall report an actual or suspected Incident to the Information Security Officer immediately, and in any event within one hour of becoming aware of it, by telephone followed by a written message or email. A vendor that notifies the Company of an Incident shall be treated as a report under this Section.

   2. The report shall state, so far as then known, what occurred, when it was discovered, the systems, accounts and records involved, the individuals whose data may be affected, and any step already taken. A Covered Person shall not delay a report in order to complete these particulars, and shall not attempt to investigate or remediate the Incident independently except to the extent of the immediate containment steps in Section 4.1.

   3. No Covered Person shall be subjected to any detriment for reporting an Incident in good faith, including an Incident arising from that person’s own error. Concealment or delayed reporting of an Incident is a disciplinary matter.

3. RESPONSE TEAM

   1. The Response Team comprises the Information Security Officer, who leads it, one director nominated by the Board, the Grievance Officer, and such technical or professional advisers, including external counsel and forensic support, as the Information Security Officer considers necessary. The Response Team is convened as soon as an Incident is reported.

   2. The Information Security Officer directs the investigation and containment, maintains the incident record, and prepares the intimations required under Section 6. The nominated director approves external communication and the engagement of advisers. The Grievance Officer handles communication with affected individuals and their subsequent requests.

4. CONTAINMENT

   1. Immediate Steps: On becoming aware of an Incident, the following steps are to be taken without waiting for the Response Team to convene, so far as they are within the knowledge and capacity of the person concerned: suspending or resetting the credentials of a compromised account; revoking the sharing of a file that has been disclosed in error; disconnecting a compromised device from the network while keeping it powered on; requesting the recall or deletion of a misdirected communication; and preserving all evidence, including messages, logs and devices, without deleting or overwriting anything.

   2. The Information Security Officer shall then secure the affected systems, restrict further access, and, where recovery is necessary, restore from backup only after the cause of the Incident has been identified and addressed.

5. ASSESSMENT AND CLASSIFICATION

   1. The Response Team shall establish the cause and extent of the Incident, the categories and volume of personal data affected, the individuals affected, whether the data was encrypted or otherwise unintelligible, whether it remains within the control of an identified person, and the likely consequences for the individuals affected.

   2. Severity: An Incident is classified as High where it involves Health Information, the records of minors, payment-related data, or the data of a substantial number of individuals, or where the data is likely to have passed to an unidentified or malicious person; as Medium where personal data other than Health Information is involved and the exposure is limited and traceable; and as Low where no personal data has been compromised. Classification does not determine whether an intimation is required under Section 6, which is governed by law.

6. INTIMATION TO AUTHORITIES AND AFFECTED INDIVIDUALS

   1. CERT-In: Where the Incident falls within a category of cyber security incident specified in the CERT-In directions issued under Section 70B(6) of the Information Technology Act, 2000, including unauthorised access to systems or data, data breach, data leak, targeted scanning, malicious code and compromise of business email, the Information Security Officer shall report it to CERT-In within six hours of becoming aware of it, in the format and by the means specified in those directions, and shall provide such further information as CERT-In may require. The six-hour period runs from awareness of the Incident and not from completion of the investigation.

   2. Data Protection Board: On and from the commencement of the corresponding provisions of the DPDP Law, the Company shall intimate the Data Protection Board of India of a Personal Data Breach without delay upon becoming aware of it, with a description of the breach in the terms then prescribed, and shall furnish the detailed intimation, including the circumstances and cause, the mitigation measures implemented, the findings as to the person who caused it, the remedial measures taken to prevent recurrence and a report of the intimations given to affected individuals, within seventy-two hours of becoming aware of the breach or within such longer period as the Board may allow on request.

   3. Affected Individuals: The Company shall intimate each affected individual, without delay and through the individual’s registered email address, WhatsApp number or telephone, of the nature, extent and timing of the breach, the likely consequences for that individual, the measures the Company has implemented to mitigate risk, the precautions the individual may take, and the contact details of the Grievance Officer. Where the affected individual is a minor client, the intimation is given to the Parent.

   4. Others: The Response Team shall also consider whether the Incident requires intimation to the Company’s bankers or payment service providers, to a Corporate Client whose participants are affected, to the Company’s insurers, or to the police, and shall record the decision taken in each case and the reasons for it.

   5. Communication Discipline: No Covered Person other than the nominated director, or a person authorised by that director, shall make any statement concerning an Incident to the media, to clients generally or on social media. Communications to affected individuals shall be issued only in the form approved by the Response Team.

7. REMEDIATION AND REVIEW

   1. The Response Team shall implement measures to prevent recurrence, which may include revision of access permissions, changes to systems or vendors, additional technical controls, revision of the Information Security Policy, and further training of Covered Persons.

   2. Within thirty days of the closure of a High or Medium severity Incident, the Information Security Officer shall place before the Board a review recording the cause of the Incident, the response, the intimations given, the remedial measures implemented and the time taken at each stage.

8. INCIDENT RECORD

   1. The Information Security Officer shall maintain a register of all Incidents, whether or not they required intimation under Section 6, recording the date and time of occurrence and of awareness, the reporting person, a description of the Incident and of the data affected, the severity classification, the containment and remedial steps taken, the intimations given with their dates and times, and the date of closure. The register and the underlying evidence shall be retained for not less than three years and shall be produced to a regulator or court on lawful demand.

9. TESTING AND MAINTENANCE OF THE PLAN

   1. The Information Security Officer shall conduct a desktop exercise at least once each year in which the Response Team works through a simulated Incident, and shall record the outcome and any deficiencies revealed. This Plan shall be reviewed by the Board at least once each financial year, upon a material change in the Company’s systems or vendors, upon any change in the applicable law, and following any High severity Incident.

   2. The Information Security Officer shall maintain a current list of the contact details of the Response Team, the Company’s vendors and advisers, and the reporting channels of CERT-In, and shall keep a copy accessible outside the Company’s primary systems so that it remains available if those systems are compromised.