Penmaen Software - Data Processing Agreement (signed)
Documentexecuted Penmaen Software · dpa · executed · 11 Jul 2024
Executed DPA dated 11 Jul 2024 under the master agreement, with Penmaen Software as controller and BG-Demo as processor. Customer Data stays within the customer's own Snowflake account. It states no price, availability figure or P1 response time.
What it says
What this says
As at Fri 9 Oct 2026Executed DPA dated 11 Jul 2024 under the master agreement, with Penmaen Software as controller and BG-Demo as processor. Customer Data stays within the customer's own Snowflake account. It states no price, availability figure or P1 response time.
What it is: an executed data processing agreement signed on 11 Jul 2024 by Tom Ashdown for BG-Demo. It "applies to every order form signed under it" and the master agreement.
Commits: BG-Demo processes Customer Data only on documented instructions and keeps it "within the Customer's Snowflake account". It must tell the customer of a breach "without undue delay" and give advance notice of new sub-processors.
Unusual: nothing off the standard terms. The Customer signatory is shown only as "Authorised signatory", so the document does not name who signed for Penmaen Software.
Not settled: no price, service levels, term, renewal date or breach notice deadline in hours. Liability is deferred to the limits in the master agreement, which is not in this document.
As found in this document
As at Fri 9 Oct 2026- Date signed11 Jul 2024Source: the AI read of this record
- Data locationkeep Customer Data within the Customer's Snowflake account and not move it elsewhere without the Customer's written agreementSource: the AI read of this record
- Breach noticetell the Customer without undue delay after becoming aware of a personal data breach affecting Customer DataSource: the AI read of this record
- Sub-processorsgive the Customer advance notice of any new sub-processor and a fair opportunity to objectSource: the AI read of this record
- International transfersshall not transfer Customer Data outside the United Kingdom unless an appropriate safeguard recognised under data protection law is in place and the Customer has been toldSource: the AI read of this record
- Return and deletionat the Customer's choice, return or delete Customer Data and delete existing copies, unless the law requires it to be keptSource: the AI read of this record
Body
Penmaen Software - Data Processing Agreement (signed)
Status: Executed Date of agreement: 11 Jul 2024
Parties
This Data Processing Agreement is made between:
- Penmaen Software, a Cardiff vendor of booking and membership software for gyms and leisure centres (the "Customer"), acting as controller; and
- BG-Demo, a London data business (the "Supplier"), acting as processor.
It forms part of the master agreement between the parties and applies to every order form signed under it.
Background
The Supplier provides B-Glass, an AI-queryable layer over the Customer's business systems. The brain is built and run inside the Customer's own Snowflake account. The Customer's source systems are connected to it as set out in the relevant order form. In doing so the Supplier may process personal data on the Customer's behalf, and this agreement sets out the terms on which it does so.
Definitions
Read the whole document (4,858 characters)
Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018. "Customer Data" means personal data processed by the Supplier on the Customer's behalf under the master agreement.
Scope and purpose of processing
| Item | Description |
|---|---|
| Subject matter | Provision of B-Glass and associated implementation and support services |
| Nature of processing | Indexing, storing, structuring and retrieving data from connected systems so that the Customer's users can search and query it |
| Duration | The term of the master agreement and any order form, plus the period needed to return or delete Customer Data |
| Categories of data subject | Customer staff, and the Customer's own customers and their contacts, as they appear in connected systems |
| Types of personal data | Names, business contact details, job titles, account and ticket records, call and email content and usage records held in connected systems |
Supplier obligations
The Supplier shall:
- process Customer Data only on the Customer's documented instructions, which include this agreement and the order forms, unless the law requires otherwise, in which case it will tell the Customer first where it lawfully can;
- ensure that anyone authorised to process Customer Data is bound by a duty of confidentiality;
- keep Customer Data within the Customer's Snowflake account and not move it elsewhere without the Customer's written agreement;
- apply appropriate technical and organisational measures to protect Customer Data, including access controls, encryption and logging;
- help the Customer, taking account of the nature of the processing, to respond to requests from data subjects;
- help the Customer with its security, breach notification, impact assessment and prior consultation duties.
Personal data breaches
The Supplier shall tell the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data. The notice shall describe the nature of the breach, the data and people concerned so far as known, the likely consequences and the measures taken or proposed.
Sub-processors
The Customer gives general authorisation for the Supplier to use sub-processors. The Supplier shall bind each sub-processor to obligations no less protective than those in this agreement and remains responsible for their performance. The Supplier shall give the Customer advance notice of any new sub-processor and a fair opportunity to object.
International transfers
The Supplier shall not transfer Customer Data outside the United Kingdom unless an appropriate safeguard recognised under data protection law is in place and the Customer has been told.
Audit and information
The Supplier shall make available the information reasonably necessary to show compliance with this agreement and shall allow and contribute to audits by the Customer or its appointed auditor, on reasonable notice and during normal working hours.
Return and deletion
On ending of the services, the Supplier shall, at the Customer's choice, return or delete Customer Data and delete existing copies, unless the law requires it to be kept. Because the brain runs inside the Customer's own Snowflake account, the Customer retains control of its data throughout.
Liability and governing law
Liability under this agreement is subject to the limits in the master agreement. This agreement is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction.
Signatures
Signed by the authorised representatives of the parties on 11 Jul 2024.
| For BG-Demo | For Penmaen Software | |
|---|---|---|
| Name | Tom Ashdown | Authorised signatory |
| Title | Account Executive | Authorised signatory for the Customer |
| Date | 11 Jul 2024 | 11 Jul 2024 |