Book a Call
Book a Call

Data Processing Addendum

This Data Processing Addendum (“DPA”) forms part of the contractual relationship between Vistara Ventures (“VV”, “Data Controller”) and any third party (e.g., investor, service provider, contractor, or partner) that processes personal data on behalf of VV (“Data Processor”) as part of providing services or engaging with VV.

1. Purpose and Scope

This DPA governs the processing of personal data subject to global privacy laws including but not limited to:

  • General Data Protection Regulation (EU/UK GDPR)
  • California Consumer Privacy Act (CCPA)
  • Australian Privacy Act
  • Applicable privacy legislation in Sri Lanka and other Asian jurisdictions
2. Definitions
  • “Personal Data”: Any information relating to an identified or identifiable individual.
  • “Processing”: Any operation performed on Personal Data (e.g., collection, storage, use, disclosure).
  • “Controller”: Vistara Ventures
  • “Processor”: The party processing data on VV’s behalf
3. Processor Obligations

The Processor agrees to:

  • Process Personal Data only on documented instructions from VV
  • Maintain the confidentiality of all Personal Data
  • Implement appropriate technical and organizational measures to ensure data security
  • Promptly notify VV of any data breach, suspected breach, or legal access request
  • Assist VV in fulfilling data subject rights requests (e.g., access, deletion)
4. Subprocessors

Processor may engage subprocessors only with VV’s prior written approval. All subprocessors must be bound by terms at least as protective as those in this DPA.

5. International Transfers

Where Personal Data is transferred outside of jurisdictions with adequate data protection laws, Processor agrees to implement Standard Contractual Clauses (SCCs) or other safeguards approved by the relevant authority.

6. Audit Rights

VV may audit Processor’s compliance with this DPA, subject to reasonable notice and confidentiality restrictions.

7. Return or Deletion of Data

Upon termination of the services or upon request, Processor shall securely return or delete all Personal Data, unless otherwise required by law.

8. Liability and Indemnity

Processor shall indemnify and hold VV harmless from any claims, damages, or fines resulting from Processor’s breach of this DPA or applicable data protection laws.

9. Governing Law and Jurisdiction

This DPA is governed by the same jurisdiction as the primary contract between the parties or, if absent, by the laws of [Insert governing jurisdiction—typically the Controller’s location].

10. Contact

For data protection matters, please contact:

Vistara Ventures – Data Protection Officer
 Email:hello@vistaraventures.com

Linkedin – https://www.linkedin.com/company/vistara-ventures/
Facebook – https://web.facebook.com/profile.php?id=61573868805841