Pelton Grange Care - Data Processing Agreement (signed)
Documentexecuted Pelton Grange Care · dpa · executed · 2025-08-27
Executed UK GDPR data processing agreement dated 27 Aug 2025 between Pelton Grange Care (Controller) and BB-Demo Limited (Processor). It covers the Company Brain service. It states no price, availability or P1 response time.
What it says
What this says
Current to 13 Oct 26Executed UK GDPR data processing agreement dated 27 Aug 2025 between Pelton Grange Care (Controller) and BB-Demo Limited (Processor). It covers the Company Brain service. It states no price, availability or P1 response time.
What it is: An executed DPA under the Master Services Agreement dated 27 Aug 2025. Pelton Grange Care is the Data Controller and BB-Demo the Data Processor, processing "only on documented instructions from Customer".
Commits: Processing runs from 10 Sep 2025 until termination or deletion. Data is held "within the United Kingdom and the European Union", and deletion or return is due within 30 days of a request after termination. Audit is allowed "no more than once per year".
Unusual: Sub-processors need the customer's prior written consent. Data subjects include family members of service users, which is sensitive for a care provider.
Not settled: The text does not state price, service levels, subscription tier or renewal. The signature blocks give titles and dates but no names, so the evidence does not show who signed.
As found in this document
Current to 9 Oct 26- Date signed27 Aug 2025Source: object_read:doc_172_006
- Date start10 Sep 2025Source: object_read:doc_172_006
- Processing instructionsProvider shall process Data only on documented instructions from Customer.Provider shall process Data only on documented instructions from Customer. · Source: object_read:doc_172_006
- Data locationData shall be processed and stored within the United Kingdom and the European Union as specified in the Master Services Agreement.Data shall be processed and stored within the United Kingdom and the European Union as specified in the Master Services Agreement. · Source: object_read:doc_172_006
- Deletion and returnProvider shall comply within 30 days.Provider shall comply within 30 days. · Source: object_read:doc_172_006
- Audit rightsupon reasonable notice, no more than once per yearupon reasonable notice, no more than once per year · Source: object_read:doc_172_006
- Sub-processorswith Customer's prior written consentwith Customer's prior written consent · Source: object_read:doc_172_006
The document
Body
Pelton Grange Care, Data Processing Agreement (Signed)
Executed
1. Definitions
In this Agreement:
- "Data" means all personal data processed by Provider on behalf of Customer
- "Processing" means any operation performed on Data as defined in UK GDPR
- "Data Subject" means any identified or identifiable natural person to whom Data relates
- "Processor" means Provider, as defined in UK GDPR
- "Controller" means Customer, as defined in UK GDPR
2. Roles
Customer is the Data Controller. Provider is the Data Processor. Provider shall process Data only on documented instructions from Customer.
3. Subject Matter and Duration
Provider shall process Data solely to deliver the Company Brain service under the Master Services Agreement dated 27 Aug 2025. Processing shall occur from 10 Sep 2025 until termination of that agreement or until Data is deleted, whichever is earlier.
4. Types of Data
The Data may include:
- Contact information from Customer's CRM
- Call recordings and transcripts
- Email metadata and content
- Financial records and invoices
- Incident reports and notes
5. Categories of Data Subjects
Read the whole document (2,873 characters)
Data may relate to:
- Customer's employees
- Family members of service users
- Commissioners and external stakeholders
6. Data Subject Rights
Customer shall ensure that Data Subject rights are respected. Provider shall, upon request, assist Customer in responding to Data Subject access requests, deletion requests and other rights under UK GDPR.
7. Security Measures
Provider shall implement and maintain technical and organisational security measures appropriate to the risk level, including:
- Encryption of Data at rest and in transit
- Access controls and multi-factor authentication
- Regular security reviews and penetration testing
- Incident response procedures
- Staff training on data protection
8. Sub-Processors
Provider may engage sub-processors with Customer's prior written consent. Provider shall ensure all sub-processors enter into equivalent data protection terms.
9. Data Location
Data shall be processed and stored within the United Kingdom and the European Union as specified in the Master Services Agreement.
10. Deletion and Return
Upon termination of the Master Services Agreement, Customer may request that Provider delete or return all Data. Provider shall comply within 30 days.
11. Audit Rights
Customer may audit Provider's compliance with this Agreement upon reasonable notice, no more than once per year.
12. Governing Law
This Agreement shall be governed by the laws of England and Wales and the UK GDPR.
Executed Signatures
For Pelton Grange Care:
_______________________________ Chief Operating Officer Date: 27 Aug 2025
For BB-Demo Limited:
_______________________________ Account Executive Date: 27 Aug 2025
Unusual terms
Current to 9 Oct 26- Prior written consent needed for sub-processors
- Data covers family members of service users
- Data location includes the EU