Tarnbeck Insurance Brokers - Data Processing Agreement (signed)
Documentexecuted Tarnbeck Insurance Brokers · dpa · executed · 2025-01-16
Data Processing Agreement with Tarnbeck Insurance Brokers as controller and BB-Demo Limited as processor, dated 16 Jan 2025 and stored as executed. It states no price, availability or response time. Deletion or return of personal data is due within 30 days of request.
What it says
What this says
Current to 13 Oct 26Data Processing Agreement with Tarnbeck Insurance Brokers as controller and BB-Demo Limited as processor, dated 16 Jan 2025 and stored as executed. It states no price, availability or response time. Deletion or return of personal data is due within 30 days of request.
What it is: a DPA under the Main Service Agreement, covering processing for the Company Brain service and support. Tarnbeck Insurance Brokers is the controller and BB-Demo Limited the processor.
Commits: the processor acts only on documented instructions and must not "engage sub-processors without prior written consent from the Controller". On termination it must delete or return data "within 30 days of request".
Unusual: Snowflake is named as the consented sub-processor, and future changes carry advance notice with a right to object. Security measures listed are encryption at rest and in transit, access controls, audit logging and incident response.
Not settled: the customer signature line is blank dots under a role, "Chief Executive Officer or Operations Director", with no name. The evidence does not show who signed for Tarnbeck. The start date depends on when the Main Service Agreement takes effect, which this document does not state.
As found in this document
Current to 9 Oct 26- Date signed16 Jan 2025Source: object_read:doc_171_005
- Processing instructionsProcess personal data only on documented instructions from the ControllerProcess personal data only on documented instructions from the Controller · Source: object_read:doc_171_005
- Sub-processorsNot engage sub-processors without prior written consent from the ControllerNot engage sub-processors without prior written consent from the Controller · Source: object_read:doc_171_005
- Sub-processor changesAny future sub-processor changes will be notified in advance, with the right to objectAny future sub-processor changes will be notified in advance, with the right to object · Source: object_read:doc_171_005
- Security measuresencryption at rest and in transit, access controls, audit logging, and incident response proceduresencryption at rest and in transit, access controls, audit logging, and incident response procedures · Source: object_read:doc_171_005
- Deletion on terminationdelete or return all personal data within 30 days of requestdelete or return all personal data within 30 days of request · Source: object_read:doc_171_005
The document
Body
Tarnbeck Insurance Brokers, Data Processing Agreement
This Data Processing Agreement ("DPA") is entered into between:
Data Controller: Tarnbeck Insurance Brokers, Kendal, United Kingdom
Data Processor: BB-Demo Limited, London, United Kingdom
1. Scope and Purpose
The Processor shall process personal data on behalf of the Controller solely for the purpose of providing the Company Brain service and associated support. Processing shall be governed by this DPA, the Main Service Agreement, and applicable data protection laws.
2. Processor Obligations
The Processor shall:
- Process personal data only on documented instructions from the Controller
- Ensure that persons authorised to process personal data are committed to confidentiality
- Implement and maintain appropriate technical and organisational security measures
- Not engage sub-processors without prior written consent from the Controller
- Assist the Controller in responding to data subject rights requests
- Delete or return all personal data upon termination of the service agreement
- Provide all information necessary to demonstrate compliance with data protection laws
3. Data Subject Rights
Read the whole document (2,341 characters)
The Processor shall, upon receipt of a request from a data subject, promptly notify the Controller and provide reasonable assistance in responding. The Controller remains responsible for handling such requests.
4. Sub-processors
BB-Demo currently uses Snowflake for cloud storage and compute resources. The Controller consents to this engagement. Any future sub-processor changes will be notified in advance, with the right to object.
5. Security
The Processor shall maintain security measures including encryption at rest and in transit, access controls, audit logging, and incident response procedures.
6. Duration and Termination
This DPA commences on the date the Main Service Agreement takes effect and continues for its term. Upon termination, the Processor shall delete or return all personal data within 30 days of request.
EXECUTION
For and on behalf of Tarnbeck Insurance Brokers:
....................................................................
Chief Executive Officer or Operations Director
Date: 16 January 2025
For and on behalf of BB-Demo Limited:
Priya Raman Account Executive
Date: 16 January 2025
Unusual terms
Current to 9 Oct 26- Prior written consent required for sub-processors
- Right to object to future sub-processor changes
- Deletion or return within 30 days of request