Penwortham Mutual - Data Processing Agreement (signed)
Documentexecuted Penwortham Mutual: documents · dpa · executed · 2026-05-14
Executed UK GDPR Data Processing Agreement between BB-Demo Limited (Processor) and Penwortham Mutual (Controller), effective 14 May 2026 under the Master Services Agreement of the same date. It states no price, availability or response-time terms.
What it says
What this says
Current to 12 Oct 26Executed UK GDPR Data Processing Agreement between BB-Demo Limited (Processor) and Penwortham Mutual (Controller), effective 14 May 2026 under the Master Services Agreement of the same date. It states no price, availability or response-time terms.
What it is: an executed DPA with effect from 14 May 2026, covering processing for the Company Brain platform under the Master Services Agreement dated 14 May 2026.
Commits: the Processor acts only on "documented instructions from the Controller", must not engage sub-processors without prior authorisation, and must not transfer Personal Data outside the UK without prior written authorisation.
Also binds the Processor to assist with data subject requests, delete or return data at the Controller's choice at the end of services, and allow audits and inspections.
Not settled: the document sets no price, service levels, notice period or renewal date. The Penwortham Mutual signature block reads only "Authorised Representative", so the evidence does not show who signed for the customer.
As found in this document
Current to 9 Oct 26- Date signed14 May 2026Source: object_read:doc_097_006
- Date start14 May 2026Source: object_read:doc_097_006
- Processing instructionsThe Processor shall process Personal Data only on documented instructions from the Controller and for no other purpose.The Processor shall process Personal Data only on documented instructions from the Controller and for no other purpose. · Source: object_read:doc_097_006
- Sub-processorsThe Processor shall not engage sub-processors without prior authorisation from the Controller.The Processor shall not engage sub-processors without prior authorisation from the Controller. · Source: object_read:doc_097_006
- International transfersThe Processor shall not transfer Personal Data outside the UK except with the Controller's prior written authorisation and in accordance with the UK GDPR.The Processor shall not transfer Personal Data outside the UK except with the Controller's prior written authorisation and in accordance with the UK GDPR. · Source: object_read:doc_097_006
- Deletion and returnThe Processor shall, at the Controller's choice, delete or return all Personal Data after the end of the provision of services, except where UK law requires storage.The Processor shall, at the Controller's choice, delete or return all Personal Data after the end of the provision of services, except where UK law requires storage. · Source: object_read:doc_097_006
The document
Body
Data Processing Agreement
Penwortham Mutual and BB-Demo Limited
Status: Executed
This Data Processing Agreement ("DPA") is entered into between BB-Demo Limited ("Processor") and Penwortham Mutual ("Controller") with effect from 14 May 2026, in accordance with the UK GDPR and Data Protection Act 2018.
1. Definitions
"Personal Data" means any information relating to an identified or identifiable natural person.
"Processing" means any operation performed on Personal Data including collection, storage, use, analysis and deletion.
"Processor" means BB-Demo Limited, which processes Personal Data on the Controller's instruction.
"Controller" means Penwortham Mutual, which determines the purposes and means of Processing.
2. Scope
This DPA covers the processing of Personal Data by the Processor in the course of providing the Company Brain platform under the Master Services Agreement dated 14 May 2026.
3. Processing Instructions
The Processor shall process Personal Data only on documented instructions from the Controller and for no other purpose. The Processor shall not process Personal Data for its own purposes.
4. Personnel Confidentiality
Read the whole document (2,881 characters)
The Processor ensures that persons authorised to process Personal Data have committed to confidentiality or are under an appropriate legal obligation of confidentiality.
5. Security Measures
The Processor implements technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Encryption at rest and in transit
- Access controls and authentication
- Regular security testing and vulnerability management
- Incident response procedures
- Staff security training
6. Sub-Processors
The Processor shall not engage sub-processors without prior authorisation from the Controller. The Processor remains liable to the Controller for the performance of any sub-processor.
7. Data Subject Rights
The Processor shall assist the Controller in fulfilling obligations to respond to data subject access requests and other rights requests under the UK GDPR.
8. Deletion and Return of Personal Data
The Processor shall, at the Controller's choice, delete or return all Personal Data after the end of the provision of services, except where UK law requires storage.
9. Audit and Inspection
The Processor shall make available to the Controller all information necessary to demonstrate compliance with the UK GDPR and allow for and contribute to audits and inspections by the Controller or its auditors.
10. International Transfers
The Processor shall not transfer Personal Data outside the UK except with the Controller's prior written authorisation and in accordance with the UK GDPR.
Signatures
Executed on 14 May 2026.
For BB-Demo Limited:
Matteo Ricci Account Executive
For Penwortham Mutual:
Authorised Representative