Skip to content

How Aarvin Ventures processes client data: a GDPR Data Processing Agreement with EU Standard Contractual Clauses on request, DPDP Act terms, and an NDA first.

Effective 8 November 2026

When we build or run something for you, we may handle personal data that belongs to you and your customers. Here is how we treat it — and what we sign so you can rely on it.

Roles

For client work you decide why and how personal data is used; we act only on your documented instructions. Under the GDPR you are the controller and we are your processor. Under India’s DPDP Act, 2023, you are the Data Fiduciary and we are your Data Processor.

An NDA before the brief

We sign a non-disclosure agreement — yours or ours — before you share any confidential material.

What our Data Processing Agreement covers

On request, we sign a Data Processing Agreement (DPA) before work with personal data begins. It sets out:

  • the subject, duration, purpose and types of personal data and data subjects;
  • processing only on your documented instructions;
  • confidentiality obligations for everyone with access;
  • the security measures we apply (below);
  • the sub-processors we use, and advance notice before we add or change one;
  • help with data-subject requests, impact assessments and consultations;
  • notification of a personal-data breach without undue delay;
  • return or deletion of personal data when the engagement ends;
  • the information you need to demonstrate compliance, including audits.

International transfers

Where personal data from the European Economic Area is processed in India, our DPA incorporates the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914). For data that must stay in the EU, we deploy to EU hosting regions and work inside your own accounts.

Security measures

  • Least-privilege access, limited to the people working on your project and removed when they finish.
  • Multi-factor authentication on every account that touches your systems.
  • Credentials kept in your password manager and cloud accounts — never in email or chat.
  • Encryption in transit everywhere, and at rest wherever the platform supports it.
  • Test and demo environments filled with invented data, not your customers’ records.
  • Code review and automated tests on every change.

Sub-processors

We prefer to work inside infrastructure you own, so most projects add no sub-processors of ours. Any we do use — for example, hosting or email providers — are listed in the project DPA.

Requesting a DPA or NDA

Email sannagiri@aarvinventures.com with your company details, or mention it in your project brief. We return a signed copy before any work with personal data begins.