Kelbrook Mutual Insurance - Data Processing Agreement (signed)

Terms such as "personal data", "processing", "controller", "processor", "data subject" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018 (together, "Data Protection Law"). "Customer Data" means personal data that BG-Demo processes on the Customer's behalf under the Agreement.

Scope and purpose of processing

Responsibilities of the parties

Controller instructions

1. BG-Demo will process Customer Data only on the Customer's documented instructions, which are the Agreement, this DPA and the configuration the Customer sets in B-Viz.
2. If BG-Demo believes an instruction breaches Data Protection Law, it will tell the Customer promptly and may pause that part of the processing until the point is settled.
3. The Customer confirms it has a lawful basis for the processing and has given data subjects the information they are entitled to.

Processing inside the Customer's Snowflake account

1. B-Viz runs inside the Customer's own Snowflake account. Customer Data stays in that account and is not copied to a BG-Demo environment, except where the Customer asks for it in writing for a specific support purpose.
2. The Customer controls the access that BG-Demo staff have to its Snowflake account. BG-Demo will use only the access it has been granted and will keep it to the minimum its work needs.
3. Data location is governed by where the Customer's Snowflake account is hosted. BG-Demo will not move Customer Data to another location without the Customer's written agreement.

Confidentiality

BG-Demo will make sure that everyone who can reach Customer Data is bound by a duty of confidentiality, has had suitable data protection training, and has access only where their role needs it.

Security

BG-Demo will keep appropriate technical and organisational measures in place to protect Customer Data, taking into account the risk, the state of the art and the cost of implementation. These include:

• access limited by role, with individual accounts and no shared credentials;
• encryption of Customer Data in transit and at rest, using the controls provided by the Customer's Snowflake account;
• logging of administrative access and changes to connectors;
• separation of customer environments;
• background checks and confidentiality terms for BG-Demo staff;
• a documented process for reviewing and removing access when someone changes role or leaves BG-Demo.

The Customer is responsible for the security settings of its own Snowflake account and of the source systems it connects.

Sub-processors

1. The Customer gives general authorisation for BG-Demo to use sub-processors, provided BG-Demo has a written contract with each that imposes data protection duties no less protective than those in this DPA.
2. BG-Demo will give the Customer notice before adding or replacing a sub-processor that would process Customer Data, so the Customer has a fair chance to object.
3. If the Customer objects on reasonable data protection grounds, the parties will talk in good faith to find a workable alternative.
4. BG-Demo remains responsible to the Customer for the acts of its sub-processors.

Assistance to the Customer

Taking into account the nature of the processing, BG-Demo will help the Customer, at a reasonable level and without undue delay, to:

• respond to requests from data subjects exercising their rights, and will pass on to the Customer any such request it receives directly rather than answering it itself;
• carry out data protection impact assessments and any consultation with the regulator that follows;
• meet its security and breach notification duties under Data Protection Law.

Personal data breach

1. BG-Demo will tell the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data.
2. The notice will describe, as far as known, the nature of the breach, the categories and approximate volume of data and data subjects concerned, the likely consequences, and the steps taken or proposed.
3. BG-Demo will take reasonable steps to contain the breach and will keep the Customer updated as more becomes known. The Customer decides whether and how to notify the regulator and data subjects.

International transfers

BG-Demo will not transfer Customer Data outside the United Kingdom, or allow access to it from outside the United Kingdom, unless a lawful transfer mechanism is in place under Data Protection Law and the Customer has been told beforehand.

Audit and information

1. BG-Demo will make available the information reasonably needed to show compliance with this DPA.
2. The Customer may audit BG-Demo's compliance, either itself or through an independent auditor bound by confidentiality, on reasonable notice, during business hours and in a way that does not unreasonably disrupt BG-Demo's business.
3. Because B-Viz runs in the Customer's Snowflake account, much of the evidence, such as access logs, is already available to the Customer directly. The parties will use it first before asking for anything further.

Return and deletion

When the Agreement ends, or earlier if the Customer asks, BG-Demo will stop processing Customer Data and remove the B-Viz components and any BG-Demo access from the Customer's Snowflake account. Any Customer Data that BG-Demo holds outside that account will be deleted or returned, at the Customer's choice, unless the law requires it to be kept. BG-Demo will confirm in writing once this is done.

Liability and precedence

Liability under this DPA is subject to the limits and exclusions set out in the Agreement. If this DPA conflicts with any other part of the Agreement on the handling of personal data, this DPA prevails.

Governing law

This DPA is governed by the laws of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it.

Contacts

Signatures

Signed by the authorised representatives of the parties on 3 Jan 2024.