Grisedale Search & Selection - Data Processing Agreement (signed)
Documentexecuted Grisedale Search & Selection: documents · dpa · executed · 2024-04-17
Executed DPA signed 17 Apr 2024 under the Master Services Agreement, with Grisedale Search & Selection as Controller and BB-Demo as Processor. It states no availability, P1 response, price or other commercial terms.
What it says
What this says
Current to 11 Oct 26Executed DPA signed 17 Apr 2024 under the Master Services Agreement, with Grisedale Search & Selection as Controller and BB-Demo as Processor. It states no availability, P1 response, price or other commercial terms.
What it is: an executed data processing agreement, version 1, signed 17 Apr 2024. It sits "under the Master Services Agreement signed on the same date".
Commits: BB-Demo processes personal data "only on the Controller's documented instructions" and must tell the Controller "without undue delay" after becoming aware of a personal data breach. It will allow "reasonable audits by the Controller on notice during business hours".
Unusual: nothing off standard terms. Data stays in the Controller's own Snowflake account and region, and BB-Demo will not move it without written instruction.
Not settled: the document gives no sub-processor list, no breach notification time limit in hours, no service levels, no price and no end date. The Controller signatory is named only as "Authorised signatory", title Director.
As found in this document
Current to 9 Oct 26- Date signed17 Apr 2024Source: object_read:doc_082_005
- Processing instructionsprocess personal data only on the Controller's documented instructions, which include the Master Services Agreement and this agreementprocess personal data only on the Controller's documented instructions, which include the Master Services Agreement and this agreement · Source: object_read:doc_082_005
- Breach notificationtell the Controller without undue delay after becoming aware of a personal data breachtell the Controller without undue delay after becoming aware of a personal data breach · Source: object_read:doc_082_005
- Data locationThe Processor will not move it elsewhere without the Controller's written instruction.The Processor will not move it elsewhere without the Controller's written instruction. · Source: object_read:doc_082_005
- Auditallow reasonable audits by the Controller on notice during business hoursallow reasonable audits by the Controller on notice during business hours · Source: object_read:doc_082_005
- Return and deletionstop processing and remove the brain from the Controller's accountstop processing and remove the brain from the Controller's account · Source: object_read:doc_082_005
- Termlasts for as long as the Processor processes personal data for the Controller under the Master Services Agreementlasts for as long as the Processor processes personal data for the Controller under the Master Services Agreement · Source: object_read:doc_082_005
The document
Body
Grisedale Search & Selection - Data Processing Agreement (signed)
Status: Executed Version: 1 Signed: 17 Apr 2024
Parties
This Data Processing Agreement sits under the Master Services Agreement signed on the same date between:
- Grisedale Search & Selection, Manchester (the "Controller"); and
- BB-Demo, London (the "Processor").
Definitions
Terms such as personal data, processing, data subject and personal data breach have the meaning given to them in UK data protection law.
Subject matter and purpose
The Processor provides the company brain to the Controller: a layer that lets the Controller's consultants and operations manager see client accounts, open roles and client complaints in one place. The Processor processes personal data only to provide that service.
Nature of the processing
- The brain is built and run inside the Controller's own Snowflake account.
- The Processor connects to the systems the Controller chooses to connect under the order form.
- Processing includes reading, indexing, storing, searching and displaying data within that account.
Categories of data and data subjects
Read the whole document (3,492 characters)
| Category | Examples |
|---|---|
| Data subjects | The Controller's consultants and staff, and contacts at the Controller's clients |
| Personal data | Names, work contact details, role and account information, notes and complaint records held in connected systems |
The Controller decides which systems and data to connect and remains responsible for the lawfulness of that choice.
Obligations of the Processor
The Processor will:
- process personal data only on the Controller's documented instructions, which include the Master Services Agreement and this agreement;
- keep personal data confidential and ensure that anyone authorised to process it is bound by confidentiality;
- apply appropriate technical and organisational security measures;
- help the Controller respond to requests from data subjects;
- tell the Controller without undue delay after becoming aware of a personal data breach; and
- help the Controller with impact assessments and consultations with the regulator where reasonably needed.
Sub-processors
The Processor will use sub-processors only where necessary to provide the service, will bind them to terms no less protective than these, and remains responsible for their performance. The Controller may ask for the current list at any time.
Location of data
Because the brain runs inside the Controller's own Snowflake account, the Controller's data stays within that account and in the region the Controller has chosen. The Processor will not move it elsewhere without the Controller's written instruction.
Return and deletion
When the service ends, the Processor will stop processing and remove the brain from the Controller's account. The Controller keeps its own source data in its own systems throughout.
Audit
The Processor will provide the information reasonably needed to show compliance with this agreement and will allow reasonable audits by the Controller on notice during business hours.
Term
This agreement lasts for as long as the Processor processes personal data for the Controller under the Master Services Agreement.
Signatures
| For BB-Demo (Processor) | For Grisedale Search & Selection (Controller) | |
|---|---|---|
| Name | Priya Raman | Authorised signatory |
| Title | Account Executive | Director |
| Date | 17 Apr 2024 | 17 Apr 2024 |