V2F Technology Private Limited (Visa2Fly) · Last updated: 13 October 2026
PARTIES AND BACKGROUND
This Data Processing Addendum (the “DPA”) is made between V2F Technology Private Limited (trading as Visa2Fly), a company incorporated in India, CIN U72900HR2021PTC094874, with its office at 4th Floor, Tower C, Unitech Business Zone, Sector 50, Gurugram, Haryana 122018, India (“Visa2Fly”, “V2F” or the “Processor”), and the business customer that has agreed to the Agreement (the “Customer” or the “Controller”). Each is a “Party” and together they are the “Parties”.
This DPA forms part of the Visa2Fly Terms and Conditions, or any other written agreement between the Parties that refers to this DPA (the “Agreement”), under which V2F provides visa application, document processing and related travel services (the “Services”). It sets out the terms on which V2F processes personal data on the Customer’s behalf and is intended to satisfy Article 28 of the GDPR.
The Customer enters into this DPA for itself and for any affiliate that is authorised to use the Services under the Agreement and has not signed a separate agreement with V2F. References to the Customer include those affiliates.
1. DEFINITIONS
1.1 In this DPA the following terms have the meanings below.
- “Applicable Data Protection Law” means the EU GDPR (Regulation (EU) 2016/679), the UK GDPR and the UK Data Protection Act 2018, the Swiss Federal Act on Data Protection, and any national law implementing or supplementing them, each as amended or replaced.
- “Customer Personal Data” means personal data that V2F processes on behalf of the Customer in providing the Services, including data supplied by the Customer, its applicants and its authorised users.
- “Biometric Data” means personal data resulting from specific technical processing of the physical characteristics of a person that allows or confirms unique identification, such as fingerprints and facial images used for identification, as defined in Article 4(14) of the GDPR.
- “Personal Data Breach” or “Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Customer Personal Data processed by V2F or its Sub-processors.
- “Restricted Transfer” means a transfer of Customer Personal Data to a country or organisation outside the EEA, the United Kingdom or Switzerland that is not covered by an adequacy decision.
- “EU SCCs” means the standard contractual clauses annexed to Commission Implementing Decision (EU) 2021/914 of 4 June 2021, Module Two (controller to processor).
- “UK Addendum” means the International Data Transfer Addendum to the EU SCCs issued by the UK Information Commissioner under section 119A of the Data Protection Act 2018, version B1.0, in force from 21 March 2022.
- “Sub-processor” means a third party engaged by V2F to process Customer Personal Data on the Customer’s behalf.
1.2 The terms “controller”, “data subject”, “personal data”, “processing”, “processor”, “special categories of personal data” and “supervisory authority” have the meanings given in the GDPR. Capitalised terms not defined here have the meanings given in the Agreement.
2. SCOPE, ROLES AND INSTRUCTIONS
2.1 Roles. This DPA applies to V2F’s processing of Customer Personal Data under the Agreement. The Customer is the controller and V2F is the processor. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subjects are set out in Annex I.
2.2 Documented instructions. V2F will process Customer Personal Data only on the Customer’s documented instructions, including with regard to transfers to a third country, unless required to do otherwise by law, in which case V2F will inform the Customer before processing unless the law prohibits this. The Agreement, this DPA and the Customer’s use and configuration of the Services are the Customer’s complete instructions at signature. Further instructions must be given in writing and are subject to reasonable agreement on scope and cost where they go beyond the Services.
2.3 Unlawful instructions. V2F will promptly tell the Customer if, in its opinion, an instruction infringes Applicable Data Protection Law, and may suspend the affected processing until the Customer confirms or amends the instruction.
2.4 Customer responsibilities. The Customer is responsible for having a lawful basis for the processing, for giving data subjects the notices required by Articles 13 and 14 of the GDPR, for obtaining any consent that is required, and for the accuracy and lawfulness of the data it provides. The Customer will use the Services only for lawful visa and travel purposes.
