Brimscombe Energy - Data Processing Agreement (signed)

• Applicable Data Protection Law means the UK GDPR, the Data Protection Act and any other law on the processing of personal data that applies to either party.
• Personal Data, Processing, Controller, Processor, Data Subject and Personal Data Breach have the meanings given in Applicable Data Protection Law.
• Customer Environment means the Snowflake account owned or controlled by Brimscombe Energy in which the company brain is built and run.
• Connected Systems means the source systems that Brimscombe Energy chooses to connect to the company brain, for example its CRM, call recorder, helpdesk, accounting system and mailboxes.

Roles of the parties

Brimscombe Energy is the Controller of the Personal Data processed under this Agreement and BB-Demo is the Processor. BB-Demo will process Personal Data only on the documented instructions of Brimscombe Energy, which are set out in this Agreement and in any written configuration the parties agree. If BB-Demo believes an instruction breaches Applicable Data Protection Law, it will tell Brimscombe Energy promptly.

Subject matter and purpose

BB-Demo will process Personal Data only to build, run, support and improve the company brain for Brimscombe Energy, so that its teams can search and ask questions across the data in the Connected Systems. BB-Demo will not process the data for its own purposes, will not sell it and will not use it to train models for other customers.

Categories of data and Data Subjects

Obligations of BB-Demo

BB-Demo will:

• process Personal Data only as instructed by Brimscombe Energy;
• ensure that its staff who access Personal Data are bound by a duty of confidentiality and have been trained in data protection;
• keep Personal Data inside the Customer Environment and not copy it out of that environment, except where Brimscombe Energy instructs otherwise in writing;
• apply access controls so that only named BB-Demo staff who need access for support or delivery can reach the Customer Environment, and record that access;
• assist Brimscombe Energy, taking account of the nature of the processing, in responding to requests from Data Subjects;
• assist Brimscombe Energy with impact assessments and consultations with the regulator where they relate to the company brain.

Security

BB-Demo will maintain technical and organisational measures appropriate to the risk, including:

• encryption of data in transit and at rest, relying on the controls of the Customer Environment;
• role-based access, with single sign-on and automated user provisioning where Brimscombe Energy has enabled them;
• logging of administrative actions and regular review of those logs;
• separation of duties between development and support access;
• documented procedures for vulnerability handling and for restoring service.

Brimscombe Energy remains responsible for the security of the Customer Environment itself and of the Connected Systems.

Sub-processors

Brimscombe Energy gives general authorisation for BB-Demo to use sub-processors. BB-Demo will keep a current list, give Brimscombe Energy notice of any intended addition or replacement and allow a reasonable period for objection. BB-Demo will bind each sub-processor to data protection terms no less protective than those in this Agreement and remains responsible for their performance. Because the company brain runs inside the Customer Environment, the Snowflake platform acts under Brimscombe Energy's own arrangements with it.

International transfers

BB-Demo will not transfer Personal Data outside the United Kingdom, or to a country without an adequacy decision, unless Brimscombe Energy has agreed and an appropriate transfer mechanism is in place. Any dedicated data residency requirement will be recorded in the commercial order and not in this Agreement.

Personal Data Breach

BB-Demo will notify Brimscombe Energy without undue delay after becoming aware of a Personal Data Breach affecting data under this Agreement. The notice will describe what is known about the nature of the breach, the data and Data Subjects concerned, the likely consequences and the steps taken or proposed. BB-Demo will cooperate with Brimscombe Energy's investigation and will not make public statements about the breach naming Brimscombe Energy without its agreement.

Audit and information

BB-Demo will make available the information reasonably needed to show compliance with this Agreement and will allow audits by Brimscombe Energy or an auditor it appoints, on reasonable notice, during business hours and subject to confidentiality. Audits will be arranged so as to limit disruption to either party.

Return and deletion

On termination of the services, or earlier on written request, BB-Demo will delete or return Personal Data and remove its own access to the Customer Environment, unless law requires retention. Because the data sits in Brimscombe Energy's own Snowflake account, Brimscombe Energy keeps full control of its data at all times. BB-Demo will confirm deletion of any derived artefacts it holds in writing on request.

Liability and order of precedence

Liability under this Agreement is subject to the limits in the master agreement between the parties, once signed. If this Agreement conflicts with any other document on the processing of Personal Data, this Agreement prevails.

Governing law

This Agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it.

Contacts

Signatures

Signed by the authorised representatives of the parties on 27 Dec 2024.