Clonvara Insurance Services - Data Processing Agreement (signed)
Documentexecuted Clonvara Insurance Services: documents · dpa · executed · 2025-10-17
Executed Data Processing Agreement under the MSA, signed 17 Oct 2025. Clonvara Insurance Services is controller and BB-Demo processor, with data staying in the customer's own Snowflake account. It states no price, availability or response times.
What it says
What this says
Current to 11 Oct 26Executed Data Processing Agreement under the MSA, signed 17 Oct 2025. Clonvara Insurance Services is controller and BB-Demo processor, with data staying in the customer's own Snowflake account. It states no price, availability or response times.
What it is: an executed DPA, version 1, that forms part of the Master Services Agreement. It covers personal data about brokers, policyholders, claimants and the customer's staff.
Commits: BB-Demo to process data "only to provide the service and only on the Customer's instructions", to report breaches "without undue delay", and to allow "reasonable audits by the Customer, on notice and during normal working hours".
Unusual: no sub-processor may be engaged "without the Customer's authorisation". Return or deletion is at the customer's choice on ending of the services.
Not settled: no price, service levels, breach notification deadline, retention period or renewal date. The customer signatory is shown only as "Authorised signatory", with no name or role.
As found in this document
Current to 9 Oct 26- Date signed17 Oct 2025Source: object_read:doc_025_006
- Processing instructionsProcess personal data only to provide the service and only on the Customer's instructions.Process personal data only to provide the service and only on the Customer's instructions. · Source: object_read:doc_025_006
- Breach notificationTell the Customer without undue delay if BB-Demo becomes aware of a personal data breach affecting the Customer's data.Tell the Customer without undue delay if BB-Demo becomes aware of a personal data breach affecting the Customer's data. · Source: object_read:doc_025_006
- Sub-processorsBB-Demo will not engage another processor for the Customer's personal data without the Customer's authorisation.BB-Demo will not engage another processor for the Customer's personal data without the Customer's authorisation. · Source: object_read:doc_025_006
- Auditallow reasonable audits by the Customer, on notice and during normal working hours.allow reasonable audits by the Customer, on notice and during normal working hours. · Source: object_read:doc_025_006
- Return and deletionOn ending of the services, BB-Demo will, at the Customer's choice, return or delete personal data it holds, unless the law requires it to be kept.On ending of the services, BB-Demo will, at the Customer's choice, return or delete personal data it holds, unless the law requires it to be kept. · Source: object_read:doc_025_006
- Data locationCustomer data remains in the Customer's Snowflake account.Customer data remains in the Customer's Snowflake account. · Source: object_read:doc_025_006
The document
Body
Clonvara Insurance Services - Data Processing Agreement (signed)
Status: Executed. Version 1.
This Data Processing Agreement sits under the Master Services Agreement between the same parties and forms part of it.
Parties
- Controller: Clonvara Insurance Services, Dublin, Ireland (the "Customer").
- Processor: BB-Demo, London, United Kingdom ("BB-Demo").
Purpose and subject matter
BB-Demo provides the Customer with the company brain, an AI-queryable layer over the Customer's connected systems. In doing so BB-Demo may process personal data held in those systems, including data about brokers, policyholders and claimants. The brain is built and run inside the Customer's own Snowflake account.
Roles
- The Customer is the controller and decides why and how personal data is processed.
- BB-Demo is the processor and acts only on the Customer's documented instructions.
- The Master Services Agreement and the Customer's use of the product's features are the Customer's documented instructions.
Categories of data and data subjects
Read the whole document (3,231 characters)
| Item | Description |
|---|---|
| Data subjects | Brokers, policyholders, claimants, and the Customer's own staff |
| Types of data | Contact details, policy and claims correspondence, support tickets, call and email content |
| Source systems | The systems the Customer chooses to connect to the brain |
BB-Demo's obligations
- Process personal data only to provide the service and only on the Customer's instructions.
- Keep personal data confidential and ensure that anyone with access is bound by a duty of confidentiality.
- Apply appropriate technical and organisational measures to protect personal data.
- Help the Customer to respond to requests from data subjects, so far as is reasonably possible.
- Tell the Customer without undue delay if BB-Demo becomes aware of a personal data breach affecting the Customer's data.
- Help the Customer with impact assessments and with dealings with regulators where relevant.
Location and transfers
Customer data remains in the Customer's Snowflake account. BB-Demo will not move personal data out of that environment except as the Customer instructs, and will comply with applicable data protection law on any transfer.
Sub-processors
BB-Demo will not engage another processor for the Customer's personal data without the Customer's authorisation. Where it does, it will impose obligations no less protective than those in this agreement and remain responsible for that processor.
Audit
BB-Demo will make available the information reasonably needed to show compliance with this agreement and will allow reasonable audits by the Customer, on notice and during normal working hours.
Return and deletion
On ending of the services, BB-Demo will, at the Customer's choice, return or delete personal data it holds, unless the law requires it to be kept. Because data sits in the Customer's own Snowflake account, the Customer keeps control of it throughout.
Signatures
Signed on 17 Oct 2025.
| For BB-Demo | For Clonvara Insurance Services |
|---|---|
| Lewis Kerr | Authorised signatory |
| Account Executive | Clonvara Insurance Services |
| Date: 17 Oct 2025 | Date: 17 Oct 2025 |
Unusual terms
Current to 9 Oct 26- Sub-processors need customer authorisation
- Breach notice without undue delay, no fixed deadline
- Customer audit rights on notice