2.5 Special categories and Biometric Data. The Parties acknowledge that visa applications may involve photographs, fingerprints or other Biometric Data and, depending on the destination country’s forms, data revealing health, religion or racial or ethnic origin. The Customer confirms that it has a valid condition under Article 9(2) of the GDPR for any such data it submits, including explicit consent from the data subject where that is the condition relied on. V2F will process these data only as needed to prepare and submit the application, will limit access to authorised personnel with a need to know, and will apply the additional safeguards listed in Annex II.
2.6 Embassies and visa centres. Embassies, consulates, immigration authorities and visa application centres that receive application data in order to decide a visa application act as independent controllers. They are not Sub-processors of V2F, and V2F’s disclosure to them is made on the Customer’s instructions.
3. PROCESSOR OBLIGATIONS
3.1 Purpose limitation. V2F will not sell or share Customer Personal Data, will not use it for its own marketing or for any purpose outside the Agreement, and will not combine it with personal data received from other customers or collected from its own interactions, except as needed to deliver the Services.
3.2 Confidentiality. V2F will ensure that every person authorised to process Customer Personal Data is bound by a written duty of confidentiality or an appropriate statutory duty, and has received data protection and security training.
3.3 Security. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, V2F will implement and maintain the technical and organisational measures in Annex II, designed to ensure a level of security appropriate to the risk under Article 32 of the GDPR. These include, as appropriate, pseudonymisation and encryption, ongoing confidentiality, integrity, availability and resilience of systems, timely restoration of access after an incident, and regular testing of the measures. V2F may update the measures if the update does not reduce the overall level of protection.
3.4 Records. V2F will keep the records of processing activities required of processors by Article 30(2) of the GDPR and make them available to a supervisory authority on request.
3.5 Assistance. Taking into account the nature of processing and the information available to it, V2F will reasonably assist the Customer with its obligations under Articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultation with a supervisory authority. Assistance that goes beyond the ordinary functionality of the Services may be charged at reasonable rates agreed in advance.
4. SUB-PROCESSORS
4.1 General authorisation. The Customer gives V2F general written authorisation to engage Sub-processors, including those listed in Annex III.
4.2 Notice of changes. V2F will give the Customer at least 30 calendar days’ written notice, by email to the contact on the Customer’s account or named in the Agreement, before adding or replacing a Sub-processor. V2F will also update Annex III on this page.
4.3 Objection. The Customer may object in writing on reasonable data protection grounds within 30 days of the notice. The Parties will then work in good faith for up to 30 days to find a commercially reasonable solution that avoids the objected-to Sub-processor. If none is found, either Party may terminate the affected Services on written notice without penalty, and V2F will refund prepaid fees for the period after termination.
4.4 Flow-down. V2F will bind each Sub-processor by a written contract that imposes data protection obligations no less protective than those in this DPA, including appropriate technical and organisational measures.
4.5 Liability. V2F remains fully liable to the Customer for each Sub-processor’s performance of its data protection obligations.
4.6 Urgent replacement. Where a Sub-processor must be replaced urgently for security or continuity reasons, V2F may do so on shorter notice and will notify the Customer as soon as reasonably possible. The objection right in section 4.3 then applies from the date of that notice.
5. DATA SUBJECT RIGHTS AND THIRD-PARTY REQUESTS
5.1 Data subject requests. If V2F receives a request from a data subject to exercise rights under Chapter III of the GDPR (access, rectification, erasure, restriction, portability or objection) that relates to Customer Personal Data, V2F will forward it to the Customer within 5 business days and will not respond unless the Customer instructs it to or the law requires.
5.2 Assistance. Taking into account the nature of the processing, V2F will assist the Customer by appropriate technical and organisational measures, insofar as possible, to fulfil the Customer’s obligation to respond to those requests.
5.3 Government and third-party requests. If V2F receives a legally binding request from a public authority, court or other third party for disclosure of Customer Personal Data, it will, unless legally prohibited, notify the Customer promptly, review the legality of the request, challenge it where there are reasonable grounds to do so, disclose only the minimum amount of data permitted, and keep a record of the request and its handling. V2F will not disclose Customer Personal Data in response to a request that is not legally binding.
