Pelton Grange Care - Data Processing Agreement (signed)
Documentexecuted Pelton Grange Care · dpa · executed · 27 Aug 2025
Executed UK GDPR data processing agreement dated 27 Aug 2025 between Pelton Grange Care (Controller) and BG-Demo Limited (Processor). It covers B-Glass service. It states no price, availability or P1 response time.
What it says
What this says
As at Fri 9 Oct 2026Executed UK GDPR data processing agreement dated 27 Aug 2025 between Pelton Grange Care (Controller) and BG-Demo Limited (Processor). It covers B-Glass service. It states no price, availability or P1 response time.
What it is: An executed DPA under the Master Services Agreement dated 27 Aug 2025. Pelton Grange Care is the Data Controller and BG-Demo the Data Processor, processing "only on documented instructions from Customer".
Commits: Processing runs from 10 Sep 2025 until termination or deletion. Data is held "within the United Kingdom and the European Union", and deletion or return is due within 30 days of a request after termination. Audit is allowed "no more than once per year".
Unusual: Sub-processors need the customer's prior written consent. Data subjects include family members of service users, which is sensitive for a care provider.
Not settled: The text does not state price, service levels, subscription tier or renewal. The signature blocks give titles and dates but no names, so the evidence does not show who signed.
As found in this document
As at Fri 9 Oct 2026- Date signed27 Aug 2025Source: the AI read of this record
- Date start10 Sep 2025Source: the AI read of this record
- Processing instructionsProvider shall process Data only on documented instructions from Customer.Source: the AI read of this record
- Data locationData shall be processed and stored within the United Kingdom and the European Union as specified in the Master Services Agreement.Source: the AI read of this record
- Deletion and returnProvider shall comply within 30 days.Source: the AI read of this record
- Audit rightsupon reasonable notice, no more than once per yearSource: the AI read of this record
- Sub-processorswith Customer's prior written consentSource: the AI read of this record
The document
Body
Pelton Grange Care, Data Processing Agreement (Signed)
Executed
1. Definitions
In this Agreement:
- "Data" means all personal data processed by Provider on behalf of Customer
- "Processing" means any operation performed on Data as defined in UK GDPR
- "Data Subject" means any identified or identifiable natural person to whom Data relates
- "Processor" means Provider, as defined in UK GDPR
- "Controller" means Customer, as defined in UK GDPR
2. Roles
Customer is the Data Controller. Provider is the Data Processor. Provider shall process Data only on documented instructions from Customer.
3. Subject Matter and Duration
Provider shall process Data solely to deliver B-Glass service under the Master Services Agreement dated 27 Aug 2025. Processing shall occur from 10 Sep 2025 until termination of that agreement or until Data is deleted, whichever is earlier.
4. Types of Data
The Data may include:
- Contact information from Customer's CRM
- Call recordings and transcripts
- Email metadata and content
- Financial records and invoices
- Incident reports and notes
5. Categories of Data Subjects
Read the whole document (2,863 characters)
Data may relate to:
- Customer's employees
- Family members of service users
- Commissioners and external stakeholders
6. Data Subject Rights
Customer shall ensure that Data Subject rights are respected. Provider shall, upon request, assist Customer in responding to Data Subject access requests, deletion requests and other rights under UK GDPR.
7. Security Measures
Provider shall implement and maintain technical and organisational security measures appropriate to the risk level, including:
- Encryption of Data at rest and in transit
- Access controls and multi-factor authentication
- Regular security reviews and penetration testing
- Incident response procedures
- Staff training on data protection
8. Sub-Processors
Provider may engage sub-processors with Customer's prior written consent. Provider shall ensure all sub-processors enter into equivalent data protection terms.
9. Data Location
Data shall be processed and stored within the United Kingdom and the European Union as specified in the Master Services Agreement.
10. Deletion and Return
Upon termination of the Master Services Agreement, Customer may request that Provider delete or return all Data. Provider shall comply within 30 days.
11. Audit Rights
Customer may audit Provider's compliance with this Agreement upon reasonable notice, no more than once per year.
12. Governing Law
This Agreement shall be governed by the laws of England and Wales and the UK GDPR.
Executed Signatures
For Pelton Grange Care:
_______________________________ Chief Operating Officer Date: 27 Aug 2025
For BG-Demo Limited:
_______________________________ Account Executive Date: 27 Aug 2025
Unusual terms
As at Fri 9 Oct 2026- Prior written consent needed for sub-processors
- Data covers family members of service users
- Data location includes the EU