Last updated August 25, 2026
This Data Processing Agreement ("DPA") forms part of the Terms & Conditions between Paras Labs ("Processor", "we") and the fund house using the platform ("Controller", "you"), and applies to the extent we process personal data on your behalf as part of the service.
Where the standard contractual clauses or another statutory transfer mechanism is required for a specific transfer, the parties agree to execute the applicable module of those clauses, which will be incorporated by reference into this DPA.
For personal data submitted by founders through your application forms, you are the Controller and we are the Processor, acting only on your documented instructions as set out in the Terms and this DPA. For the account data of your own team members, we act as an independent Controller for the limited purpose of operating their console access, as described in our Privacy Policy.
This DPA covers the processing of personal data submitted through the platform for the duration of your subscription, and continues to apply to any personal data retained afterward until it is deleted in accordance with this DPA and our Data Policy.
Data subjects: founders and other individuals named in an application; your own team members.
Data categories: name, email address, and any other information a founder chooses to include in a submission — typically business information, and occasionally personal details volunteered in free-text answers or an uploaded deck. We do not ask funds to collect special categories of data through the platform and recommend against configuring a form to request it.
You authorize us to engage the sub-processors listed in our Data Policy for the purposes described there. We will impose data protection obligations on each sub-processor consistent with this DPA, and remain liable to you for a sub-processor's performance. We will give you notice, via email or in-product notice, before adding a new sub-processor that will process your data, and you may object on reasonable data-protection grounds within 14 days of that notice.
If we receive a request from a data subject relating to your data, we will forward it to you and will not respond ourselves except to confirm receipt, unless legally required to do so. We will provide reasonable assistance to help you respond within the timeframe applicable law requires.
We will notify you without undue delay, and in any case within 72 hours of becoming aware, of any breach affecting your data, with the information reasonably available to us at the time — the nature of the breach, the categories and approximate number of data subjects and records affected, and the measures taken or proposed.
Where personal data is transferred to a country without an adequacy decision or equivalent recognition, we rely on the standard contractual clauses or another lawful transfer mechanism to protect it, consistent with the applicable data protection law.
On reasonable written notice, and no more than once per year unless required by a supervisory authority or following a security incident, we will make available the information reasonably necessary to demonstrate compliance with this DPA, which may take the form of a summary of our security practices in place of an on-site audit.
On termination of your subscription, and following any request, we will delete or return your personal data within a reasonable period, except to the extent retention is required by law. Deletion of a workspace through the console, or a written request to hello@pitchinfra.com, is treated as an instruction to delete under this clause.
PitchInfra