Brackwell Freight Ltd - Data Processing Agreement (signed)

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK data protection legislation. "Customer Data" means any personal data processed by B-Brain on behalf of the Customer under the order form. "Connected Systems" means the Customer's own systems that are connected to the brain, such as its CRM, helpdesk, call recorder and accounting system.

Clause two: Roles and scope

• The Customer is the controller of Customer Data and B-Brain is its processor.
• B-Brain processes Customer Data only to provide, support and maintain the brain as described in the order form.
• The subject matter is the connection, indexing and querying of data from the Connected Systems.
• The duration of processing is the term of the order form and any period needed afterwards to return or delete Customer Data.

Clause three: Types of data and data subjects

Clause four: Instructions

B-Brain will process Customer Data only on the Customer's documented instructions, which are this Agreement, the order form and the configuration the Customer chooses for its connectors. If B-Brain believes an instruction breaches data protection law it will tell the Customer promptly and may pause that processing until the position is clear.

Clause five: Location and architecture

The brain runs inside the Customer's Snowflake account. Customer Data therefore stays in the environment the Customer controls and B-Brain does not copy it into a separate store of its own, other than the limited operational and support information needed to run the service. B-Brain will not move Customer Data outside that environment without the Customer's written agreement.

Clause six: Confidentiality and personnel

B-Brain will make sure that everyone authorised to process Customer Data is bound by a duty of confidentiality, has received appropriate data protection training and has access only to the extent needed for their role.

Clause seven: Security

B-Brain will keep appropriate technical and organisational measures in place to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include:

• access controls based on least privilege, with named accounts;
• encryption of data in transit and at rest within the Snowflake environment;
• logging of administrative access to the brain;
• separation of duties between engineering and support work;
• regular review of access when people join, move or leave.

Clause eight: Sub-processors

The Customer gives general authorisation for B-Brain to use sub-processors that are needed to deliver the service. B-Brain will keep a list available to the Customer on request and will tell the Customer before adding or replacing a sub-processor, giving the Customer a fair chance to object. B-Brain stays responsible for its sub-processors and will bind them to terms no less protective than this Agreement.

Clause nine: Assistance to the Customer

Taking account of the nature of the processing, B-Brain will help the Customer:

• respond to requests from data subjects exercising their rights;
• meet its obligations on security, breach notification, impact assessments and consultation with the regulator;
• demonstrate compliance with this Agreement.

Clause ten: Personal data breach

B-Brain will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data. The notice will describe, as far as is known, the nature of the breach, the data and data subjects concerned, the likely consequences and the steps taken or proposed. B-Brain will keep the Customer updated as more is learned and will cooperate in any investigation.

Clause eleven: Audit

B-Brain will make available the information reasonably needed to show compliance with this Agreement and will allow and contribute to audits by the Customer or an auditor the Customer appoints, on reasonable notice, during business hours and without unreasonable disruption to the service.

Clause twelve: Return and deletion

When the order form ends, or earlier on the Customer's written request, B-Brain will stop processing Customer Data. Because the brain lives in the Customer's Snowflake account, the Customer keeps its data; B-Brain will remove its own access and delete any Customer Data it holds outside that account, unless the law requires it to keep a copy.

Clause thirteen: International transfers

B-Brain will not transfer Customer Data outside the United Kingdom unless the transfer is covered by an appropriate safeguard recognised under data protection law and the Customer has agreed to it in writing.

Clause fourteen: Liability and precedence

Liability under this Agreement is subject to the limits set out in the Master Services Agreement. If this Agreement conflicts with the order form or the Master Services Agreement on the handling of personal data, this Agreement prevails.

Clause fifteen: Governing law

This Agreement is governed by the law of England and Wales and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it.

Signatures

Signed by the authorised representatives of the parties on 17 Nov 2023.