Vellacott Payments - Data Processing Agreement (signed)
Documentexecuted Vellacott Payments: documents · dpa · executed · 2025-06-26
Executed DPA effective 26 Jun 2025 between Vellacott Payments (controller) and BB-Demo (processor). It keeps Customer Data inside the customer's own Snowflake account. It states no price, availability or response times.
What it says
What this says
Current to 11 Oct 26Executed DPA effective 26 Jun 2025 between Vellacott Payments (controller) and BB-Demo (processor). It keeps Customer Data inside the customer's own Snowflake account. It states no price, availability or response times.
What it is: an executed data processing agreement that forms part of the master agreement and order form. Vellacott Payments is the controller and BB-Demo the processor, signed by Lewis Kerr for BB-Demo on 26 Jun 2025.
Commits: BB-Demo "will not move Customer Data outside that environment, or to another country, without the Customer's prior written agreement". It must notify breaches "without undue delay" and delete or return data on termination or expiry.
Unusual: the sub-processor clause is a general authorisation with notice and a right to object. If the DPA conflicts with the master agreement on personal data, the DPA prevails.
Not settled: no price, service levels, renewal date or term length. The customer signatory is shown only as "Authorised signatory", with no named person.
As found in this document
Current to 9 Oct 26- Date signed26 Jun 2025Source: object_read:doc_084_006
- Date start26 Jun 2025Source: object_read:doc_084_006
- Data locationThe Supplier will not move Customer Data outside that environment, or to another country, without the Customer's prior written agreement.The Supplier will not move Customer Data outside that environment, or to another country, without the Customer's prior written agreement. · Source: object_read:doc_084_006
- Breach notificationThe Supplier will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data.The Supplier will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data. · Source: object_read:doc_084_006
- Return and deletionOn termination or expiry of the Services, and at the Customer's choice, the Supplier will delete or return Customer DataOn termination or expiry of the Services, and at the Customer's choice, the Supplier will delete or return Customer Data · Source: object_read:doc_084_006
- Sub-processorsThe Supplier will give the Customer notice of any intended addition or replacement so the Customer can object on reasonable grounds.The Supplier will give the Customer notice of any intended addition or replacement so the Customer can object on reasonable grounds. · Source: object_read:doc_084_006
- Auditon reasonable notice and during business hours, subject to confidentialityon reasonable notice and during business hours, subject to confidentiality · Source: object_read:doc_084_006
The document
Body
Vellacott Payments - Data Processing Agreement (signed)
Status: Executed Effective date: 26 Jun 2025
This Data Processing Agreement (the "DPA") is made between Vellacott Payments, an FCA-authorised e-money and payments firm based in London (the "Customer"), and BB-Demo, a London data business (the "Supplier"). It forms part of the master agreement and order form between the parties and applies to all personal data the Supplier handles when providing the company brain to the Customer.
Clause one: Definitions
Terms such as "personal data", "processing", "controller", "processor" and "data subject" have the meanings given in UK data protection law. "Services" means the company brain and the implementation and support services described in the order form. "Customer Data" means any personal data processed by the Supplier on the Customer's behalf.
Clause two: Roles and scope
Read the whole document (5,284 characters)
- The Customer is the controller of Customer Data and the Supplier is its processor.
- The Supplier processes Customer Data only to provide the Services and only on the Customer's documented instructions, including this DPA and the order form.
- The subject matter, nature and purpose of processing are the connection of the Customer's business systems to the brain and the answering of queries over that data by the Customer's authorised users.
Clause three: Categories of data and data subjects
| Item | Description |
|---|---|
| Data subjects | The Customer's employees and contractors, its clients and their representatives, merchants, and individuals who contact the Customer, including complainants |
| Categories of data | Contact details, account and relationship records, call and email content, support and complaint records, and usage data from connected systems |
| Special category data | None is intended to be processed. If the Customer connects a source that holds such data, it will tell the Supplier first |
| Duration | The term of the order form and any period needed to return or delete data under clause nine |
Clause four: Where the data lives
The company brain is built and run inside the Customer's own Snowflake account. Customer Data therefore stays within an environment the Customer controls. The Supplier will not move Customer Data outside that environment, or to another country, without the Customer's prior written agreement.
Clause five: Security
The Supplier will keep appropriate technical and organisational measures in place to protect Customer Data, including:
- access limited to staff who need it, bound by confidentiality duties;
- role-based access and logging of administrative actions;
- encryption of data in transit and at rest within the Customer's Snowflake account;
- regular review of measures, and support for the Customer's own security review.
Clause six: Sub-processors
The Customer gives general authorisation for the Supplier to use sub-processors. The Supplier will give the Customer notice of any intended addition or replacement so the Customer can object on reasonable grounds. The Supplier remains responsible for its sub-processors and will bind them to obligations no less protective than this DPA.
Clause seven: Assistance and data subject rights
The Supplier will, taking account of the nature of the processing, help the Customer to respond to requests from data subjects, and to meet its obligations on security, impact assessments and consultation with the regulator. If the Supplier receives a request directly from a data subject, it will pass it to the Customer without undue delay and will not respond itself unless instructed.
Clause eight: Personal data breaches
The Supplier will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data. The notice will describe the nature of the breach, the data and people affected where known, the likely consequences and the steps taken or proposed. The Supplier will cooperate with the Customer's investigation and with any notification the Customer must make.
Clause nine: Return and deletion
On termination or expiry of the Services, and at the Customer's choice, the Supplier will delete or return Customer Data and remove its access to the Customer's Snowflake environment, unless the law requires retention. The Supplier will confirm completion in writing on request.
Clause ten: Audit
The Supplier will make available the information reasonably needed to show compliance with this DPA and will allow and contribute to audits by the Customer or an auditor it appoints, on reasonable notice and during business hours, subject to confidentiality.
Clause eleven: General
- If this DPA conflicts with the master agreement on the handling of personal data, this DPA prevails.
- This DPA is governed by the law that governs the master agreement, and the courts named there have jurisdiction.
- Changes must be in writing and signed by both parties.
Signatures
Signed by the duly authorised representatives of the parties on 26 Jun 2025.
| For Vellacott Payments | For BB-Demo | |
|---|---|---|
| Name | Authorised signatory | Lewis Kerr |
| Title | Authorised signatory of Vellacott Payments | Account Executive |
| Date | 26 Jun 2025 | 26 Jun 2025 |
Unusual terms
Current to 9 Oct 26- DPA prevails over master agreement on personal data
- General sub-processor authorisation with right to object
- Customer Data stays in customer's Snowflake account