Mossbrook Data Partners - Data Processing Agreement (signed)

• Data Protection Law means the UK GDPR, the Data Protection Act and any other law on the protection of personal data that applies to either party.
• Personal Data means any information relating to an identified or identifiable person that BG-Demo processes on behalf of Mossbrook.
• Processing, controller, processor, data subject and personal data breach have the meanings given in Data Protection Law.
• Customer Snowflake Account means the Snowflake account that Mossbrook controls and in which B-Viz is deployed.
• Sub-processor means any third party engaged by BG-Demo to process Personal Data.

Roles of the parties

Mossbrook is the controller of the Personal Data. BG-Demo is the processor. Where Mossbrook processes data on behalf of its own clients, Mossbrook remains responsible for its arrangements with those clients, and the instructions it gives BG-Demo must be consistent with them.

Subject matter and purpose

BG-Demo processes Personal Data only to provide, support and improve the delivery of B-Viz to Mossbrook under the master agreement. This covers connecting approved source systems, indexing records, answering queries, running the nightly refresh and giving support.

The categories of data subject are Mossbrook's staff, contacts at its clients and prospects, and other individuals whose details appear in the systems Mossbrook chooses to connect. The types of Personal Data are business contact details, job titles, correspondence and call records, support tickets, usage records and similar business information. Mossbrook will not connect special category data unless the parties agree this in writing first.

Instructions

• BG-Demo will process Personal Data only on Mossbrook's documented instructions, including the master agreement, this agreement and the configuration Mossbrook sets in B-Viz.
• If BG-Demo believes an instruction breaches Data Protection Law, it will tell Mossbrook promptly and may pause that instruction until the point is resolved.
• BG-Demo will not use Personal Data for its own purposes or combine it with data from other customers.

Location of processing

B-Viz runs inside the Customer Snowflake Account, so Personal Data stays within the environment Mossbrook controls. BG-Demo staff access it only as far as needed to implement, support and maintain the service. Any transfer outside the United Kingdom needs Mossbrook's written agreement and an appropriate transfer mechanism under Data Protection Law.

Confidentiality and personnel

BG-Demo will make sure that everyone who can access Personal Data is bound by a duty of confidentiality, has received suitable data protection training and has access only where their role requires it.

Security

BG-Demo will keep appropriate technical and organisational measures in place to protect Personal Data, taking account of the risks and the nature of the data. These include:

• access limited by role, with named accounts and no shared credentials;
• encryption of data in transit and at rest, using the controls available in the Customer Snowflake Account;
• logging of administrative access and regular review of those logs;
• separation of customer environments;
• tested procedures for backup, recovery and the removal of access when staff leave or change role.

Mossbrook is responsible for the security of its own users, source systems and the Customer Snowflake Account.

Sub-processors

Mossbrook gives general authorisation for BG-Demo to use Sub-processors. BG-Demo will bind each Sub-processor to data protection terms no less protective than these, will remain responsible for their performance, and will tell Mossbrook before adding or replacing one so that Mossbrook has a fair chance to object. If Mossbrook objects on reasonable grounds and the parties cannot agree a solution, Mossbrook may end the affected service.

Assistance to Mossbrook

BG-Demo will, taking account of the nature of the processing, help Mossbrook to:

• respond to requests from data subjects to exercise their rights;
• carry out data protection impact assessments and prior consultations;
• meet its security and breach notification duties;
• show compliance with this agreement.

Personal data breach

BG-Demo will tell Mossbrook without undue delay after becoming aware of a personal data breach affecting Personal Data. The notice will describe what is known about the nature of the breach, the data and people affected, the likely consequences and the steps taken or proposed. BG-Demo will keep Mossbrook informed as the position develops and will help it meet any duty to notify the regulator or data subjects.

Audit

BG-Demo will give Mossbrook the information reasonably needed to show compliance with this agreement and will allow audits, including inspections, carried out by Mossbrook or an auditor it appoints. Audits will be on reasonable notice, during business hours and in a way that does not unreasonably disrupt BG-Demo or put other customers' data at risk.

Return and deletion

Because B-Viz is deployed in the Customer Snowflake Account, Mossbrook keeps its data at all times. When the services end, BG-Demo will remove its access and delete any Personal Data it holds outside that account, unless the law requires it to keep a copy. BG-Demo will confirm this in writing if Mossbrook asks.

Liability and term

Liability under this agreement is governed by the limits in the master agreement. This agreement starts on the effective date and continues for as long as BG-Demo processes Personal Data for Mossbrook. The clauses on confidentiality, breach, audit and deletion continue after that point for as long as they are relevant. This agreement is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.

Signatures

Signed by the authorised representatives of the parties on 15 August 2025.