6. PERSONAL DATA BREACH
6.1 Notification. V2F will notify the Customer without undue delay and in any event within 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice will go to the security or privacy contact on the Customer’s account or named in the Agreement.
6.2 Content. To the extent known, the notice will describe the nature of the breach, including the categories and approximate number of data subjects and records concerned, the name and contact details of V2F’s contact point, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects. Where all information is not yet available, V2F may provide it in phases without further undue delay.
6.3 Response. V2F will take reasonable steps to contain, investigate and remediate the breach, will keep the Customer informed of material developments, and will give the Customer the cooperation it reasonably needs to meet its own notification duties under Articles 33 and 34 of the GDPR.
6.4 Responsibility for notifications. The Customer decides whether and how to notify supervisory authorities and data subjects. V2F will not notify them or make public statements naming the Customer unless the law requires it.
6.5 No admission. V2F’s notice or response is not an admission of fault or liability. Unsuccessful attempts that do not compromise Customer Personal Data, such as failed logins, pings, port scans and blocked denial-of-service attacks, are not Personal Data Breaches.
7. AUDITS AND COMPLIANCE
7.1 Information. V2F will make available to the Customer the information reasonably necessary to demonstrate compliance with Article 28 of the GDPR and this DPA, including, on request and under confidentiality, its most recent independent audit reports, certifications or penetration test summaries (currently its ISO/IEC 27001 certificate, SOC 2 Type 2 report and VAPT summary).
7.2 Audits. If that information does not reasonably satisfy the Customer, or where a supervisory authority requires it or a Personal Data Breach has occurred, the Customer or an independent auditor it appoints may audit V2F’s relevant processing operations, no more than once in any 12 months except in those cases.
7.3 Conditions. The Customer will give at least 30 days’ written notice, agree the scope and timing with V2F, audit during normal business hours, keep V2F’s and its other customers’ information confidential, and avoid unreasonable disruption. The auditor must be bound by confidentiality. An audit does not give access to data of other customers or to information that is not relevant to Customer Personal Data.
7.4 Costs. Each Party bears its own costs of an audit, except that the Customer will reimburse V2F’s reasonable costs for any audit beyond the first in a 12-month period, unless the audit reveals a material breach of this DPA by V2F.
8. INTERNATIONAL TRANSFERS
8.1 Transfers to V2F. V2F is established in India, which is not covered by an adequacy decision of the European Commission. Where Customer Personal Data subject to the GDPR is made available to V2F, that is a Restricted Transfer and the EU SCCs apply as set out in this section. The Customer is the data exporter and V2F is the data importer.
8.2 EU SCCs. The EU SCCs (Module Two) are incorporated into this DPA and completed as follows:
- Clause 7 (docking clause): applies.
- Clause 9(a) (sub-processors): Option 2, general written authorisation, with the notice period in section 4.2 of this DPA.
- Clause 11(a) (redress): the optional language does not apply.
- Clause 13 and Annex I.C: the competent supervisory authority is identified in Annex I.
- Clause 17: Option 1, the law of Ireland.
- Clause 18(b): the courts of Ireland.
- Annexes I, II and III of the EU SCCs are completed by Annexes I, II and III of this DPA.
8.3 Switzerland. For Customer Personal Data subject to the Swiss Federal Act on Data Protection, the EU SCCs apply with these changes: references to the GDPR mean the Swiss Act; references to the EU, a Member State or Member State law mean Switzerland or Swiss law; the competent supervisory authority is the Swiss Federal Data Protection and Information Commissioner; and data subjects in Switzerland may enforce their rights in Switzerland.
8.4 United Kingdom. For Customer Personal Data subject to the UK GDPR, the UK Addendum applies and is incorporated into this DPA. Tables 1 to 3 of the UK Addendum are completed with the information in Annexes I to III, and in Table 4 both the Importer and the Exporter may end the UK Addendum in accordance with its Section 19.
8.5 Supplementary measures. V2F will apply the supplementary measures in Annex II, including encryption of Customer Personal Data in transit and at rest. If a transfer mechanism proves insufficient to protect Customer Personal Data to the standard required by Applicable Data Protection Law, V2F will promptly implement further supplementary measures and tell the Customer.
