Saltdean Hart Insurance Brokers - Data Processing Agreement (signed)
Documentexecuted Saltdean Hart Insurance Brokers: documents · dpa · executed · 2024-11-08
Executed data processing agreement dated 8 Nov 2024 between Saltdean Hart Insurance Brokers (Controller) and BB-Demo (Processor). It keeps data inside the Controller's Snowflake account. It states no price, availability or response-time figures.
What it says
What this says
Current to 11 Oct 26Executed data processing agreement dated 8 Nov 2024 between Saltdean Hart Insurance Brokers (Controller) and BB-Demo (Processor). It keeps data inside the Controller's Snowflake account. It states no price, availability or response-time figures.
What it is: an executed DPA, version one, made on Friday 8 Nov 2024. It forms part of the Master Services Agreement and the order form and applies "whenever the Processor handles personal data on the Controller's behalf".
Commits: BB-Demo must act only on documented instructions, keep the data "inside the Controller's Snowflake account", tell the Controller in writing before changing a sub-processor, and report a breach "without undue delay". On exit it must return or delete the data and confirm in writing.
Unusual: no fixed breach-notification hours and no deletion deadline are stated. Transfers outside the United Kingdom need the Controller's written agreement.
Not settled: the document gives no price, service levels, renewal date or term. The Controller's signatory is unnamed, so their role is not shown. Commercial terms sit in the order form, which is not this document.
As found in this document
Current to 9 Oct 26- Date signed8 Nov 2024Source: object_read:doc_089_006
- Processing instructionsprocess personal data only on the Controller's documented instructionsprocess personal data only on the Controller's documented instructions · Source: object_read:doc_089_006
- Data locationkeep the data inside the Controller's Snowflake account and not move it elsewhere without written agreementkeep the data inside the Controller's Snowflake account and not move it elsewhere without written agreement · Source: object_read:doc_089_006
- Sub-processorstell the Controller in writing before adding or replacing a sub-processortell the Controller in writing before adding or replacing a sub-processor · Source: object_read:doc_089_006
- Breach notificationnotify the Controller without undue delay after becoming aware of a personal data breachnotify the Controller without undue delay after becoming aware of a personal data breach · Source: object_read:doc_089_006
- Auditallow reasonable audits by the Controller or its appointed auditor, on reasonable notice and during normal business hoursallow reasonable audits by the Controller or its appointed auditor, on reasonable notice and during normal business hours · Source: object_read:doc_089_006
- Return and deletionat the Controller's choice, return or delete the personal data and confirm in writingat the Controller's choice, return or delete the personal data and confirm in writing · Source: object_read:doc_089_006
The document
Body
Data Processing Agreement
Executed copy, version one
This Data Processing Agreement is made on Friday 8 Nov 2024 between:
- Saltdean Hart Insurance Brokers, an insurance broker based in Brighton (the "Controller"); and
- BB-Demo, a data business based in London (the "Processor").
It forms part of the Master Services Agreement and the order form agreed between the parties and applies whenever the Processor handles personal data on the Controller's behalf.
First: Purpose and scope
The Processor provides the company brain, a queryable layer over the Controller's connected business systems, built and run inside the Controller's own Snowflake account. In doing so the Processor may process personal data of the Controller's staff, clients, policyholders and claimants. The Processor will process that data only to deliver the services described in the order form.
Second: Roles
The Controller decides the purposes and means of processing. The Processor acts only on the Controller's documented instructions, which are set out in this agreement, the order form and any written instruction given by the Controller's authorised contacts.
Read the whole document (4,537 characters)
Third: Categories of data and data subjects
| Item | Description |
|---|---|
| Data subjects | Employees and contractors of the Controller; its clients, prospects, policyholders and claimants |
| Categories of data | Contact details, policy and claim references, call and email content, support tickets, usage data and finance records held in connected systems |
| Special category data | Only where it appears incidentally in claims or call content; the Controller remains responsible for deciding what is connected |
| Duration | The term of the services, plus any agreed exit period |
Fourth: Processor obligations
The Processor will:
- process personal data only on the Controller's documented instructions;
- ensure that everyone authorised to process the data is bound by confidentiality;
- keep appropriate technical and organisational measures in place to protect the data;
- keep the data inside the Controller's Snowflake account and not move it elsewhere without written agreement;
- assist the Controller, as far as reasonably possible, in responding to requests from data subjects;
- assist the Controller with security, impact assessments and consultation with the regulator where relevant.
Fifth: Sub-processors
The Controller gives general authorisation for the Processor to use sub-processors needed to run the services. The Processor will tell the Controller in writing before adding or replacing a sub-processor and will give the Controller a fair opportunity to object. The Processor remains responsible for its sub-processors and will bind them to terms no less protective than these.
Sixth: Personal data breaches
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and will give enough detail for the Controller to meet its own notification duties. The Processor will take reasonable steps to contain and remedy the breach.
Seventh: International transfers
The data stays in the region where the Controller's Snowflake account is hosted. If any transfer outside the United Kingdom becomes necessary, the Processor will only make it with the Controller's written agreement and an appropriate lawful transfer mechanism.
Eighth: Audit and information
The Processor will make available the information needed to show compliance with this agreement and will allow reasonable audits by the Controller or its appointed auditor, on reasonable notice and during normal business hours, without disrupting other customers.
Ninth: Return and deletion
On termination or expiry of the services, the Processor will, at the Controller's choice, return or delete the personal data it holds on the Controller's behalf, and will confirm in writing that it has done so, unless the law requires continued storage.
Tenth: General
This agreement is governed by the law of England and Wales. If it conflicts with the Master Services Agreement on the handling of personal data, this agreement prevails.
Signatures
| For the Controller | For the Processor | |
|---|---|---|
| Organisation | Saltdean Hart Insurance Brokers | BB-Demo |
| Name | Authorised signatory | Priya Raman |
| Title | Authorised signatory of the Controller | Account Executive |
| Date | 8 Nov 2024 | 8 Nov 2024 |
Customer success contact at BB-Demo: Esther Quaye.
Unusual terms
Current to 9 Oct 26- DPA prevails over MSA on personal data
- No fixed breach notification time
- Transfers outside the UK need written agreement