Ashwell Mercer Interiors - Data Processing Agreement (signed)

• Data Protection Law means the UK GDPR, the Data Protection Act and any other law on the protection of personal data that applies to the processing under this DPA.
• Personal Data, Controller, Processor, Data Subject, Personal Data Breach and Processing have the meanings given in Data Protection Law.
• Customer Data means the Personal Data that BG-Demo processes on behalf of the Customer in providing B-Glass.
• Connected Systems means the Customer's own systems that the Customer chooses to connect to B-Glass, such as its CRM, call recorder, mailboxes, helpdesk, accounting system and shared drive.
• Customer Snowflake Account means the Snowflake account owned and controlled by the Customer, inside which B-Glass runs.

Two. Roles and scope

The Customer is the Controller and BG-Demo is the Processor of Customer Data. BG-Demo will process Customer Data only to provide, support and maintain B-Glass for the Customer, and only on the Customer's documented instructions. This DPA and the Customer's configuration of the Connected Systems are the Customer's complete instructions at signature. Any further instruction must be given in writing and agreed by both parties.

Three. Details of processing

Four. Customer obligations

The Customer confirms that it has a lawful basis for the processing, that it has given the notices Data Protection Law requires, and that its instructions comply with Data Protection Law. The Customer decides which Connected Systems are linked and which data is indexed, and is responsible for the accuracy and lawfulness of the data it connects.

Five. BG-Demo obligations

BG-Demo will:

• process Customer Data only on the Customer's documented instructions, unless required by law to do otherwise, in which case it will tell the Customer first where the law allows;
• ensure that everyone authorised to process Customer Data is bound by confidentiality;
• keep Customer Data inside the Customer Snowflake Account and not copy it elsewhere except as needed to provide support the Customer has asked for;
• apply the technical and organisational measures in Schedule Two;
• help the Customer to respond to requests from Data Subjects, taking account of the nature of the processing;
• help the Customer with security, breach notification, impact assessments and prior consultation, as far as the processing and the information available to BG-Demo allow; and
• make available the information needed to show compliance with this DPA.

Six. Security

BG-Demo will maintain appropriate technical and organisational measures to protect Customer Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. The measures are summarised in Schedule Two. Because B-Glass runs inside the Customer Snowflake Account, the Customer remains responsible for the access controls, network settings and user management of that account, and BG-Demo will work within the access the Customer grants.

Seven. Sub-processors

The Customer gives general authorisation for BG-Demo to use sub-processors to deliver the service. BG-Demo will bind each sub-processor to data protection obligations no less protective than those in this DPA and remains responsible for their performance. BG-Demo will tell the Customer in advance of any intended addition or replacement, and the Customer may object on reasonable data protection grounds. If the parties cannot resolve an objection, the Customer may stop using the affected part of the service.

Eight. International transfers

BG-Demo will process Customer Data in the location of the Customer Snowflake Account. It will not transfer Customer Data outside the United Kingdom, or to a country without an adequate level of protection, except on the Customer's instruction and with an appropriate transfer mechanism in place. Dedicated data residency is available as an add-on and is not included unless an order form says so.

Nine. Personal Data Breach

BG-Demo will notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Customer Data. The notice will describe, as far as then known, the nature of the breach, the data and data subjects concerned, the likely consequences and the measures taken or proposed. BG-Demo will keep the Customer updated as it learns more and will cooperate with the Customer's investigation and any notification to a regulator or to individuals.

Ten. Return and deletion

On termination or expiry of the service, and on the Customer's written request, BG-Demo will stop processing Customer Data and will delete or return it, at the Customer's choice, unless the law requires it to be kept. Because the data sits in the Customer Snowflake Account, deletion of BG-Demo's access, configuration and any working copies will be confirmed to the Customer in writing.

Eleven. Audit

BG-Demo will give the Customer the information reasonably needed to show compliance with this DPA and will allow and contribute to audits, including inspections, carried out by the Customer or an auditor it appoints. The Customer will give reasonable notice, keep audits proportionate, and protect BG-Demo's confidential information.

Twelve. Liability and precedence

Each party's liability under this DPA is subject to the limits set out in the agreement under which the service is provided. If this DPA conflicts with that agreement on the protection of personal data, this DPA prevails. Nothing in this DPA limits any liability that cannot lawfully be limited.

Thirteen. Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it.

Schedule One: Customer contacts

Schedule Two: Technical and organisational measures

Signatures

This DPA is executed by the authorised representatives of the parties on the date below.