Kaltenbrunn Medizintechnik - Data Processing Agreement (signed)
Documentexecuted Kaltenbrunn Medizintechnik · dpa · executed · 2026-04-17
Executed data processing agreement signed on 17 Apr 2026 between Kaltenbrunn Medizintechnik (Controller) and BB-Demo (Processor), covering the Enterprise tier. Data stays in an EU region within the Controller's Snowflake account. It states no price or service levels.
What it says
What this says
Current to 13 Oct 26Executed data processing agreement signed on 17 Apr 2026 between Kaltenbrunn Medizintechnik (Controller) and BB-Demo (Processor), covering the Enterprise tier. Data stays in an EU region within the Controller's Snowflake account. It states no price or service levels.
What it is: an executed DPA that sits alongside the Master Services Agreement signed on the same date. It applies to all personal data BB-Demo handles in providing the Company Brain.
Commits: "The Processor will not move the data outside that region without the Controller's written agreement." Sub-processors need prior authorisation, and breaches must be reported "without undue delay".
Unusual: the Controller's signatory is shown only as "Authorised signatory", so the customer signer's name and role are not recorded. BB-Demo signed through its Account Executive, Matteo Ricci.
Not settled: it states no price, availability, P1 response time, refresh deadline, service credit, term or renewal date. Those sit in the Master Services Agreement and order form, which are not shown here.
As found in this document
Current to 9 Oct 26- Date signed17 Apr 2026Source: object_read:doc_161_006
- Data locationThe Controller's data is held in an EU region within the Controller's Snowflake account.The Controller's data is held in an EU region within the Controller's Snowflake account. · Source: object_read:doc_161_006
- Data movementThe Processor will not move the data outside that region without the Controller's written agreement.The Processor will not move the data outside that region without the Controller's written agreement. · Source: object_read:doc_161_006
- Sub-processorsThe Processor will use sub-processors only with the Controller's prior authorisation.The Processor will use sub-processors only with the Controller's prior authorisation. · Source: object_read:doc_161_006
- Breach notificationThe Processor will tell the Controller without undue delay after becoming aware of a personal data breachThe Processor will tell the Controller without undue delay after becoming aware of a personal data breach · Source: object_read:doc_161_006
- Return and deletionWhen the services end, the Processor will, at the Controller's choice, return or delete the personal data.When the services end, the Processor will, at the Controller's choice, return or delete the personal data. · Source: object_read:doc_161_006
The document
Body
Kaltenbrunn Medizintechnik - Data Processing Agreement (signed)
Status: Executed. Signed on 17 Apr 2026.
Parties
- Kaltenbrunn Medizintechnik, of Hamburg, Germany (the "Controller").
- BB-Demo, a London data business (the "Processor").
This agreement sits alongside the Master Services Agreement signed on the same date and applies to all personal data the Processor handles in providing the Company Brain to the Controller.
Clause one: Subject matter and nature of processing
The Processor provides the Enterprise tier of the Company Brain, an AI-queryable layer over the Controller's connected systems, so that field service, key accounts and complaints can see each hospital's devices, service tickets and contracts together. The Processor builds and runs the Company Brain inside the Controller's own Snowflake account.
Processing consists of indexing, storing, refreshing and answering questions over data from the systems the Controller connects.
Clause two: Roles
Read the whole document (3,978 characters)
The Controller decides the purposes and means of processing. The Processor acts only on the Controller's documented instructions, which are the Master Services Agreement, this agreement and the Controller's configuration of the product.
Clause three: Data location
The Controller's data is held in an EU region within the Controller's Snowflake account. The Processor will not move the data outside that region without the Controller's written agreement.
Clause four: Confidentiality
The Processor ensures that everyone who may access the personal data is bound by a duty of confidentiality and has access only where their work requires it.
Clause five: Security
The Processor applies technical and organisational measures appropriate to the risk, including:
- access control and single sign-on for the Controller's users, with provisioning through SCIM;
- encryption of data in transit and at rest within the Controller's Snowflake account;
- separation of the Controller's data from that of any other customer;
- logging of administrative access, available to the Controller on request.
The security review completed during implementation records the measures in more detail.
Clause six: Sub-processors
The Processor will use sub-processors only with the Controller's prior authorisation. The Processor remains responsible for any sub-processor it engages and will flow down obligations no less protective than those in this agreement. The Processor will tell the Controller in writing of any intended change so that the Controller can object.
Clause seven: Assistance to the Controller
The Processor will help the Controller, taking account of the nature of processing, to:
- respond to requests from individuals exercising their rights;
- meet its security, impact assessment and consultation duties under applicable data protection law;
- demonstrate compliance, including by answering reasonable audit questions.
Clause eight: Personal data breaches
The Processor will tell the Controller without undue delay after becoming aware of a personal data breach, and will give the information the Controller needs to meet its own notification duties. The Processor will not withhold an incident from the Controller's security team.
Clause nine: Return and deletion
When the services end, the Processor will, at the Controller's choice, return or delete the personal data. Because the Company Brain runs inside the Controller's own Snowflake account, the Controller keeps control of the underlying data throughout.
Clause ten: Governing law
This agreement is governed by the same law and jurisdiction as the Master Services Agreement, subject to any mandatory data protection rules that apply to the Controller.
Signatures
| For Kaltenbrunn Medizintechnik | For BB-Demo | |
|---|---|---|
| Name | Authorised signatory | Matteo Ricci |
| Title | Authorised signatory | Account Executive |
| Date | 17 Apr 2026 | 17 Apr 2026 |
Unusual terms
Current to 9 Oct 26- EU data location fixed by clause
- Sub-processor changes need prior authorisation
- Administrative access logs available on request