Hartside Student Living - Data Processing Agreement (signed)
Documentexecuted Hartside Student Living · dpa · executed · 27 Mar 2026
Executed Data Processing Agreement between Hartside Student Living (Controller) and BG-Demo (Processor), signed 27 Mar 2026 alongside the MSA. It sets processing on documented instructions only, with no sub-processors or transfers outside the United Kingdom without written authorisation.
What it says
What this says
As at Fri 9 Oct 2026Executed Data Processing Agreement between Hartside Student Living (Controller) and BG-Demo (Processor), signed 27 Mar 2026 alongside the MSA. It sets processing on documented instructions only, with no sub-processors or transfers outside the United Kingdom without written authorisation.
What it is: an executed DPA, version 1, that forms part of the Master Services Agreement and was signed the same day. BG-Demo acts only as processor, and the brain runs inside the Controller's own Snowflake account.
Commits: the Processor will process data "only on the Controller's instructions", keep staff bound by confidentiality, and tell the Controller of a breach "without undue delay". It will not engage a sub-processor without "prior written authorisation".
Unusual: nothing off standard. There are no service levels, prices or fixed notice periods in this document. Audits are allowed on "reasonable notice and during business hours".
Not settled: the text does not name the Hartside signatory, gives no breach notification deadline in hours or days, and states no end date. Duration follows the MSA.
As found in this document
As at Fri 9 Oct 2026- Date signed27 Mar 2026Source: the AI read of this record
- Processing instructionsprocess personal data only on the Controller's instructionsSource: the AI read of this record
- Sub-processorswill not engage a sub-processor for the Controller's personal data without the Controller's prior written authorisationSource: the AI read of this record
- Breach notificationtell the Controller without undue delay on becoming aware of a personal data breachSource: the AI read of this record
- International transferswill not transfer the Controller's personal data outside the United Kingdom except as the Controller authorises in writing and as the law allowsSource: the AI read of this record
- Return and deletionat the Controller's choice, return or delete the personal data it holds, and confirm in writing once that is doneSource: the AI read of this record
- Auditreasonable audits by the Controller or its appointed auditor, on reasonable notice and during business hoursSource: the AI read of this record
Body
Hartside Student Living - Data Processing Agreement (signed)
Status: Executed. Version 1. Signed: 27 Mar 2026
Parties
This Data Processing Agreement is made between Hartside Student Living ("the Controller"), based in Nottingham, and BG-Demo ("the Processor"), based in London. It forms part of the Master Services Agreement between the parties and is signed on the same day.
Subject matter and purpose
The Processor provides B-Glass to the Controller: an AI-queryable layer over the Controller's business systems, built and run inside the Controller's own Snowflake account. The Processor handles personal data only to provide, support and maintain that service, and only on the Controller's documented instructions.
Roles
- The Controller decides what data is connected and why it is used.
- The Processor acts only as a processor and does not use the data for its own purposes.
- Because the brain runs inside the Controller's Snowflake account, the data stays under the Controller's own account controls.
Categories of data and people
Read the whole document (3,741 characters)
The data connected may include records about university partners, residents, staff and suppliers held in the systems the Controller chooses to connect, such as tickets, agreements and invoices. The Controller is responsible for deciding which sources are connected and for telling the Processor about any special categories of data in them.
Processor obligations
The Processor will:
- process personal data only on the Controller's instructions;
- make sure that everyone who handles the data is bound by confidentiality;
- apply appropriate technical and organisational security measures;
- help the Controller to respond to requests from individuals exercising their rights;
- help the Controller with impact assessments and consultations where reasonably asked.
Sub-processors
The Processor will not engage a sub-processor for the Controller's personal data without the Controller's prior written authorisation. Where a sub-processor is authorised, the Processor remains responsible for it and will bind it to the same obligations as this agreement.
Personal data breaches
The Processor will tell the Controller without undue delay on becoming aware of a personal data breach affecting the Controller's data, and will give the information the Controller reasonably needs to meet its own duties to the regulator and to individuals.
International transfers
The Processor will not transfer the Controller's personal data outside the United Kingdom except as the Controller authorises in writing and as the law allows.
Return and deletion
When the services end, the Processor will, at the Controller's choice, return or delete the personal data it holds, and will confirm in writing once that is done. Because the brain runs in the Controller's own Snowflake account, the Controller keeps its own data and the Processor's access is withdrawn.
Audit
The Processor will make available the information needed to show compliance with this agreement and will allow reasonable audits by the Controller or its appointed auditor, on reasonable notice and during business hours.
Duration
This agreement runs for as long as the Processor handles personal data for the Controller under the Master Services Agreement, and for any period afterwards in which data remains in the Processor's hands.
Governing law
This agreement is governed by the law of England and Wales.
Signatures
| For BG-Demo (Processor) | For Hartside Student Living (Controller) | |
|---|---|---|
| Name | Lewis Kerr | Authorised signatory |
| Title | Account Executive | Authorised signatory of Hartside Student Living |
| Date | 27 Mar 2026 | 27 Mar 2026 |