Strensall Merchants - Data Processing Agreement (signed)

Terms such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018. "Data Protection Law" means those laws and any legislation that replaces or supplements them.

Roles and instructions

• The Customer is the controller of the personal data processed under this DPA. The Supplier is the processor.
• The Supplier will process personal data only on the Customer's documented instructions, which are the master agreement, the order form, this DPA and any written instruction the Customer gives during the term.
• If the Supplier believes an instruction infringes Data Protection Law, it will tell the Customer promptly and may pause that processing until the position is clear.

Scope of processing

Customer responsibilities

The Customer will make sure it has a lawful basis for the processing, that its own notices to data subjects are adequate, and that the connectors it asks the Supplier to configure are authorised sources of data.

Supplier obligations

The Supplier will:

• keep personal data confidential and make sure everyone who may access it is bound by a duty of confidentiality;
• apply the technical and organisational measures described in the security section below;
• help the Customer respond to requests from data subjects exercising their rights, taking into account the nature of the processing;
• help the Customer meet its obligations on security, breach notification, impact assessments and consultation with the regulator, so far as they relate to the service;
• keep records of processing carried out for the Customer.

Location of data

Because B-Viz runs inside the Customer's own Snowflake account, personal data stays in the environment the Customer controls. The Supplier will not copy personal data out of that account except where the Customer instructs it in writing, and will not move it to another country without the Customer's prior written agreement. Any dedicated data residency requirement is handled through the order form and not through this DPA.

Security

The Supplier maintains measures appropriate to the risk, including:

• access to the Customer's environment limited to named staff with a need to know;
• strong authentication, with single sign-on and automated user provisioning available to the Customer on the Enterprise tier;
• logging of administrative access;
• separation of the Customer's data from that of other customers;
• regular review of access rights, and removal of access when a person leaves the Supplier.

The Supplier will support the Customer's security review and will answer reasonable written questions about these measures.

Sub-processors

The Customer gives general authorisation for the Supplier to use sub-processors. The Supplier will keep a current list available to the Customer, will tell the Customer before adding or replacing one, and will give the Customer a fair opportunity to object on reasonable data protection grounds. The Supplier remains responsible for its sub-processors and will bind them to terms no less protective than this DPA.

Personal data breaches

The Supplier will tell the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's personal data. The notice will describe, as far as known, what happened, the data and data subjects affected, the likely consequences and the steps taken or proposed. The Supplier will keep the Customer updated and will cooperate in any investigation. The Customer decides whether to notify the regulator or data subjects.

Audit

The Supplier will make available the information reasonably needed to show compliance with this DPA and will allow audits by the Customer or an auditor it appoints, on reasonable notice, during business hours and without unreasonable disruption to the Supplier's other customers. Each party bears its own costs unless an audit shows a material breach by the Supplier.

Return and deletion

On expiry or termination of the subscription, the Supplier will stop processing and, at the Customer's choice, return or delete the personal data it holds, and remove its access to the Customer's Snowflake account within a reasonable period. Because the data sits in the Customer's account, the Customer retains its own source data throughout. The Supplier may keep copies only where law requires, and will say so in writing.

Liability and order of precedence

Liability under this DPA is subject to the limits in the master agreement. If this DPA conflicts with the master agreement on the processing of personal data, this DPA prevails. If it conflicts with an executed order form on commercial terms, the executed order form prevails.

Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction, in line with the master agreement.

Signatures

Signed by the authorised representatives of the parties on 14 Feb 2025.