Lornefield Pensions Administration - Data Processing Agreement (signed)
Documentexecuted Lornefield Pensions Administration: documents · dpa · executed · 2023-03-17
Executed data processing agreement between BB-Demo (Processor) and Lornefield Pensions Administration (Controller), signed 17 Mar 2023. It limits processing to the company brain and keeps data in the Controller's own Snowflake account. It states no price, availability or response times.
What it says
What this says
Current to 11 Oct 26Executed data processing agreement between BB-Demo (Processor) and Lornefield Pensions Administration (Controller), signed 17 Mar 2023. It limits processing to the company brain and keeps data in the Controller's own Snowflake account. It states no price, availability or response times.
What it is: a UK data processing agreement alongside the Master Services Agreement. It covers search and questions across trustee calls, member-query tickets and fee invoices, and the text is marked executed on 17 Mar 2023.
Commits: the Processor acts only on documented instructions and will not engage another processor "without the Controller's prior written agreement". It must tell the Controller of a breach "without undue delay" and allow reasonable audits on sensible notice.
Unusual: no fixed breach-notification period and no named sub-processor list. Data stays in the Controller's own Snowflake account, so the Controller keeps its data throughout and chooses return or deletion at the end.
Not settled: price, service levels, term and renewal sit in the order form and Master Services Agreement, which this document does not reproduce. The customer signatory is shown only as "Authorised signatory", with no name.
As found in this document
Current to 9 Oct 26- Date signed17 Mar 2023Source: object_read:doc_005_005
- Processing instructionsThe Processor acts only on the Controller's documented instructions, which are the Master Services Agreement, the order form and this agreement.The Processor acts only on the Controller's documented instructions, which are the Master Services Agreement, the order form and this agreement. · Source: object_read:doc_005_005
- Sub-processorsThe Processor will not engage another processor for personal data without the Controller's prior written agreementThe Processor will not engage another processor for personal data without the Controller's prior written agreement · Source: object_read:doc_005_005
- Breach notificationtell the Controller without undue delaytell the Controller without undue delay · Source: object_read:doc_005_005
- Auditallow reasonable audits by the Controller on sensible noticeallow reasonable audits by the Controller on sensible notice · Source: object_read:doc_005_005
- Return and deletionat the Controller's choice, return or delete personal data it holdsat the Controller's choice, return or delete personal data it holds · Source: object_read:doc_005_005
- Data locationPersonal data is not copied out of that account except as the Controller instructs in writing.Personal data is not copied out of that account except as the Controller instructs in writing. · Source: object_read:doc_005_005
The document
Body
Lornefield Pensions Administration - Data Processing Agreement (signed)
Executed on 17 Mar 2023.
This data processing agreement sits alongside the Master Services Agreement between BB-Demo ("the Processor") and Lornefield Pensions Administration, Edinburgh ("the Controller").
Definitions
- Personal data: any information relating to an identifiable person that the Processor handles on the Controller's behalf.
- Applicable data protection law: the data protection law that applies to the Controller's processing in the United Kingdom.
- Services: the company brain, as described in the Master Services Agreement and order form.
Subject matter and purpose
The Processor provides the company brain so that the Controller's scheme-relationship managers can search and ask questions across trustee calls, member-query tickets and fee invoices. Personal data is processed only for that purpose.
Roles
The Controller decides why and how personal data is processed. The Processor acts only on the Controller's documented instructions, which are the Master Services Agreement, the order form and this agreement.
Categories of data and people
Read the whole document (3,179 characters)
The data may include names and contact details of trustees, scheme members and the Controller's staff, together with the content of calls, tickets and invoices connected to the brain. The Controller remains responsible for deciding which sources are connected.
Where data is held
The brain is built and run inside the Controller's own Snowflake account. Personal data is not copied out of that account except as the Controller instructs in writing.
Security
The Processor keeps appropriate technical and organisational measures in place to protect personal data against loss, misuse and unauthorised access, and restricts access to staff who need it to deliver the Services.
Staff and confidentiality
Everyone at the Processor with access to personal data is bound by a duty of confidentiality.
Sub-processors
The Processor will not engage another processor for personal data without the Controller's prior written agreement, and will keep the same obligations in place with any approved sub-processor.
Assistance and incidents
The Processor will help the Controller respond to requests from individuals and to regulators. If the Processor becomes aware of a personal data breach, it will tell the Controller without undue delay and give the information the Controller needs to meet its own obligations.
Audit
The Processor will make available the information reasonably needed to show compliance with this agreement and will allow reasonable audits by the Controller on sensible notice.
Return and deletion
When the Services end, the Processor will stop processing and, at the Controller's choice, return or delete personal data it holds. Because the data lives in the Controller's own Snowflake account, the Controller keeps its data throughout.
Signatures
Signed for BB-Demo Name: Nell Ashcombe Title: Chief Executive Officer and Co-founder Date: 17 Mar 2023
Signed for Lornefield Pensions Administration Title: Authorised signatory Date: 17 Mar 2023
Unusual terms
Current to 9 Oct 26- Breach notice without undue delay, no fixed period
- Prior written consent for any sub-processor