Delancey Haig - Data Processing Agreement (signed)
Documentexecuted Delancey Haig: documents · dpa · executed · 2024-06-19
Executed DPA effective 19 Jun 2024 between Delancey Haig (controller) and BB-Demo (processor) for the company brain, run inside the customer's own Snowflake account. It states no price, availability or response-time terms.
What it says
What this says
Current to 11 Oct 26Executed DPA effective 19 Jun 2024 between Delancey Haig (controller) and BB-Demo (processor) for the company brain, run inside the customer's own Snowflake account. It states no price, availability or response-time terms.
What it is: an executed data processing agreement, signed 19 Jun 2024 by a Delancey Haig director and Priya Raman for BB-Demo. Delancey Haig is the controller and BB-Demo the processor "acting on documented instructions".
Commits: BB-Demo will tell the customer "without undue delay" after becoming aware of a personal data breach. It will not move personal data outside that environment, or outside the United Kingdom, except on the customer's instruction with a lawful transfer mechanism.
Unusual: general authorisation for sub-processors with reasonable notice of change, and the DPA prevails over the master agreement or an order form on personal data handling. Audits are allowed on reasonable notice.
Not settled: no price, service levels, term or renewal date. Liability follows the master agreement, which is not in this document. The customer signatory is named only as "Authorised signatory".
As found in this document
Current to 9 Oct 26- Date signed19 Jun 2024Source: object_read:doc_077_006
- Date start19 Jun 2024Source: object_read:doc_077_006
- Processing instructionsprocess personal data only on the Customer's documented instructionsprocess personal data only on the Customer's documented instructions · Source: object_read:doc_077_006
- Breach notificationtell the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's datatell the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data · Source: object_read:doc_077_006
- International transferswill not move the Customer's personal data outside that environment, or outside the United Kingdom, except on the Customer's instruction and with a lawful transfer mechanism in placewill not move the Customer's personal data outside that environment, or outside the United Kingdom, except on the Customer's instruction and with a lawful transfer mechanism in place · Source: object_read:doc_077_006
- Return and deletionremove its access to the Customer's Snowflake account and delete any copies of the Customer's personal data it holds outside that accountremove its access to the Customer's Snowflake account and delete any copies of the Customer's personal data it holds outside that account · Source: object_read:doc_077_006
- Auditallow audits by the Customer or an auditor the Customer appoints, on reasonable notice, during business hoursallow audits by the Customer or an auditor the Customer appoints, on reasonable notice, during business hours · Source: object_read:doc_077_006
The document
Body
Delancey Haig - Data Processing Agreement (signed)
Status: Executed Effective date: 19 Jun 2024
This agreement is made between Delancey Haig, a recruitment group based in London (the "Customer"), and BB-Demo, a London data business (the "Supplier"). It sets out how the Supplier handles personal data on the Customer's behalf when the Customer uses the company brain.
Parties and roles
| Item | Detail |
|---|---|
| Customer | Delancey Haig, London |
| Supplier | BB-Demo, London |
| Customer role | Controller of the personal data |
| Supplier role | Processor acting on documented instructions |
| Supplier account owner | Priya Raman, Account Executive |
| Supplier customer success manager | Daniel Okafor |
Background
The Customer intends to use the company brain so that its client-account directors can see each client's vacancies, placements, invoices and complaints together in one place. The brain is built and run inside the Customer's own Snowflake account. Because of this, the Customer's data stays within an environment the Customer controls, and the Supplier works on it only to provide and support the service.
Subject matter and purpose
Read the whole document (5,932 characters)
| Item | Detail |
|---|---|
| Subject matter | Provision, configuration and support of the company brain |
| Purpose | To let the teams at Delancey Haig ask questions across their own CRM, accounting, helpdesk and related business records |
| Nature of processing | Indexing, storing, searching and summarising records inside the Customer's Snowflake account |
| Duration | For as long as the Supplier provides the service to the Customer, and until deletion as set out below |
Categories of data and data subjects
Data subjects may include:
- the Customer's employees and contractors
- contact people at the Customer's clients
- candidates and placed professionals
- individuals named in complaints or correspondence
Categories of personal data may include:
- names, job titles and business contact details
- placement and vacancy records linked to named individuals
- invoicing and payment references
- the content of emails, call notes and helpdesk tickets that mention individuals
The Customer decides which systems are connected. The Supplier does not ask for special category data and the Customer agrees not to connect sources that hold it unless both parties have agreed this in writing first.
Obligations of the Supplier
The Supplier will:
- process personal data only on the Customer's documented instructions, including as set out in this agreement and the order form, unless the law requires otherwise, in which case it will tell the Customer first where it lawfully can
- make sure that everyone authorised to process the data is bound by a duty of confidentiality
- apply appropriate technical and organisational security measures, including access control, encryption in transit and at rest where the Customer's Snowflake account provides it, and logging of administrative access
- help the Customer respond to requests from individuals exercising their rights, by searching and exporting records on request
- help the Customer with impact assessments and consultations with the regulator where reasonably needed
- tell the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, with the information it then has
- keep a record of its processing activities for the Customer
Obligations of the Customer
The Customer will:
- make sure it has a lawful basis for the processing it instructs
- give the Supplier only lawful instructions
- tell individuals what it needs to tell them about the use of their data
- manage who in its organisation has access to the brain and keep user lists current
Sub-processors
The Customer gives general authorisation for the Supplier to use sub-processors needed to provide the service. The Supplier will keep an up-to-date list, give the Customer reasonable notice of any change, and allow the Customer to object on reasonable data protection grounds. The Supplier remains responsible for its sub-processors and will bind them to terms no less protective than those in this agreement.
International transfers
The brain runs inside the Customer's own Snowflake account, so data is held in the region the Customer has chosen for that account. The Supplier will not move the Customer's personal data outside that environment, or outside the United Kingdom, except on the Customer's instruction and with a lawful transfer mechanism in place.
Audit and information
The Supplier will make available the information reasonably needed to show compliance with this agreement and will allow audits by the Customer or an auditor the Customer appoints, on reasonable notice, during business hours and subject to sensible confidentiality terms.
Return and deletion
On ending of the service, the Supplier will remove its access to the Customer's Snowflake account and delete any copies of the Customer's personal data it holds outside that account. Data inside the Customer's own account remains under the Customer's control. The Supplier will confirm deletion in writing if asked.
Liability and governing law
Liability under this agreement is subject to the limits in the master agreement between the parties. This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Order of precedence
If this agreement conflicts with the master agreement or an order form on the handling of personal data, this agreement prevails.
Signatures
Signed by the authorised representatives of the parties on 19 Jun 2024.
| For Delancey Haig | For BB-Demo | |
|---|---|---|
| Name | Authorised signatory | Priya Raman |
| Title | Director, Delancey Haig | Account Executive, BB-Demo |
| Signature | Signed | Signed |
| Date | 19 Jun 2024 | 19 Jun 2024 |
Unusual terms
Current to 9 Oct 26- DPA prevails over master agreement and order form on personal data
- General authorisation for sub-processors
- Transfers restricted to the United Kingdom without instruction