8.6 Transfer assessment. V2F confirms that, at the date of this DPA, it has no reason to believe that the laws applicable to it, including requirements to disclose data to public authorities, prevent it from meeting its obligations under the EU SCCs. V2F will notify the Customer promptly if that changes.
8.7 Onward transfers. V2F will not make any other Restricted Transfer of Customer Personal Data, and will not allow a Sub-processor to do so, unless it complies with Chapter V of the GDPR. Disclosure of application data to an embassy, consulate or visa centre in a destination country is made on the Customer’s instructions, and the Customer remains responsible for identifying the valid transfer ground for it, such as an applicable derogation under Article 49 of the GDPR.
9. RETURN AND DELETION
9.1 On termination. When the Services end, V2F will stop processing Customer Personal Data and, at the Customer’s choice made within 30 days, return it in a commonly used format or delete it, including by making it unreadable. If the Customer does not choose within 30 days, V2F will delete it.
9.2 Timing and certification. V2F will complete deletion from live systems within 30 days of the Customer’s instruction or the end of the choice period, delete it from backups within 90 days, and confirm deletion in writing on request.
9.3 Retention required by law. V2F may keep Customer Personal Data to the extent and for the period that applicable law requires. It will tell the Customer what it is keeping and why, keep it confidential and protected, and use it for no other purpose.
9.4 Retention during the Services. Retention periods for application documents and records during the Services are set out in Annex I.
10. LIABILITY, GOVERNING LAW AND GENERAL TERMS
10.1 Liability. Each Party is liable for its own breach of this DPA and Applicable Data Protection Law. Subject to section 10.2, the liability of each Party under or in connection with this DPA is subject to the limitations and exclusions of liability in the Agreement.
10.2 Exceptions. Nothing in this DPA limits liability that cannot be limited by law, a data subject’s rights under the EU SCCs or Article 82 of the GDPR, or either Party’s liability to data subjects or supervisory authorities.
10.3 Governing law and courts. This DPA is governed by the law of Ireland. The courts of Ireland have exclusive jurisdiction over any dispute arising from it, without prejudice to Clause 18 of the EU SCCs and to the rights of data subjects.
10.4 Order of precedence. If there is a conflict, the following prevail in this order: the EU SCCs and the UK Addendum, this DPA, then the Agreement.
10.5 Term. This DPA starts when the Customer accepts the Agreement, or on the date the Parties sign a copy of it if earlier, and continues for as long as V2F processes Customer Personal Data, even after the Agreement ends.
10.6 Changes in law. If Applicable Data Protection Law changes or a competent authority requires it, the Parties will negotiate in good faith any amendment needed to keep the DPA compliant.
10.7 Severability. If any provision is held unlawful or unenforceable, the rest of this DPA continues in effect and the Parties will replace the provision with a valid one that comes closest to its intent.
10.8 Acceptance. The Customer accepts this DPA by agreeing to the Agreement, and no separate signature is needed. A countersigned copy is available on request at dpo@visa2fly.com.
10.9 Updates. V2F may update this DPA by posting a new version on this page with a new “last updated” date. V2F will give Customers at least 30 days’ notice by email of any update that materially affects them.
