Ardenmore Pension Administration - Data Processing Agreement (signed)
Documentexecuted Ardenmore Pension Administration · dpa · executed · 2023-08-16
Executed DPA signed 16 Aug 2023 making BB-Demo processor and Ardenmore Pension Administration controller. Processing stays in the UK inside the controller's Snowflake account. It states no price, availability or response times.
What it says
What this says
Current to 13 Oct 26Executed DPA signed 16 Aug 2023 making BB-Demo processor and Ardenmore Pension Administration controller. Processing stays in the UK inside the controller's Snowflake account. It states no price, availability or response times.
What it is: an executed data processing agreement supplementing the Master Services Agreement signed on the same date. It applies "for as long as the Processor handles personal data under it".
Commits: BB-Demo to process only on documented instructions, to "keep the data inside the Controller's Snowflake account", and to tell the Controller of a breach "without undue delay". Sub-processors need prior written authorisation.
Unusual: no fixed breach notification period, and the Controller's signatory is shown only as "Authorised signatory", so the evidence does not show who signed for Ardenmore.
Not settled: price, service levels, term end and renewal sit in the Master Services Agreement and order form, which are not in this document.
As found in this document
Current to 9 Oct 26- Date signed16 Aug 2023Source: object_read:doc_159_005
- Date start16 Aug 2023Source: object_read:doc_159_005
- Data locationProcessing takes place in the United Kingdom, within the Controller's Snowflake account.Processing takes place in the United Kingdom, within the Controller's Snowflake account. · Source: object_read:doc_159_005
- Breach notificationtell the Controller without undue delay on becoming aware of a personal data breachtell the Controller without undue delay on becoming aware of a personal data breach · Source: object_read:doc_159_005
- Sub-processorsThe Processor will not engage another processor for the Controller's personal data without the Controller's prior written authorisation.The Processor will not engage another processor for the Controller's personal data without the Controller's prior written authorisation. · Source: object_read:doc_159_005
- Transfers outside the UKrequires the Controller's prior written agreement and a lawful transfer mechanismrequires the Controller's prior written agreement and a lawful transfer mechanism · Source: object_read:doc_159_005
- Return and deletionat the Controller's choice, return or delete the personal data it holds, and will confirm in writing once this is doneat the Controller's choice, return or delete the personal data it holds, and will confirm in writing once this is done · Source: object_read:doc_159_005
- Termtakes effect on signature and continues for as long as the Processor processes personal data for the Controllertakes effect on signature and continues for as long as the Processor processes personal data for the Controller · Source: object_read:doc_159_005
The document
Body
Ardenmore Pension Administration - Data Processing Agreement (signed)
Status: Executed Signed: 16 Aug 2023
Parties
This Data Processing Agreement is made between Ardenmore Pension Administration, of Birmingham (the "Controller"), and BB-Demo, of London (the "Processor").
It supplements the Master Services Agreement between the same parties signed on the same date and applies for as long as the Processor handles personal data under it.
Subject matter and purpose
The Processor provides the company brain to the Controller. The brain is built and run inside the Controller's own Snowflake account and gives the Controller's client-relationship team one searchable layer over the systems the Controller chooses to connect. The Processor handles personal data only so far as is needed to deliver, support and secure that service.
Nature of the data
Read the whole document (3,857 characters)
The personal data processed is the data held in the systems the Controller connects, which may include contact details and correspondence of the Controller's clients and staff, call and ticket records, and related account information. The Controller decides which systems are connected and may remove a connector at any time.
Processor obligations
The Processor will:
- process personal data only on the Controller's documented instructions, which include the Master Services Agreement and its order lines;
- ensure that everyone it authorises to handle the data is bound by a duty of confidence;
- keep the data inside the Controller's Snowflake account and not copy it elsewhere without the Controller's written agreement;
- apply appropriate technical and organisational measures to protect the data, including access controls and logging;
- tell the Controller without undue delay on becoming aware of a personal data breach, and give the information reasonably needed to deal with it;
- help the Controller, as far as reasonably possible, to answer requests from individuals exercising their data protection rights;
- help the Controller with impact assessments and consultations with the regulator where they relate to the service.
Controller obligations
The Controller confirms that it has a lawful basis for the processing it instructs, and that it has given any notices to individuals that the law requires.
Sub-processors
The Processor will not engage another processor for the Controller's personal data without the Controller's prior written authorisation. Where one is authorised, the Processor will bind it to obligations no less protective than these, and remains responsible for its performance.
Location of processing
Processing takes place in the United Kingdom, within the Controller's Snowflake account. Any transfer outside the United Kingdom requires the Controller's prior written agreement and a lawful transfer mechanism.
Audit
The Processor will make available the information reasonably needed to show compliance with this agreement and will allow reasonable audits by the Controller or its appointed auditor, on reasonable notice and during business hours.
Return and deletion
On the end of the services, the Processor will, at the Controller's choice, return or delete the personal data it holds, and will confirm in writing once this is done. Because the brain runs inside the Controller's own Snowflake account, the Controller retains control of its source data throughout.
Term
This agreement takes effect on signature and continues for as long as the Processor processes personal data for the Controller.
Signatures
| For BB-Demo (Processor) | For Ardenmore Pension Administration (Controller) |
|---|---|
| Name: Nell Ashcombe | Name: Authorised signatory |
| Title: Chief Executive Officer and Co-founder | Title: Authorised signatory of the Controller |
| Date: 16 Aug 2023 | Date: 16 Aug 2023 |
Unusual terms
Current to 9 Oct 26- No fixed breach notification period
- Controller signatory not named