Carnmoor Fleet Leasing - Data Processing Agreement (signed)

The Supplier provides the company brain: one AI-queryable layer over the Customer's business systems, built and run inside the Customer's own Snowflake account. The Customer intends to connect systems holding information about its corporate clients, their drivers, service desk queries and invoices, so that its corporate account managers, driver service desk and remarketing teams can see each client's fleet, queries and invoices together. Some of that information is personal data. The parties therefore agree the terms below.

Clause One: Definitions

Terms such as "controller", "processor", "data subject", "personal data", "personal data breach" and "processing" have the meanings given in the UK GDPR and the Data Protection Act. "Data Protection Law" means the UK GDPR, the Data Protection Act and any other law on the protection of personal data that applies to the processing under this Agreement. "Customer Personal Data" means personal data processed by the Supplier on behalf of the Customer under the Main Agreement.

Clause Two: Roles of the parties

The Customer is the controller of Customer Personal Data and the Supplier is its processor. The Customer is responsible for having a lawful basis for the processing and for giving data subjects the information they are entitled to.

Clause Three: Scope and instructions

The Supplier will process Customer Personal Data only on the Customer's documented instructions, which are set out in the Main Agreement, in this Agreement and in the configuration of connectors the Customer chooses to enable. The Supplier will tell the Customer if it believes an instruction breaches Data Protection Law.

The subject matter, nature and purpose of the processing are set out in Schedule One.

Clause Four: Location of data

The brain runs inside the Customer's Snowflake account, so Customer Personal Data stays in the environment the Customer controls. The Supplier will not move Customer Personal Data out of that environment except where the Customer instructs it to do so in writing. Any request for dedicated data residency is handled as an add-on under the Order Form.

Clause Five: Confidentiality and personnel

The Supplier will make sure that everyone authorised to process Customer Personal Data is bound by a duty of confidence, has been trained in data protection, and has access only where their role requires it.

Clause Six: Security

The Supplier will keep appropriate technical and organisational measures to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, disclosure or access. These measures are summarised in Schedule Two. The Supplier will keep them under review and will not reduce their overall level of protection during the term.

Clause Seven: Sub-processors

The Customer gives general authorisation for the Supplier to use sub-processors, on these conditions:

• the Supplier keeps a current list of sub-processors and gives the Customer reasonable notice of any addition or replacement;
• the Customer may object on reasonable data protection grounds, and the parties will then work in good faith to resolve the objection;
• the Supplier imposes on each sub-processor obligations no less protective than those in this Agreement and remains responsible for their performance.

Clause Eight: Assistance with data subject rights

Taking account of the nature of the processing, the Supplier will help the Customer respond to requests from data subjects to exercise their rights. If the Supplier receives such a request directly, it will pass it to the Customer promptly and will not respond except on the Customer's instruction.

Clause Nine: Personal data breaches

The Supplier will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as is then known, the nature of the breach, the data and data subjects affected, the likely consequences and the measures taken or proposed. The Supplier will cooperate with the Customer's investigation and with any notification the Customer must make.

Clause Ten: Assessments and prior consultation

The Supplier will give the Customer reasonable help with data protection impact assessments and with any consultation of a regulator that relates to the processing under this Agreement.

Clause Eleven: Audit

The Supplier will make available the information reasonably necessary to show compliance with this Agreement and will allow and contribute to audits by the Customer or an auditor the Customer appoints, on reasonable notice, during business hours and without unreasonable disruption to the Supplier's other customers.

Clause Twelve: Return and deletion

Because the data lives in the Customer's own Snowflake account, the Customer keeps control of it throughout the term. When the Main Agreement ends, the Supplier will, at the Customer's choice, delete the brain's derived indexes and any copies of Customer Personal Data it holds, or return them, and will confirm in writing once this is done, unless the law requires it to keep them.

Clause Thirteen: Liability and term

Liability under this Agreement is subject to the limits and exclusions in the Main Agreement. This Agreement takes effect on the date above and continues for as long as the Supplier processes Customer Personal Data on the Customer's behalf.

Clause Fourteen: Governing law

This Agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it.

Schedule One: Details of processing

Schedule Two: Security measures

• Processing inside the Customer's own Snowflake account, using the Customer's access controls and logging.
• Role-based access for Supplier staff, limited to what is needed to run and support the service.
• Encryption of data in transit and at rest.
• Separation of customer environments, so that one customer's data is never combined with another's.
• Documented incident response and breach notification procedure.
• Regular review of access rights and removal of access when staff change role or leave.

Signatures

This Agreement has been signed by the authorised signatories of the parties and is executed on 18 Nov 2025.

Customer Success Manager for the account: Amara Obi.