Silverbeck Energy Services - Data Processing Agreement (signed)

The customer shall:

• provide lawful notice and, where required, obtain consent before uploading personal data to the brain;
• maintain a record of the lawful basis for each category of personal data;
• not upload personal data that is excessive, irrelevant or not held for a specified purpose;
• instruct BB-Demo immediately if a data subject requests erasure, correction or export ("a data rights request").

4. BB-Demo obligations

BB-Demo shall:

• process personal data only on documented instruction from the customer;
• not use personal data for its own purposes;
• ensure staff and contractors with access to the brain sign confidentiality agreements;
• assist the customer in responding to data rights requests within 10 working days of notice;
• keep a processing log of all data uploads and deletions;
• notify the customer immediately of any suspected breach.

5. Security

BB-Demo stores the customer's data in the customer's Snowflake account and has no separate copy. Nightly syncs are encrypted using industry-standard TLS. BB-Demo does not back up personal data offline. The customer is responsible for Snowflake access control and encryption keys.

6. Sub-processors

BB-Demo uses Amazon Web Services as a sub-processor for temporary staging during syncs. AWS processes no data at rest; all uploads are encrypted end-to-end. The customer may object to any new sub-processor within 14 days of notice, in which case BB-Demo may terminate this agreement.

7. Data transfers

If the customer's Snowflake region is outside the UK or EU, the customer is responsible for ensuring lawful transfer mechanisms are in place (such as Standard Contractual Clauses or adequacy decisions).

8. Breach notification

In the event of suspected unauthorised access to the brain, BB-Demo shall notify the customer within 24 hours. BB-Demo shall co-operate with the customer's investigation and any notification to the ICO or relevant authority.

9. Assistance with subject rights

BB-Demo shall provide reasonable assistance to the customer in responding to requests from data subjects (for example, a request to know what data the brain holds about a named person). Charges apply if the request is frivolous or the cost exceeds 10 hours of labour.

10. Return or deletion of data

On termination or expiry of the Main Services Agreement, the customer may export all personal data from the brain within 30 days. After 30 days, BB-Demo shall delete all copies from live storage and backups within a further 30 days. BB-Demo shall certify deletion in writing on request.

11. Duration

This DPA runs for the same term as the Main Services Agreement and survives termination of that agreement for data rights requests and breach investigation.

---

Executed as of 14 November 2025.

For BB-Demo:

Authorised Signatory BB-Demo

For Silverbeck Energy Services:

Authorised Signatory Silverbeck Energy Services