Wexmoor Property Group - Data Processing Agreement (signed)

• Personal Data: any information relating to an identified or identifiable individual that BB-Demo processes on behalf of the Customer.
• Data Protection Laws: the data protection and privacy laws that apply to the Customer's processing of Personal Data, including applicable United States federal and state laws.
• Services: the implementation and subscription services described in the order form and the master agreement between the parties.
• Security Incident: a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to Personal Data.
• Sub-processor: any third party engaged by BB-Demo that processes Personal Data on behalf of the Customer.

Roles and scope

The Customer is the controller of the Personal Data and BB-Demo is its processor. BB-Demo processes Personal Data only to provide the Services, and only as described in this DPA and in the Customer's documented instructions. The subject matter, nature and purpose of the processing are set out in Annex A.

Customer instructions

The Customer instructs BB-Demo to process Personal Data in order to connect, index, refresh and make queryable the sources the Customer chooses to connect to its brain. The master agreement, the order form and this DPA are the Customer's complete instructions at signing. Any further instruction must be given in writing. BB-Demo will tell the Customer without undue delay if it believes an instruction would breach Data Protection Laws.

Confidentiality

BB-Demo will ensure that everyone authorised to process Personal Data is bound by a duty of confidentiality and has been trained in the handling of personal data. Access is limited to those who need it to deliver the Services.

Security

BB-Demo will apply technical and organisational measures appropriate to the risk, as described in Annex B. Because the brain runs inside the Customer's Snowflake account, the Customer remains responsible for the access controls and configuration of that account, and BB-Demo is responsible for the controls within the components it builds and operates.

Sub-processors

The Customer gives general authorisation for BB-Demo to use Sub-processors. BB-Demo will:

• bind each Sub-processor to data protection terms no less protective than this DPA;
• remain responsible for the acts and omissions of its Sub-processors;
• give the Customer reasonable notice of any new Sub-processor, so that the Customer may object on reasonable data protection grounds.

If the parties cannot resolve an objection, the Customer may stop using the affected part of the Services in line with the master agreement.

International transfers

BB-Demo is established in the United Kingdom and the Customer is established in the United States. Where Personal Data is transferred across borders in connection with the Services, BB-Demo will rely on a lawful transfer mechanism recognised under Data Protection Laws and will keep that mechanism in place for as long as the transfer continues.

Assistance with individual rights

If BB-Demo receives a request from an individual about their Personal Data, it will pass the request to the Customer without undue delay and will not respond itself unless the Customer asks it to. Taking account of the nature of the processing, BB-Demo will give the Customer reasonable help in meeting its obligations to respond to such requests.

Security Incidents

BB-Demo will notify the Customer without undue delay after becoming aware of a Security Incident affecting Personal Data. The notification will describe, as far as it is known, the nature of the incident, the data and individuals affected, the likely consequences and the steps taken or proposed to contain and remedy it. BB-Demo will cooperate with the Customer's investigation and with any notifications the Customer must make.

Audit and information

BB-Demo will make available the information reasonably necessary to show compliance with this DPA, including answers to the Customer's security questionnaires. The Customer may carry out an audit on reasonable notice, during business hours and no more often than is reasonably necessary, subject to confidentiality and to avoiding disruption to the Services.

Return and deletion

Because the brain sits in the Customer's own Snowflake account, the Customer's source data stays under its control. On termination or expiry of the Services, BB-Demo will remove the brain components it operates and delete any Personal Data it holds outside the Customer's account, unless the law requires it to keep it. BB-Demo will confirm the deletion in writing on request.

Liability and order of precedence

Liability under this DPA is governed by the limitations and exclusions in the master agreement. If this DPA conflicts with the master agreement on the processing of Personal Data, this DPA prevails. The governing law and jurisdiction are those stated in the master agreement.

Term

This DPA takes effect on the effective date above and continues for as long as BB-Demo processes Personal Data on behalf of the Customer, including any period of return and deletion.

Annex A: Details of processing

Annex B: Security measures

• Processing inside the Customer's Snowflake account, with access governed by the Customer's roles and permissions.
• Role-based access for BB-Demo staff, limited to what the Services require.
• Encryption of Personal Data in transit and at rest.
• Logging of administrative access to the components BB-Demo operates.
• Documented incident response and a named contact for the Customer.
• Staff confidentiality undertakings and regular data protection training.
• Secure removal of data when the Services end.

Signatures

Signed by the authorised representatives of the parties on 16 Jan 2026.