Dunholm Precision - Data Processing Agreement (signed)

1.4 The processing lasts for as long as BB-Demo provides services to the customer under an order form signed under the master agreement, and for the period needed to return or delete data afterwards.

2. Instructions

2.1 BB-Demo will process personal data only on the documented instructions of the customer, including this agreement, the order form and the configuration the customer sets in the brain.

2.2 If BB-Demo believes an instruction breaches data protection law, it will tell the customer promptly and may pause that instruction until the customer confirms.

3. Where the data lives

3.1 The brain is built and run inside the customer's own Snowflake account. The customer therefore keeps its data in an environment it already controls.

3.2 BB-Demo will keep the data within that Snowflake account and will not copy it elsewhere without the customer's written agreement.

3.3 BB-Demo staff will have access to the account only where needed to deliver and support the service, and only through named, access-controlled users.

4. Confidentiality and security

4.1 BB-Demo will make sure that everyone authorised to handle personal data is bound by a duty of confidence.

4.2 BB-Demo will keep appropriate technical and organisational measures in place, including:

• access limited to named people with a business need;
• separation of customer environments;
• encryption of data in transit and at rest, using the facilities of the customer's Snowflake account;
• logging of administrative access;
• regular review of who holds access.

5. Sub-processors

5.1 BB-Demo will not engage another party to handle the customer's personal data without the customer's prior written authorisation.

5.2 Where such a party is authorised, BB-Demo will put in place terms that give the same level of protection as this agreement and will remain responsible for that party's performance.

6. Assistance and rights of individuals

6.1 BB-Demo will help the customer, by appropriate measures, to respond to requests from individuals exercising their rights under data protection law.

6.2 If BB-Demo receives such a request directly, it will pass it to the customer without answering it itself.

6.3 BB-Demo will give the customer reasonable help with impact assessments and with dealings with the regulator, where these relate to the service.

7. Personal data breaches

7.1 BB-Demo will tell the customer without undue delay after becoming aware of a personal data breach affecting the customer's data.

7.2 The notice will describe, as far as known, what happened, the data and people affected, the likely consequences and the steps being taken to contain and fix it.

8. International transfers

8.1 BB-Demo will not transfer the customer's personal data outside the United Kingdom unless the customer has agreed in writing and a lawful transfer mechanism is in place.

9. Audit

9.1 BB-Demo will make available the information reasonably needed to show it is meeting this agreement.

9.2 The customer may carry out, or appoint someone to carry out, an audit on reasonable notice, during business hours and without unreasonable disruption to BB-Demo.

10. Return and deletion

10.1 When the services end, BB-Demo will, at the customer's choice, return the personal data or delete it, and will remove its own access to the customer's Snowflake account.

10.2 BB-Demo will confirm in writing once deletion and removal of access are complete.

11. Liability and governing law

11.1 Liability under this agreement is governed by the limitations set out in the master agreement between the parties.

11.2 This agreement is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.

Signatures

Signed by the parties on Friday 25 October 2024.