Fenmoor Specialty Underwriting - Data Processing Agreement (signed)

The Customer is the controller of the personal data processed through the Services. The Supplier is the processor and acts only on the Customer's documented instructions. The Master Services Agreement and this agreement are the Customer's complete instructions at signing. Further instructions must be given in writing.

Subject matter and nature of processing

The Customer will tell the Supplier before connecting any system that holds special category data, so that the parties can agree any further safeguards in writing.

Where the data lives

The brain is built and run inside the Customer's own Snowflake account. The Customer's data is not copied into a Supplier-owned data store. The Supplier accesses the Customer's environment only through the access the Customer grants, and the Customer may review or withdraw that access at any time.

Supplier obligations

The Supplier will:

• process personal data only on the Customer's documented instructions, and tell the Customer if it believes an instruction breaches data protection law;
• make sure that every person authorised to process personal data is bound by a duty of confidence;
• apply appropriate technical and organisational measures to protect personal data, including access controls, separation of duties and logging of administrative access;
• help the Customer, taking into account the nature of the processing, to respond to requests from data subjects;
• help the Customer to meet its obligations on security, breach notification, impact assessments and consultation with regulators; and
• make available the information needed to show compliance with this agreement and allow reasonable audits, on reasonable notice and during normal working hours.

Sub-processors

The Customer gives general authorisation for the Supplier to use sub-processors to deliver the Services. The Supplier will keep a current list available to the Customer, will tell the Customer of any intended addition or replacement, and will give the Customer a fair opportunity to object. The Supplier will put in place with each sub-processor terms that give the same level of protection as this agreement and remains responsible for their performance.

International transfers

The Supplier will not transfer personal data outside the United Kingdom unless the transfer is covered by an approved transfer mechanism under data protection law and the Customer has been told in advance. The Customer's data residency follows the location of its own Snowflake account.

Personal data breaches

The Supplier will tell the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's personal data. The notice will describe, as far as it is known, the nature of the breach, the data and people affected, the likely consequences and the steps taken or proposed. The Supplier will work with the Customer to contain the breach and support any notification the Customer has to make.

Return and deletion

When the Master Services Agreement ends, the Supplier will remove its access to the Customer's environment and delete any personal data it holds outside the Customer's Snowflake account, unless the law requires it to keep the data. The Customer remains responsible for the data inside its own Snowflake account.

Liability and order of precedence

Liability under this agreement is subject to the limits set out in the Master Services Agreement. If there is any conflict between this agreement and the Master Services Agreement on the processing of personal data, this agreement prevails.

Governing law

This agreement is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.

Signatures