Penwortham Mutual

Penwortham Mutual has an executed Enterprise order form, MSA and DPA, all dated 14 May 2026: £119k Annual, 28 May 2026 to 27 May 2027, billed quarterly in advance. Open points are the refresh wording, 12 versus 20 connectors and unnamed customer signatories.

Executed: Three documents are filed executed, all dated 14 May 2026: the order form, the Master Services Agreement and the Data Processing Agreement. The order form sets £119k Annual (£125k less 5%) plus £30k implementation, for 28 May 2026 to 27 May 2027.

Billing: the order form bills quarterly in advance on Net 30 days, for up to 150 users and up to 12 connectors. It renews automatically unless either party gives 90 days' notice of non-renewal.

Open items: three documents are drafts or lapsed offers. The executed paper supersedes all three.

• Proposal v1, draft, 30 Mar 2026: £119k subscription, up to 20 connectors.
• Proposal, final, 2 Apr 2026: same price, 20 data connectors, valid for 30 days.
• MSA v2, draft, 23 Apr 2026: unsigned, signature blocks blank.

Contradictions: the documents disagree on several points.

• Refresh: the order form says daily by 07:00 UK time; the signed MSA says business days.
• P1: the signed MSA qualifies the 30-minute response as UK business hours; the order form does not.
• Connectors: the order form caps at 12; the 2 Apr 2026 proposal and the 23 Apr 2026 draft MSA offer 20.
• Billing: the 23 Apr 2026 draft MSA says both quarterly and annual in advance; the executed copies say quarterly.
• Governing paper: the order form and signed MSA describe the DPA as still to be executed, yet the DPA is filed executed on 14 May 2026.
• Roles: the 2 Jun 2026 onboarding plan names Matteo Ricci as customer project owner; the proposals name him as BG-Demo Account Executive.

Commitments: the executed documents bind BG-Demo to the following.

• 99.9% availability, 30-minute P1 response, refresh by 07:00 UK time.
• Service credit of 10% of monthly subscription fee per month of SLA breach, covering availability and freshness.
• Implementation within 12 weeks of the Effective Date, with £30k due upon execution.
• 90 days' notice of non-renewal ahead of 27 May 2027.
• DPA: processing only on documented instructions, with no sub-processors or transfers outside the UK without authorisation.

Gaps: all 8 documents were read. The customer signatory on the executed documents appears only as Authorised Representative, and the order form's customer block carries no date.

The documents do not show whether go-live happened within the 12 weeks. The 22 Mar 2026 security questionnaire says ISO 27001 is planned for late 2026, not held.

AI · claude-opus-5-5 · as at Fri 9 Oct 2026