Pentreath Cold Chain - Data Processing Agreement (signed)
Documentexecuted Pentreath Cold Chain: documents · dpa · executed · 2023-12-14
Executed Data Processing Agreement signed 14 Dec 2023 between Pentreath Cold Chain (Controller) and BB-Demo (Processor), covering the company brain on the Growth tier. It states no price, service levels or renewal date.
What it says
What this says
Current to 11 Oct 26Executed Data Processing Agreement signed 14 Dec 2023 between Pentreath Cold Chain (Controller) and BB-Demo (Processor), covering the company brain on the Growth tier. It states no price, service levels or renewal date.
What it is: an executed DPA that "sits alongside the Master Services Agreement signed by the same parties". It sets out how BB-Demo handles personal data for the company brain on the Growth tier.
Commits: BB-Demo processes data only on documented instructions, applies access control, encryption and logging, and tells the Controller of a breach "without undue delay". No sub-processor without prior written authorisation, and no transfer outside the United Kingdom without written agreement.
Unusual: nothing off standard. The brain runs inside the Controller's own Snowflake account, and the Processor does not move data into its own environment.
Not settled: no price, availability, support response time or refresh deadline. The agreement runs for as long as processing continues under the MSA, so it triggers no renewal. The signatory for Pentreath Cold Chain is not named.
As found in this document
Current to 9 Oct 26- Date signed14 Dec 2023Source: object_read:doc_081_006
- Processing instructionsprocess personal data only on the Controller's documented instructionsprocess personal data only on the Controller's documented instructions · Source: object_read:doc_081_006
- Breach notificationtell the Controller without undue delay after becoming aware of a personal data breachtell the Controller without undue delay after becoming aware of a personal data breach · Source: object_read:doc_081_006
- Sub-processorsnot engage a sub-processor for the Controller's personal data without the Controller's prior written authorisationnot engage a sub-processor for the Controller's personal data without the Controller's prior written authorisation · Source: object_read:doc_081_006
- International transfersnot transfer the Controller's personal data outside the United Kingdom unless the Controller has agreed in writing and a lawful transfer mechanism is in placenot transfer the Controller's personal data outside the United Kingdom unless the Controller has agreed in writing and a lawful transfer mechanism is in place · Source: object_read:doc_081_006
- Return and deletionat the Controller's choice, return or delete the personal data and confirm in writingat the Controller's choice, return or delete the personal data and confirm in writing · Source: object_read:doc_081_006
- Durationcontinues for as long as the Processor processes personal data for the Controller under the Master Services Agreementcontinues for as long as the Processor processes personal data for the Controller under the Master Services Agreement · Source: object_read:doc_081_006
The document
Body
Pentreath Cold Chain - Data Processing Agreement (signed)
Status: Executed Version: 1 Signed: 14 Dec 2023
Parties and purpose
This Data Processing Agreement is made between Pentreath Cold Chain, of Bristol ("the Controller"), and BB-Demo, a London data business ("the Processor").
It sits alongside the Master Services Agreement signed by the same parties and sets out how the Processor handles personal data on the Controller's behalf when providing the company brain.
Definitions
Terms such as personal data, processing, data subject and personal data breach have the meanings given in the UK data protection legislation.
Subject matter and nature of processing
Read the whole document (3,915 characters)
- Subject matter: provision of the company brain on the Growth tier, including its implementation and support.
- Nature: the brain indexes, organises and answers questions over data held in the systems the Controller connects to it, such as its CRM, helpdesk, email and finance systems.
- Location: the brain is built and run inside the Controller's own Snowflake account. The Processor does not move the Controller's data into a separate environment of its own for the purpose of running the service.
- Data subjects: the Controller's employees, its clients' contacts and other individuals who appear in the connected systems.
- Types of data: business contact details, correspondence, ticket and order records, contract review records and similar operational data.
Processor obligations
The Processor will:
- process personal data only on the Controller's documented instructions, which include the Master Services Agreement and this agreement;
- make sure that everyone authorised to process the data is bound by confidentiality;
- apply appropriate technical and organisational measures, including access control, encryption and logging of administrative access;
- help the Controller to respond to requests from data subjects, within a reasonable time;
- tell the Controller without undue delay after becoming aware of a personal data breach, with the information it holds about it;
- help the Controller with data protection impact assessments and with any consultation with the regulator where the processing requires it.
Controller obligations
The Controller confirms that it has a lawful basis for the data it connects to the brain, and that it has given any notices to data subjects that the law requires. It will connect only the systems and data it is entitled to use for this purpose.
Sub-processors
The Processor will not engage a sub-processor for the Controller's personal data without the Controller's prior written authorisation. Where one is authorised, the Processor will impose equivalent data protection obligations on it and remain responsible for its performance.
International transfers
The Processor will not transfer the Controller's personal data outside the United Kingdom unless the Controller has agreed in writing and a lawful transfer mechanism is in place.
Audit
The Processor will make available the information reasonably needed to show that it complies with this agreement, and will allow audits by the Controller or its appointed auditor on reasonable notice and during business hours.
Return and deletion
When the services end, the Processor will, at the Controller's choice, return or delete the personal data it holds on the Controller's behalf and confirm in writing that it has done so, unless the law requires it to be kept.
Duration
This agreement continues for as long as the Processor processes personal data for the Controller under the Master Services Agreement.
Signatures
| For Pentreath Cold Chain | For BB-Demo |
|---|---|
| Signed: authorised signatory | Signed: Tom Ashdown |
| Title: authorised signatory for the Controller | Title: Account Executive |
| Date: 14 Dec 2023 | Date: 14 Dec 2023 |