Merriott Lyle Distribution - Data Processing Agreement (signed)
Documentexecuted Merriott Lyle Distribution · dpa · executed · 14 Feb 2025
Executed data processing agreement dated 14 Feb 2025 between Merriott Lyle Distribution (controller) and BG-Demo (processor) for the Enterprise tier B-Glass. It states no price, availability figure or response time, and prevails over the master agreement on personal data.
What it says
What this says
As at Fri 9 Oct 2026Executed data processing agreement dated 14 Feb 2025 between Merriott Lyle Distribution (controller) and BG-Demo (processor) for the Enterprise tier B-Glass. It states no price, availability figure or response time, and prevails over the master agreement on personal data.
What it is: an executed DPA, signed 14 Feb 2025, under which Merriott Lyle Distribution is the controller and BG-Demo the processor. It covers personal data processed to provide the Enterprise tier brain inside the Customer's own Snowflake account.
Commits: BG-Demo processes data only on documented instructions, applies the listed security measures, helps with data subject requests and breaches, and deletes or returns data at the end of the services. Breaches are notified "without undue delay", with no hour count given.
Unusual: the DPA prevails over the master agreement and order form on personal data. Sub-processors are under general authorisation, with notice of changes and a chance to object.
Not settled: no price, service levels, term dates or renewal terms appear here. The customer signatory is shown only as "Authorised signatory", with no name or role. The contacts section names Lewis Kerr as BG-Demo account owner, which should be checked against HR records.
As found in this document
As at Fri 9 Oct 2026- Date signed14 Feb 2025Source: the AI read of this record
- Processing instructionsprocess personal data only on the Customer's documented instructionsSource: the AI read of this record
- Data locationData stays within the Customer's own Snowflake account; the Supplier does not copy it to its own systemsSource: the AI read of this record
- EncryptionEncryption in transit and at restSource: the AI read of this record
- Breach notificationwithout undue delay after becoming aware of a personal data breachSource: the AI read of this record
- End of servicesdelete or return personal data at the end of the services, at the Customer's choiceSource: the AI read of this record
- International transferswill not transfer personal data outside the United Kingdom, or from the Customer's chosen location, except on the Customer's instructionsSource: the AI read of this record
The document
Body
Merriott Lyle Distribution - Data Processing Agreement (signed)
Status: Executed Date of agreement: 14 Feb 2025
Parties
This agreement is made between:
- Merriott Lyle Distribution, a wholesale distribution business with its head office in Birmingham (the Customer); and
- BG-Demo, a London data business (the Supplier).
This agreement sits alongside the master agreement and the order form between the parties and forms part of them. If this agreement conflicts with either on the handling of personal data, this agreement prevails.
Background
The Customer has chosen the Enterprise tier of B-Glass. The Supplier builds and runs the brain inside the Customer's own Snowflake account, connecting the Customer's systems so that its branch, key-account and credit-control teams can see each trade account's orders, disputes, calls and invoices together. In doing so the Supplier will process personal data on the Customer's behalf. This agreement sets out the terms on which it does so.
Definitions
Read the whole document (5,639 characters)
Terms such as personal data, processing, controller, processor, data subject and personal data breach have the meanings given to them in applicable data protection law. In this agreement the Customer is the controller and the Supplier is the processor.
Scope and purpose of processing
The Supplier will process personal data only to provide B-Glass and the related implementation and support services described in the order form, and only on the Customer's documented instructions. The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject are set out in the processing details table below.
Processing details
| Item | Description |
|---|---|
| Subject matter | Provision of B-Glass over the Customer's connected systems |
| Duration | The term of the order form, plus the period needed to return or delete data at the end |
| Nature of processing | Indexing, storage, retrieval, summarisation and display within the Customer's Snowflake account |
| Purpose | Allowing the Customer's teams to query their own business data |
| Types of personal data | Names, business contact details, job titles, call recordings and transcripts, emails, support tickets and account correspondence |
| Data subjects | Customer staff, and staff and contacts of the Customer's trade accounts and suppliers |
Obligations of the Supplier
The Supplier will:
- process personal data only on the Customer's documented instructions, and tell the Customer if it believes an instruction breaches data protection law;
- keep personal data confidential and ensure that everyone authorised to process it is bound by a duty of confidentiality;
- apply the security measures set out in the security measures table below;
- help the Customer to respond to requests from data subjects exercising their rights;
- help the Customer with security, breach notification, impact assessments and consultation with the regulator, taking into account the nature of the processing;
- delete or return personal data at the end of the services, at the Customer's choice, unless the law requires it to be kept.
Security measures
| Area | Measure |
|---|---|
| Location of data | Data stays within the Customer's own Snowflake account; the Supplier does not copy it to its own systems |
| Access control | Named users only, least privilege, and single sign-on for the Enterprise tier |
| Encryption | Encryption in transit and at rest |
| Logging | Access and administrative actions are logged and reviewable by the Customer |
| Staff | Supplier staff with access are vetted, trained and bound by confidentiality |
| Resilience | Regular backups and a tested recovery process |
Sub-processors
The Customer gives general authorisation for the Supplier to use sub-processors. The Supplier will tell the Customer of any intended addition or replacement and give it a fair opportunity to object. The Supplier remains responsible for its sub-processors and will bind them to terms no less protective than these.
Personal data breaches
The Supplier will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's personal data, and will give the information the Customer reasonably needs to meet its own obligations.
International transfers
The Supplier will not transfer personal data outside the United Kingdom, or from the Customer's chosen location, except on the Customer's instructions and with an appropriate lawful transfer mechanism in place.
Audit
The Supplier will make available the information needed to show compliance with this agreement and will allow and contribute to reasonable audits by the Customer or an auditor it appoints, on reasonable notice and during business hours.
Liability and governing law
Liability under this agreement is subject to the limitations in the master agreement. This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Contacts
- For the Supplier: Tom Ashdown, Account Executive, with Daniel Okafor as the customer success manager.
- For the Customer: Lewis Kerr is the BG-Demo account owner for this relationship.
Signatures
Signed by the authorised representatives of the parties on 14 Feb 2025.
| For the Customer | For the Supplier | |
|---|---|---|
| Organisation | Merriott Lyle Distribution | BG-Demo |
| Name | Authorised signatory | Tom Ashdown |
| Title | Authorised signatory of the Customer | Account Executive |
| Date | 14 Feb 2025 | 14 Feb 2025 |
Unusual terms
As at Fri 9 Oct 2026- DPA prevails over master agreement on personal data
- General authorisation for sub-processors
- No breach notification time limit stated