Fairhallow Travel - Data Processing Agreement (signed)
Documentexecuted Fairhallow Travel: documents · dpa · executed · 2024-12-13
Executed Data Processing Agreement dated 13 Dec 2024 between Fairhallow Travel (controller) and BB-Demo (processor), under the Master Services Agreement. It states no price, availability or response-time figures.
What it says
What this says
Current to 11 Oct 26Executed Data Processing Agreement dated 13 Dec 2024 between Fairhallow Travel (controller) and BB-Demo (processor), under the Master Services Agreement. It states no price, availability or response-time figures.
What it is: an executed DPA, signed 13 Dec 2024 by a Fairhallow Travel director and by Tom Ashdown for BB-Demo. It sits under the Master Services Agreement and applies to every order form signed under it.
Commits: BB-Demo as processor acts only on documented instructions, applies access controls, encryption and logging, and tells the customer "without undue delay" of a personal data breach. It also keeps a sub-processor list and returns or deletes data at the end of the services.
Unusual: nothing off standard. Sub-processors are under general authorisation with reasonable notice of change, and audits are allowed on reasonable notice.
Not settled: no price, service levels, breach notification deadline in hours, or renewal date. The Fairhallow Travel signatory is named only as "Authorised signatory" with the title Director.
As found in this document
Current to 9 Oct 26- Date signed13 Dec 2024Source: object_read:doc_020_006
- Date start13 Dec 2024Source: object_read:doc_020_006
- Processing instructionsprocess personal data only on the Customer's documented instructions, unless the law requires otherwiseprocess personal data only on the Customer's documented instructions, unless the law requires otherwise · Source: object_read:doc_020_006
- Breach notificationtell the Customer without undue delay if it becomes aware of a personal data breachtell the Customer without undue delay if it becomes aware of a personal data breach · Source: object_read:doc_020_006
- Sub-processorskeep an up-to-date list available to the Customer and give reasonable notice of any changekeep an up-to-date list available to the Customer and give reasonable notice of any change · Source: object_read:doc_020_006
- International transferswill not move personal data outside the Customer's Snowflake account or out of the region the Customer has chosen, except on the Customer's instructionswill not move personal data outside the Customer's Snowflake account or out of the region the Customer has chosen, except on the Customer's instructions · Source: object_read:doc_020_006
- Return and deletionat the Customer's choice, return or delete the personal data it holds on the Customer's behalfat the Customer's choice, return or delete the personal data it holds on the Customer's behalf · Source: object_read:doc_020_006
The document
Body
Fairhallow Travel - Data Processing Agreement (signed)
Status: Executed
Version: one
Effective date: 13 Dec 2024
Parties
This Data Processing Agreement is made between Fairhallow Travel, a business travel management company with its headquarters in Manchester (the "Customer"), and BB-Demo, a data business based in London (the "Supplier"). It sits under the Master Services Agreement between the parties and applies to every order form signed under it.
Background
The Customer has agreed to buy the company brain from the Supplier. The brain is built and run inside the Customer's own Snowflake account and brings together systems the Customer chooses to connect, such as its CRM, helpdesk, call recorder, mailboxes and accounting system. In doing so the Supplier may process personal data on the Customer's behalf. This agreement sets out how.
Roles of the parties
The Customer is the controller of the personal data processed through the brain. The Supplier is the processor and acts only on the Customer's documented instructions, which include the configuration of connectors and the order form.
Subject matter and nature of processing
Read the whole document (4,127 characters)
- The Supplier indexes, stores and makes searchable the data held in the sources the Customer connects.
- Processing takes place inside the Customer's Snowflake account, so the data stays within the Customer's own environment.
- The categories of data subject are the Customer's staff, its corporate clients' contacts and travellers, and its suppliers' contacts, to the extent they appear in the connected systems.
- The Customer decides which sources are connected and may remove a connector at any time.
Supplier obligations
The Supplier shall:
- process personal data only on the Customer's documented instructions, unless the law requires otherwise, in which case it will tell the Customer first where it is allowed to;
- make sure everyone who handles the data is bound by a duty of confidence;
- apply appropriate technical and organisational measures to protect the data, including access controls, encryption and logging of administrative access;
- help the Customer respond to requests from data subjects, and with its own security, breach-notification and impact-assessment duties, taking into account the nature of the processing;
- tell the Customer without undue delay if it becomes aware of a personal data breach.
Sub-processors
The Customer gives general authorisation for the Supplier to use sub-processors that the Supplier needs to run the service. The Supplier will keep an up-to-date list available to the Customer and will give reasonable notice of any change, so that the Customer has a fair opportunity to object. The Supplier remains responsible for its sub-processors.
International transfers
The Supplier will not move personal data outside the Customer's Snowflake account or out of the region the Customer has chosen, except on the Customer's instructions and with a lawful transfer mechanism in place.
Audit and information
The Supplier will provide the information reasonably needed to show compliance with this agreement and will allow and contribute to audits by the Customer or an auditor the Customer appoints, on reasonable notice and during business hours.
Return and deletion
On termination or expiry of the services, the Supplier will, at the Customer's choice, return or delete the personal data it holds on the Customer's behalf and remove its access to the Customer's Snowflake account, unless the law requires it to keep a copy.
Liability and precedence
Liability under this agreement follows the limits in the Master Services Agreement. If this agreement conflicts with the Master Services Agreement on the processing of personal data, this agreement prevails.
Signatures
Signed by the parties' authorised representatives on 13 Dec 2024.
| For Fairhallow Travel | For BB-Demo | |
|---|---|---|
| Name | Authorised signatory | Tom Ashdown |
| Title | Director, Fairhallow Travel | Account Executive |
| Signed | Yes | Yes |
| Date | 13 Dec 2024 | 13 Dec 2024 |