Kelvinhaugh Pension Services - Data Processing Agreement (signed)
Documentexecuted Kelvinhaugh Pension Services: documents · dpa · executed · 2024-01-26
Executed data processing agreement, effective 26 Jan 2024, under the Master Services Agreement of the same date. BB-Demo is Processor for the Starter tier. It states no price, service levels or renewal date.
What it says
What this says
Current to 11 Oct 26Executed data processing agreement, effective 26 Jan 2024, under the Master Services Agreement of the same date. BB-Demo is Processor for the Starter tier. It states no price, service levels or renewal date.
What it is: an executed DPA in which Kelvinhaugh Pension Services is Controller and BB-Demo is Processor. It sits under the Master Services Agreement signed on the same date and prevails on personal data if the two conflict.
Commits: BB-Demo will process data "only on the documented instructions of the Controller" and will not engage another processor without prior written authorisation. It must tell the Controller of a breach "without undue delay" and return or delete data when the services end.
Unusual: nothing off the standard terms. Because the brain runs in the Controller's own Snowflake account, data stays there unless the Controller instructs otherwise in writing.
Not settled: no price, availability, response times, connector dates, term or renewal date. The Controller's signatory is shown only as "Authorised signatory of the Controller", with no name. Tom Ashdown signed for BB-Demo.
As found in this document
Current to 9 Oct 26- Date signed26 Jan 2024Source: object_read:doc_088_005
- Date start26 Jan 2024Source: object_read:doc_088_005
- Processing instructionsonly on the documented instructions of the Controlleronly on the documented instructions of the Controller · Source: object_read:doc_088_005
- Sub-processorsnot engage another processor for the Controller's personal data without the Controller's prior written authorisationnot engage another processor for the Controller's personal data without the Controller's prior written authorisation · Source: object_read:doc_088_005
- Breach notificationtell the Controller without undue delay after becoming aware of a personal data breach affecting its datatell the Controller without undue delay after becoming aware of a personal data breach affecting its data · Source: object_read:doc_088_005
- Location of processingwill not move the Controller's personal data outside that account except on the Controller's written instructionwill not move the Controller's personal data outside that account except on the Controller's written instruction · Source: object_read:doc_088_005
- Return and deletionat the Controller's choice, return or delete the personal data it holds and confirm that it has done soat the Controller's choice, return or delete the personal data it holds and confirm that it has done so · Source: object_read:doc_088_005
- Auditallow and contribute to reasonable audits, on reasonable notice and during normal business hoursallow and contribute to reasonable audits, on reasonable notice and during normal business hours · Source: object_read:doc_088_005
The document
Body
Kelvinhaugh Pension Services - Data Processing Agreement (signed)
Status: Executed. Version 1.
Effective date: Friday 26 January 2024
This Data Processing Agreement sits under the Master Services Agreement signed by the same parties on the same date. If the two documents conflict on the handling of personal data, this agreement prevails.
Parties
- Kelvinhaugh Pension Services, a third-party administrator of pension schemes, based in Glasgow ("the Controller").
- BB-Demo, a London data business that provides the company brain ("the Processor").
Subject matter and purpose
The Processor provides the company brain to the Controller under the Starter tier. The brain is built and run inside the Controller's own Snowflake account and gives the Controller's scheme-relationship managers a single layer to search and ask questions across the systems the Controller chooses to connect.
The Processor will process personal data only to provide that service and only on the documented instructions of the Controller.
Roles
Read the whole document (3,794 characters)
The Controller decides the purposes and means of processing. The Processor acts on the Controller's behalf. Each party will comply with the data protection law that applies to it.
Categories of data and data subjects
The data processed depends on the systems the Controller connects. It may include:
- contact and correspondence details of the Controller's staff and of scheme employers' contacts;
- records held in the Controller's CRM, call recordings, emails and helpdesk tickets that relate to those contacts;
- information about scheme members only to the extent that it appears in the connected sources.
The Controller is responsible for deciding which sources are connected and for the lawfulness of that decision.
Processor obligations
The Processor will:
- process personal data only on the Controller's documented instructions;
- make sure that everyone it authorises to process the data is bound by a duty of confidence;
- keep appropriate technical and organisational measures in place to protect the data;
- help the Controller to respond to requests from data subjects, taking account of the nature of the processing;
- tell the Controller without undue delay after becoming aware of a personal data breach affecting its data;
- help the Controller with impact assessments and consultations with the regulator where reasonably needed.
Location of processing
Because the brain runs inside the Controller's own Snowflake account, the data stays where the Controller has chosen to hold it. The Processor will not move the Controller's personal data outside that account except on the Controller's written instruction.
Sub-processors
The Processor will not engage another processor for the Controller's personal data without the Controller's prior written authorisation. Where it does so, it will impose the same data protection obligations on that party and remain responsible for its performance.
Audit and information
The Processor will give the Controller the information reasonably needed to show compliance with this agreement and will allow and contribute to reasonable audits, on reasonable notice and during normal business hours.
Return and deletion
When the services end, the Processor will, at the Controller's choice, return or delete the personal data it holds and confirm that it has done so, unless the law requires it to keep a copy.
Governing law
This agreement is governed by the law of England and Wales.
Signatures
Signed for and on behalf of Kelvinhaugh Pension Services
- Title: Authorised signatory of the Controller
- Date: 26 January 2024
Signed for and on behalf of BB-Demo
- Name: Tom Ashdown
- Title: Account Executive
- Date: 26 January 2024