Pellegrin Hart Benefits - Data Processing Agreement (signed)
Documentexecuted Pellegrin Hart Benefits · dpa · executed · 12 May 2026
Executed DPA signed on 12 May 2026 between Pellegrin Hart Benefits (controller) and BG-Demo (processor). It sets how personal data is handled inside the customer's Snowflake account. It states no price, service levels or renewal date.
What it says
What this says
As at Fri 9 Oct 2026Executed DPA signed on 12 May 2026 between Pellegrin Hart Benefits (controller) and BG-Demo (processor). It sets how personal data is handled inside the customer's Snowflake account. It states no price, service levels or renewal date.
What it is: a data processing agreement that forms part of the main agreement. It says "The Customer is the controller of the personal data" and the Supplier acts as processor on documented instructions.
Commits: BG-Demo will not "process personal data for its own purposes or use it to train models for other customers". It must notify the customer "without undue delay" of a breach and allow audits on reasonable notice.
Unusual: the customer will not connect sources holding health or retirement account data unless agreed in writing. Sub-processors are generally authorised, with notice and a chance to object. Transfers rely on a lawful mechanism, as BG-Demo is in the UK and the customer in the US.
Not settled: no price, term, renewal date, service levels or breach notification deadline in hours. The customer signatory is shown only as an authorised signatory, unnamed.
As found in this document
As at Fri 9 Oct 2026- Date signed12 May 2026Source: the AI read of this record
- Processing basisprocesses the data only on the Customer's documented instructionsSource: the AI read of this record
- Use of datawill not process personal data for its own purposes or use it to train models for other customersSource: the AI read of this record
- Personal data breachnotify the Customer without undue delay after becoming aware of a personal data breachSource: the AI read of this record
- Auditallow audits by the Customer or its appointed auditor on reasonable notice, during business hoursSource: the AI read of this record
- Return and deletionat the Customer's choice, return or delete personal data it holds on the Customer's behalf, and will confirm in writingSource: the AI read of this record
The document
Body
Data Processing Agreement
Status: Executed. Signed on 12 May 2026.
This Data Processing Agreement (the "DPA") is made between Pellegrin Hart Benefits, of Hartford (the "Customer"), and BG-Demo, of London (the "Supplier"). It forms part of the agreement under which the Supplier provides B-Glass to the Customer, and it applies for as long as the Supplier processes personal data on the Customer's behalf.
1. Purpose and scope
The Supplier provides an AI-queryable layer over the Customer's business systems, built and run inside the Customer's own Snowflake account. In doing so the Supplier may process personal data of the Customer's employees, of the employer clients the Customer administers, and of those clients' plan participants. This DPA sets out how that data is handled.
2. Roles of the parties
The Customer is the controller of the personal data. The Supplier acts as processor and processes the data only on the Customer's documented instructions, which are the agreement, this DPA and the Customer's configuration of the service.
3. Categories of data and data subjects
Read the whole document (5,277 characters)
| Item | Description |
|---|---|
| Data subjects | Customer staff; contacts at the Customer's employer clients; plan participants where they appear in tickets, calls or emails |
| Categories of data | Names, business contact details, job titles, correspondence, call recordings and transcripts, ticket content, account and renewal records |
| Special categories | None intended. The Customer will not connect sources that hold health or retirement account data unless the parties agree this in writing |
| Nature of processing | Indexing, storage, retrieval and summarisation within the Customer's Snowflake account |
4. Customer instructions
The Supplier will tell the Customer without undue delay if it considers an instruction to infringe applicable data protection law. The Supplier will not process personal data for its own purposes or use it to train models for other customers.
5. Confidentiality and personnel
The Supplier ensures that everyone authorised to process the personal data is bound by a duty of confidentiality and receives appropriate data protection training.
6. Security
The Supplier maintains technical and organisational measures appropriate to the risk, including:
- processing inside the Customer's own Snowflake account, so that data does not leave the Customer's environment by default;
- access control and logging for Supplier staff who work on the Customer's deployment;
- encryption in transit and at rest, using the controls provided by the Customer's Snowflake account;
- regular review of access rights and prompt removal of access when staff change role or leave.
7. Sub-processors
The Customer gives general authorisation for the Supplier to use sub-processors. The Supplier will keep an up-to-date list available to the Customer, will give notice of any intended addition or replacement, and will allow the Customer a reasonable opportunity to object. The Supplier remains responsible for its sub-processors.
8. International transfers
The Supplier is based in the United Kingdom and the Customer in the United States. Where personal data is made available to the Supplier from outside the United Kingdom, the parties will rely on an appropriate lawful transfer mechanism and will cooperate to put in place any further terms that applicable law requires.
9. Assistance to the Customer
Taking into account the nature of the processing, the Supplier will assist the Customer, by appropriate measures, in:
- responding to requests from individuals exercising their rights;
- meeting its security, breach notification and impact assessment obligations;
- demonstrating compliance with this DPA.
10. Personal data breach
The Supplier will notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, and will provide the information the Customer reasonably needs to meet its own notification duties.
11. Audit
The Supplier will make available the information needed to demonstrate compliance and will allow audits by the Customer or its appointed auditor on reasonable notice, during business hours and without unreasonable disruption to the Supplier's operations.
12. Return and deletion
On termination or expiry of the agreement, the Supplier will, at the Customer's choice, return or delete personal data it holds on the Customer's behalf, and will confirm in writing that it has done so, unless the law requires retention.
13. Liability and order of precedence
Liability under this DPA is subject to the limitations in the main agreement. If this DPA conflicts with the main agreement on the processing of personal data, this DPA prevails.
14. Governing law
This DPA is governed by the law that governs the main agreement, and disputes are resolved in the forum that agreement specifies.
Signatures
Signed by the duly authorised representatives of the parties on 12 May 2026.
| For Pellegrin Hart Benefits | For BG-Demo | |
|---|---|---|
| Name | Authorised signatory | Jordan Pike |
| Title | Authorised officer of Pellegrin Hart Benefits | Account Executive, US |
| Date | 12 May 2026 | 12 May 2026 |
Unusual terms
As at Fri 9 Oct 2026- Health or retirement account data excluded unless agreed in writing
- General authorisation for sub-processors with notice and objection right
- DPA prevails over main agreement on personal data conflicts