Garrow Lusk - Data Processing Agreement (signed)
Documentexecuted Garrow Lusk · dpa · executed · 2023-06-08
Executed data processing agreement signed on 8 Jun 2023 between Garrow Lusk as controller and BB-Demo Limited as processor for the Company Brain service. It runs for the Master Services Agreement term plus 30 days. It states no price or service levels.
What it says
What this says
Current to 11 Oct 26Executed data processing agreement signed on 8 Jun 2023 between Garrow Lusk as controller and BB-Demo Limited as processor for the Company Brain service. It runs for the Master Services Agreement term plus 30 days. It states no price or service levels.
What it is: a data processing agreement naming Garrow Lusk as "Data Controller" and BB-Demo Limited as "Data Processor". Nell Ashcombe signed for BB-Demo on 8 Jun 2023; Garrow Lusk's signatory appears only as "Authorised Representative".
Commits: the processor to security measures "including encryption, access controls and incident response procedures", to no sub-processors "without prior written consent", and to secure deletion on termination unless law requires retention.
Unusual: nothing off the standard terms. Processing ends no later than 30 days after termination, which is the stated tail.
Not settled: the document names no price, service levels, breach notification period or sub-processor list. It does not name the Garrow Lusk signatory or say which Master Services Agreement it sits under, and it has no renewal date.
As found in this document
Current to 9 Oct 26- Date signed8 Jun 2023Source: object_read:doc_093_005
- Durationfor the duration of the parties' Master Services Agreement and for 30 days thereafterfor the duration of the parties' Master Services Agreement and for 30 days thereafter · Source: object_read:doc_093_005
- Processing after terminationfor no longer than 30 days after service termination, unless law requires retentionfor no longer than 30 days after service termination, unless law requires retention · Source: object_read:doc_093_005
- Securitytechnical and organisational security measures appropriate to the risk, including encryption, access controls and incident response procedurestechnical and organisational security measures appropriate to the risk, including encryption, access controls and incident response procedures · Source: object_read:doc_093_005
- Sub-processingwill not engage sub-processors without prior written consent from the Controllerwill not engage sub-processors without prior written consent from the Controller · Source: object_read:doc_093_005
- Deletionsecurely delete all Personal Data, unless law requires retentionsecurely delete all Personal Data, unless law requires retention · Source: object_read:doc_093_005
The document
Body
Garrow Lusk - Data Processing Agreement (signed)
1. Definitions
"Personal Data" means any information relating to an identified or identifiable natural person.
"Processing" means any operation performed on Personal Data.
"Data Controller" means Garrow Lusk, which determines the purposes and means of Processing.
"Data Processor" means BB-Demo Limited, which processes Personal Data on behalf of the Controller.
2. Subject Matter and Duration
The Processor processes Personal Data on behalf of the Controller in connection with the provision of the Company Brain service. This agreement applies for the duration of the parties' Master Services Agreement and for 30 days thereafter.
3. Nature and Purpose of Processing
The Processor will process Personal Data to enable the Controller to query and analyse business data through the Company Brain interface, including customer records, communication logs and transaction details.
4. Type of Personal Data
Personal Data may include:
- Employee names and contact information
- Customer and client names and contact information
- Call recordings and email metadata
- Transaction and financial records
Read the whole document (2,386 characters)
5. Categories of Data Subject
Data subjects may include the Controller's employees, customers, clients and suppliers.
6. Duration of Processing
The Processor will process Personal Data for the duration of the service and for no longer than 30 days after service termination, unless law requires retention.
7. Data Security
The Processor will implement and maintain technical and organisational security measures appropriate to the risk, including encryption, access controls and incident response procedures.
8. Sub-processing
The Processor will not engage sub-processors without prior written consent from the Controller.
9. Data Subject Rights
The Processor will, upon reasonable request from the Controller, assist the Controller in fulfilling data subject rights requests, including access, rectification, erasure and restriction of processing.
10. Deletion and Return of Data
On termination of the service, the Processor will securely delete all Personal Data, unless law requires retention.
Signatures
For BB-Demo Limited:
Nell Ashcombe
Chief Executive Officer and Co-founder
Date: 8 June 2023
For Garrow Lusk:
Authorised Representative
Date: 8 June 2023