Kronfeld Assekuranz - Data Processing Agreement (signed)
Documentexecuted Kronfeld Assekuranz · dpa · executed · 2026-03-23
Executed DPA between BB-Demo Limited (Processor) and Kronfeld Assekuranz (Controller), signed 23 Mar 2026 under the Master Service Agreement of the same date. It states no price, availability or response-time figures.
What it says
What this says
Current to 13 Oct 26Executed DPA between BB-Demo Limited (Processor) and Kronfeld Assekuranz (Controller), signed 23 Mar 2026 under the Master Service Agreement of the same date. It states no price, availability or response-time figures.
What it is: an executed data processing agreement that forms part of the Master Service Agreement dated 23 Mar 2026. It governs personal data processing for the Company Brain service, signed by Tom Ashdown for BB-Demo and Matteo Ricci, Account Owner, for Kronfeld Assekuranz.
Commits: the Processor acts only on documented instructions, and "shall not transfer personal data outside the United Kingdom or European Economic Area without prior written consent". Sub-processors need the Controller's prior written consent, and personal data is deleted or returned on termination at the Controller's choice.
Unusual: nothing off the standard terms in the commercial sense, but the sub-processor and transfer clauses both require prior written consent, which is a tight operating constraint.
Not settled: the categories of data, data subjects and processing activities are only referred to the principal agreement. The document states no price, service levels, term dates or renewal.
As found in this document
Current to 9 Oct 26- Date signed23 Mar 2026Source: object_read:doc_177_006
- International transfersThe Processor shall not transfer personal data outside the United Kingdom or European Economic Area without prior written consent from the ControllerThe Processor shall not transfer personal data outside the United Kingdom or European Economic Area without prior written consent from the Controller · Source: object_read:doc_177_006
- Sub-processorsThe Processor may engage sub-processors only with the Controller's prior written consent.The Processor may engage sub-processors only with the Controller's prior written consent. · Source: object_read:doc_177_006
- Data subject requestsThe Processor shall inform the Controller without undue delay if it receives a request from a data subject.The Processor shall inform the Controller without undue delay if it receives a request from a data subject. · Source: object_read:doc_177_006
- TerminationOn termination, the Processor shall, at the Controller's choice, delete or return all personal data and delete existing copies unless law requires storage.On termination, the Processor shall, at the Controller's choice, delete or return all personal data and delete existing copies unless law requires storage. · Source: object_read:doc_177_006
The document
Body
Kronfeld Assekuranz - Data Processing Agreement
Version: 1 Status: Executed, 23 Mar 2026
1. Introduction
This Data Processing Agreement ("DPA") is entered into between BB-Demo Limited, a company registered in England and Wales ("Processor"), and Kronfeld Assekuranz ("Controller").
This DPA forms part of the Master Service Agreement dated 23 Mar 2026 and governs the processing of personal data by the Processor on behalf of the Controller in connection with the provision of the Company Brain service.
2. Scope and Purpose
The Processor shall process personal data only on documented instructions from the Controller and solely for the purpose of providing the services described in the Service Schedule. The categories of personal data, types of data subjects, duration of processing and nature of processing activities are set out in the principal agreement.
3. Processor Obligations
The Processor shall:
Read the whole document (3,185 characters)
- Process personal data only in accordance with the Controller's documented instructions;
- Ensure that persons authorised to process personal data are bound by a duty of confidentiality;
- Implement appropriate technical and organisational measures to ensure the security of personal data, including protection against unauthorised processing;
- Not engage sub-processors without prior specific or general written authorisation from the Controller;
- Assist the Controller in fulfilling data subject rights requests;
- Upon termination or expiry of services, delete or return all personal data unless EU or UK law requires storage;
- Make available to the Controller all information necessary to demonstrate compliance and allow for audits.
4. Data Subject Rights
The Processor shall assist the Controller in fulfilling the rights of data subjects under applicable data protection law, including rights of access, rectification, erasure and restriction of processing. The Processor shall inform the Controller without undue delay if it receives a request from a data subject.
5. International Transfers
The Processor shall not transfer personal data outside the United Kingdom or European Economic Area without prior written consent from the Controller and shall implement appropriate safeguards as required by law.
6. Sub-processors
The Processor may engage sub-processors only with the Controller's prior written consent. A current list of authorised sub-processors is maintained and provided to the Controller on request.
7. Duration and Termination
This DPA shall remain in effect for the duration of the principal agreement and shall survive its termination. On termination, the Processor shall, at the Controller's choice, delete or return all personal data and delete existing copies unless law requires storage.
8. Liability
Nothing in this DPA limits the liability of either party for breaches of data protection law. The Controller remains responsible for the legality of the basis for processing and the accuracy of the personal data.
Signatures
BB-Demo Limited Tom Ashdown Account Executive Signed: 23 Mar 2026
Kronfeld Assekuranz Matteo Ricci Account Owner Signed: 23 Mar 2026
Unusual terms
Current to 9 Oct 26- Prior written consent for any sub-processor
- Prior written consent for transfers outside the UK or EEA