Veenendrecht Payments - Data Processing Agreement (signed)
Documentexecuted Veenendrecht Payments · dpa · executed · 2026-01-22
Executed Data Processing Agreement under the Master Services Agreement between Veenendrecht Payments (Controller) and BB-Demo (Processor), signed 22 Jan 2026. It sets no service levels or price. Data residency is excluded unless an order form says otherwise.
What it says
What this says
Current to 13 Oct 26Executed Data Processing Agreement under the Master Services Agreement between Veenendrecht Payments (Controller) and BB-Demo (Processor), signed 22 Jan 2026. It sets no service levels or price. Data residency is excluded unless an order form says otherwise.
What it is: an executed DPA signed on 22 Jan 2026 by Sophie Ling for BB-Demo and an unnamed authorised signatory for Veenendrecht Payments. It sits under the Master Services Agreement and prevails on personal data: "this agreement prevails".
Commits: BB-Demo processes personal data only on documented instructions, will not "use it to train models for any other customer", and needs prior authorisation for any sub-processor. It must tell the Controller of a breach "without undue delay" and delete or return data at the end of the MSA.
Unusual: no fixed breach-notification period is given, and the audit right is on "reasonable notice". Data residency is "not part of this agreement unless stated in an order form".
Not settled: price, service levels, term and renewal are not in this document. The Controller's signatory is not named, so the evidence does not show who signed for Veenendrecht Payments.
As found in this document
Current to 9 Oct 26- Date signed22 Jan 2026Source: object_read:doc_160_006
- Processing instructionsprocess personal data only on the Controller's documented instructionsprocess personal data only on the Controller's documented instructions · Source: object_read:doc_160_006
- Model trainingnot use it to train models for any other customernot use it to train models for any other customer · Source: object_read:doc_160_006
- Sub-processorsnot engage another processor for personal data without the Controller's prior authorisationnot engage another processor for personal data without the Controller's prior authorisation · Source: object_read:doc_160_006
- Personal data breachestell the Controller without undue delay after becoming aware of a personal data breachtell the Controller without undue delay after becoming aware of a personal data breach · Source: object_read:doc_160_006
- International transfersnot transfer personal data outside the United Kingdom or the European Economic Area except on the Controller's instructions and with a lawful transfer mechanism in placenot transfer personal data outside the United Kingdom or the European Economic Area except on the Controller's instructions and with a lawful transfer mechanism in place · Source: object_read:doc_160_006
- Return and deletionat the Controller's choice, delete or return personal data, and remove the brain from the Controller's Snowflake accountat the Controller's choice, delete or return personal data, and remove the brain from the Controller's Snowflake account · Source: object_read:doc_160_006
- Auditsallow reasonable audits on reasonable noticeallow reasonable audits on reasonable notice · Source: object_read:doc_160_006
The document
Body
Veenendrecht Payments - Data Processing Agreement (signed)
Status: Executed. Signed on 22 Jan 2026.
Parties and purpose
This Data Processing Agreement sits under the Master Services Agreement between Veenendrecht Payments ("the Controller") and BB-Demo ("the Processor"). It sets out how BB-Demo handles personal data on the Controller's behalf when providing the company brain.
The Controller is a payment service provider based in Utrecht. The Processor is a data business based in London.
Definitions
- Personal data means any information relating to an identified or identifiable person that the Processor handles for the Controller under the Master Services Agreement.
- Data protection law means the UK GDPR, the EU GDPR and any national law that implements or supplements them, as they apply to either party.
- Brain means the AI-queryable layer that the Processor builds and runs for the Controller.
Subject matter and nature of processing
Read the whole document (4,027 characters)
The Processor will process personal data only to build, run and support the brain for the Controller. The brain is deployed inside the Controller's own Snowflake account, so source data remains in the Controller's environment. The categories of data are those held in the systems the Controller chooses to connect, which may include records of merchants, merchant contacts, support tickets, calls and emails, and the Controller's own staff.
Instructions
The Processor will:
- process personal data only on the Controller's documented instructions, including the instructions given by connecting a system to the brain;
- tell the Controller if it believes an instruction would breach data protection law;
- not use personal data for its own purposes, and not use it to train models for any other customer.
Confidentiality and security
The Processor will make sure that everyone who can access personal data is bound by a duty of confidentiality. It will keep appropriate technical and organisational measures in place to protect personal data, including access controls, separation between customers, and logging of administrative access.
Sub-processors
The Processor will not engage another processor for personal data without the Controller's prior authorisation. Where one is authorised, the Processor will bind it to obligations equivalent to those in this agreement and remain responsible for its performance.
Assistance to the Controller
The Processor will, taking account of the nature of the processing:
- help the Controller respond to requests from individuals exercising their rights;
- help the Controller meet its obligations on security, impact assessments and consultation with supervisory authorities;
- make available the information needed to show compliance, and allow reasonable audits on reasonable notice.
Personal data breaches
The Processor will tell the Controller without undue delay after becoming aware of a personal data breach, and will give the information the Controller needs to meet its own notification duties.
International transfers
The Processor will not transfer personal data outside the United Kingdom or the European Economic Area except on the Controller's instructions and with a lawful transfer mechanism in place. Dedicated data residency is available as an add-on and is not part of this agreement unless stated in an order form.
Return and deletion
On the end of the Master Services Agreement, the Processor will, at the Controller's choice, delete or return personal data, and remove the brain from the Controller's Snowflake account, unless the law requires it to be kept.
Order of precedence
If this agreement conflicts with the Master Services Agreement on the handling of personal data, this agreement prevails.
Signatures
| For BB-Demo | For Veenendrecht Payments | |
|---|---|---|
| Name | Sophie Ling | Authorised signatory |
| Title | Account Executive | Authorised signatory of the Controller |
| Date | 22 Jan 2026 | 22 Jan 2026 |
Unusual terms
Current to 9 Oct 26- Breach notification has no fixed time limit
- Data residency excluded unless in an order form
- No training of models for other customers