Data Processing Terms

In most of our relationship with a buyer, Anabyn Global Ventures LLP acts as a data controller: we decide why and how we process the contact, order, and portal-activity data you give us, in order to quote, produce, and fulfil your order (see our Privacy Policy §§1–2). Where you submit data on behalf of your own end customers (for example, a distributor uploading their client's delivery details into the Buyer Portal), we act as a processor on your instructions for that specific data.

• Subject matter: contact/identity data, order and transaction data, Buyer Portal account data, and communications, as listed in our Privacy Policy §1.
• Nature and purpose: quoting, order fulfilment, Buyer Portal operation, and transactional/marketing communications, as listed in our Privacy Policy §2.
• Duration: for the term of the commercial relationship under our Terms of Service, plus the retention periods set out in our Privacy Policy §6 (e.g. order records retained 7 years for GST/FEMA compliance).

We use the following categories of sub-processor, each under their own data-processing terms with us:

• Google Firebase / Google Cloud — database, authentication, file storage, and hosting.
• Google Analytics 4 and Microsoft Clarity — website analytics (only where you have consented to analytics cookies).
• Anthropic and Google (Gemini/Genkit) — AI processing of spec sheets, RFQs, and inbound messages, to help draft replies and extract order details.
• Meta (WhatsApp Business API) — only when you initiate contact via WhatsApp.

We will notify registered Buyer Portal users of a material change to this sub-processor list.

The safeguards we apply are set out in full in our Privacy Policy §8, and include TLS 1.3 in transit, AES-256 at rest, role-based access control, and a 72-hour breach-notification commitment for incidents that create a high risk to you.

Data may be processed in data centres in the United States, European Union, and Asia Pacific regions by our cloud providers. Transfers outside the European Economic Area are covered by our providers' Standard Contractual Clauses (SCCs) and applicable adequacy decisions, as described in our Privacy Policy §10.

If your organisation's policy requires a bilateral, signed Data Processing Agreement (for example, under GDPR Article 28) rather than relying on this summary, email us with your standard DPA template or ask for ours, and we will review and execute terms consistent with this page and our Privacy Policy.