Data Processing Addendum
This Data Processing Addendum ("DPA") forms part of the agreement between Ventureship and the customer ("Customer") for the use of Data AI (the "Agreement") and applies where Ventureship processes personal data on Customer's behalf. If there is a conflict between this DPA and the Agreement regarding the processing of personal data, this DPA prevails. Customers who require a countersigned copy can request one at legal@ventureship.xyz.
1. 1. Definitions and roles
"Data Protection Laws" means all laws applicable to the processing of personal data under the Agreement, including the GDPR, UK GDPR and applicable US state privacy laws. "Customer Personal Data" means personal data within Customer Data processed by Ventureship on behalf of Customer. Terms such as controller, processor, data subject and personal data breach have the meanings given in Data Protection Laws.
Customer is the controller (or a processor acting for its own controller) and Ventureship is a processor (or sub-processor) of Customer Personal Data. Where US state laws apply, Ventureship acts as a service provider or contractor.
2. 2. Processing instructions
Ventureship will process Customer Personal Data only on Customer's documented instructions, which are set out in the Agreement, this DPA and Customer's configuration and use of the Service, unless required otherwise by law. Ventureship will inform Customer if it believes an instruction infringes Data Protection Laws.
Ventureship will not sell or share Customer Personal Data, retain, use or disclose it outside the direct business relationship, or combine it with other data except as permitted by Data Protection Laws.
3. 3. Details of processing
Subject matter and purpose: providing the Service, including search, natural-language analysis, dashboards, forecasting, automation and related support. Duration: the term of the Agreement plus the period until deletion. Data subjects and categories of data: determined by Customer and may include Customer's employees, customers, prospects and other individuals whose data Customer uploads or connects.
4. 4. Confidentiality and security
Ventureship ensures that personnel authorized to process Customer Personal Data are bound by confidentiality obligations. Ventureship implements appropriate technical and organizational measures designed to protect Customer Personal Data, including encryption in transit and at rest, role-based access controls, logging and monitoring, and regular review of security practices.
5. 5. Sub-processors
Customer authorizes Ventureship to engage sub-processors, such as cloud hosting and payment providers, to support the Service. Ventureship will impose data protection obligations on each sub-processor that are no less protective than this DPA and remains responsible for their performance.
Ventureship will maintain a list of sub-processors available on request and give Customer advance notice of new sub-processors. Customer may object on reasonable data protection grounds, and the parties will work in good faith to resolve the objection. If they cannot, Customer may terminate the affected Service.
6. 6. Data subject requests and assistance
Taking into account the nature of the processing, Ventureship will assist Customer by appropriate measures in responding to data subject requests, and will promptly forward any request it receives directly. Ventureship will also provide reasonable assistance with data protection impact assessments and consultations with supervisory authorities.
7. 7. Personal data breaches
Ventureship will notify Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data, and will provide information reasonably needed for Customer to meet its obligations. Ventureship will take reasonable steps to contain and remediate the breach.
8. 8. International transfers
Where Customer Personal Data is transferred to a country that does not provide an adequate level of protection, the parties agree that the applicable standard contractual clauses, and the UK addendum where relevant, are incorporated by reference, with Customer as data exporter and Ventureship as data importer.
9. 9. Audits
Ventureship will make available information reasonably necessary to demonstrate compliance with this DPA, including responses to security questionnaires. Where required by Data Protection Laws, Customer may conduct an audit on reasonable notice, at its own cost, no more than once a year, subject to confidentiality and in a manner that does not disrupt the Service.
10. 10. Deletion and return
On termination of the Agreement, Customer may export Customer Personal Data using the Service. Ventureship will then delete Customer Personal Data within a reasonable period, unless retention is required by law, in which case it will remain protected by this DPA.