Calderbrook Housing Group - Data Processing Agreement (signed)
Documentexecuted Calderbrook Housing Group: documents · dpa · executed · 2024-08-16
Executed Data Processing Agreement under the MSA, signed 16 Aug 2024. Calderbrook is controller and B-Brain processor, with data kept in the customer's own Snowflake account. It states no availability, response time or price.
What it says
What this says
Current to 11 Oct 26Executed Data Processing Agreement under the MSA, signed 16 Aug 2024. Calderbrook is controller and B-Brain processor, with data kept in the customer's own Snowflake account. It states no availability, response time or price.
What it is: an executed DPA that forms part of the Master Services Agreement. It says B-Brain "will process the Controller data only on the Controller's documented instructions" and sets the purpose as a combined picture of tenant calls, repairs tickets, complaints and rent arrears.
Commits: B-Brain to confidentiality, role-based access, help with data subject requests, prompt breach notification "without undue delay", audits on reasonable notice, and removal of access and deletion of outside copies at the end.
Unusual: general authorisation for sub-processors, with notice and a fair opportunity to object. Transfers outside the United Kingdom need a lawful mechanism and notice to the Controller.
Not settled: no price, service levels, renewal date or term. The Controller signatory is only named as an authorised signatory, so the evidence does not show who signed for Calderbrook.
As found in this document
Current to 9 Oct 26- Date signed16 Aug 2024Source: object_read:doc_007_006
- Processing instructionsB-Brain will process the Controller data only on the Controller's documented instructionsB-Brain will process the Controller data only on the Controller's documented instructions · Source: object_read:doc_007_006
- Data locationB-Brain will not move Controller data out of that account except as the Controller instructs in writing.B-Brain will not move Controller data out of that account except as the Controller instructs in writing. · Source: object_read:doc_007_006
- Personal data breachit will tell the Controller without undue delayit will tell the Controller without undue delay · Source: object_read:doc_007_006
- International transfersB-Brain will not transfer Controller data outside the United Kingdom unless the transfer is covered by a lawful transfer mechanism and the Controller has been told.B-Brain will not transfer Controller data outside the United Kingdom unless the transfer is covered by a lawful transfer mechanism and the Controller has been told. · Source: object_read:doc_007_006
- Auditon reasonable notice, during business hours and without unreasonable disruptionon reasonable notice, during business hours and without unreasonable disruption · Source: object_read:doc_007_006
- Return and deletionB-Brain will remove its access and delete any copies it holds outside that account, unless the law requires them to be kept.B-Brain will remove its access and delete any copies it holds outside that account, unless the law requires them to be kept. · Source: object_read:doc_007_006
The document
Body
Unusual terms
Current to 9 Oct 26- General authorisation for sub-processors
- DPA prevails over MSA on personal data
- Order form data residency takes precedence