10.10 Contact. Questions about this DPA or requests under it can be sent to dpo@visa2fly.com.
ANNEX I: DESCRIPTION OF PROCESSING
A. List of parties
| Data exporter | Data importer | |
|---|---|---|
| Name | The Customer, as identified in the Agreement or on its account | V2F Technology Private Limited (Visa2Fly) |
| Address | As stated in the Agreement or on the Customer’s account | 4th Floor, Tower C, Unitech Business Zone, Sector 50, Gurugram, Haryana 122018, India |
| Contact | As stated in the Agreement or on the Customer’s account | V2F data protection team, dpo@visa2fly.com |
| Role | Controller | Processor |
| Activities relevant to the transfer | Receives the Services for its visa applicants and travellers | Provides visa application, document processing and related travel services |
B. Description of processing
| Item | Description |
|---|---|
| Data subjects | Visa applicants and travellers submitted by the Customer; family members or co-travellers on joint applications; the Customer’s authorised users and staff; sponsors, referees and employers named in applications |
| Frequency of transfer | Continuous, for the duration of the Services |
| Nature of processing | Collection, recording, storage, review, verification, form completion, translation, submission to embassies and visa centres, document delivery, communication with applicants, support and deletion |
| Purposes | Providing the Services to the Customer, and nothing else |
| Retention | Application documents and records are kept for 90 days after the final visa decision or delivery, then deleted unless the Customer instructs otherwise or law requires longer retention |
| Sub-processor transfers | The same subject matter, nature and duration, as listed in Annex III |
Categories of personal data
| Category | Examples | Special category? |
|---|---|---|
| Identity and passport | Name, date of birth, gender, nationality, passport number, passport and ID scans, signature | No |
| Photographs and biometrics | Visa photographs, facial images, fingerprints | Yes, where used to identify a person |
| Travel and contact | Itineraries, bookings, address, email, phone, previous travel history | No |
| Financial and employment | Bank statements, income proof, employer details, payment references | No |
| Other application data | Marital status and, where a destination form requires it, data on health, religion or racial or ethnic origin | Yes, where applicable |
C. Competent supervisory authority
As determined under Clause 13 of the EU SCCs. Where the Customer is established in the EU, this is the supervisory authority of the Member State of its establishment.
ANNEX II: TECHNICAL AND ORGANISATIONAL MEASURES
V2F maintains the following measures, or measures that give an equivalent level of protection. They also serve as Annex II of the EU SCCs.
| Area | Measures |
|---|---|
| Security governance | Named security lead; written information security policies reviewed at least annually; information security management system certified to ISO/IEC 27001; SOC 2 Type 2 report; formal risk assessment at least annually |
| Encryption | TLS 1.2 or higher for data in transit; encryption at rest for databases, file storage and backups; keys managed separately from data |
| Access control | Role-based access on a least-privilege and need-to-know basis; unique user IDs; multi-factor authentication for administrative and production access; periodic access reviews; prompt removal of access on role change or exit |
| Special category and biometric data | Restricted to named roles; access logged and reviewed; stored separately from general application data where feasible; deleted on the shortest practicable schedule |
| Logging and monitoring | Audit logs of access to Customer Personal Data and administrative actions; monitoring for suspicious activity; logs protected from tampering |
| Application and network security | Network segmentation and firewalls; secure development practices with code review; regular vulnerability scans; independent penetration testing (VAPT) at least annually; risk-based patching |
| Resilience and recovery | Redundant infrastructure; regular backups; tested disaster recovery and backup restoration plans |
| Personnel | Background checks where lawful; confidentiality agreements at hire; privacy and security training at onboarding and annually |
| Incident management | Documented incident response procedure with escalation paths, root cause review and customer notification within 48 hours as set out in section 6 of this DPA |
| Vendor management | Security and privacy due diligence on Sub-processors before engagement; written data protection terms; periodic review |
| Physical security | Production systems hosted in AWS data centres in Frankfurt, Germany (eu-central-1) with physical access controls; office access controls and clear-desk practice |
| Data minimisation and deletion | Collection limited to what each destination requires; retention schedule enforced; secure deletion on instruction, including from backups as set out in section 9 |
ANNEX III: AUTHORISED SUB-PROCESSORS
The Customer authorises the following Sub-processors at the date of this DPA. V2F will keep this list current and notify changes under section 4.
| Sub-processor | Service | Location of processing | Safeguards |
|---|---|---|---|
| AWS (Amazon Web Services) | Hosting, storage and backups for the platform | Germany (AWS Frankfurt, eu-central-1) | AWS Data Processing Addendum, including SCCs where applicable; encryption at rest and in transit |
| DTDC | Courier delivery of passports and documents | India | Written agreement with confidentiality and data protection terms |
| Microsoft Azure | Email and messaging for applicant notifications and support messages | India | Microsoft Products and Services Data Protection Addendum |
| Razorpay | Payment processing | India | Data protection terms in the merchant agreement; PCI DSS compliance |