Marlcliff Security Services - Data Processing Agreement (signed)

Terms such as "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the UK GDPR. In this DPA:

• Customer Personal Data means personal data processed by BG-Demo on behalf of the Customer in connection with the services.
• Services means the B-Viz subscription, the implementation work and the support described in the order form.
• Connected Systems means the Customer's own systems that it chooses to connect to B-Viz, for example its CRM, call recorder, helpdesk, accounting system and mailboxes.
• Customer Snowflake Account means the Snowflake account owned and administered by the Customer in which B-Viz runs.

Clause two: Roles of the parties

The Customer is the controller of Customer Personal Data and BG-Demo is its processor. The Customer is responsible for having a lawful basis for the processing, for the instructions it gives, and for telling the people whose data is involved, including its staff, its clients' contacts and the individuals recorded on calls, how their data is used.

Clause three: Subject matter, nature and purpose

The parties do not intend BG-Demo to process special category data. If the Customer's connected systems hold such data, the Customer will tell BG-Demo before connecting them so that the parties can agree any extra safeguards in writing.

Clause four: Instructions

BG-Demo will process Customer Personal Data only on the Customer's documented instructions, which are this DPA, the order form and the Customer's configuration of B-Viz. If BG-Demo believes an instruction breaches data protection law, it will say so promptly and may pause that instruction until the Customer confirms.

Clause five: Confidentiality

BG-Demo will make sure that everyone who can access Customer Personal Data is bound by a duty of confidentiality, has been trained in data protection, and has access only where their work requires it.

Clause six: Security

BG-Demo will keep appropriate technical and organisational measures in place, taking account of the nature of the data and the risks. In particular:

• Customer Personal Data stays in the Customer Snowflake Account, and BG-Demo does not copy it into systems outside that account except as the Customer instructs.
• Access by BG-Demo staff is limited to named people, uses strong authentication, and is removed when no longer needed.
• Connectors read from Connected Systems using credentials the Customer provides and can revoke at any time.
• Changes to the B-Viz environment are logged so that the Customer can review them.

The Customer is responsible for the security of its own Snowflake Account and Connected Systems, including who it grants access to.

Clause seven: Sub-processors

The Customer gives general authorisation for BG-Demo to use sub-processors needed to deliver the Services. BG-Demo will keep a current list available to the Customer and give notice of any intended addition or replacement, so that the Customer can object on reasonable data protection grounds. BG-Demo will bind each sub-processor to terms no less protective than this DPA and remains responsible for their performance.

Clause eight: International transfers

BG-Demo will not transfer Customer Personal Data outside the United Kingdom except on the Customer's instructions, or where a lawful transfer mechanism is in place and the Customer has been told. Where the Customer chooses a data residency add-on, the location stated in the order form applies.

Clause nine: Assistance to the Customer

Taking account of the nature of the processing, BG-Demo will help the Customer to:

• respond to requests from data subjects exercising their rights, by passing on any request it receives without delay and not replying itself unless told to;
• carry out data protection impact assessments and any consultation with the regulator that follows;
• meet its security and breach notification obligations.

Clause ten: Personal data breaches

BG-Demo will tell the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, what happened, the data and people affected, the likely consequences and the steps taken or proposed. BG-Demo will keep the Customer updated as it learns more and will help with any notification the Customer has to make.

Clause eleven: Audit and information

BG-Demo will give the Customer the information needed to show compliance with this DPA and will allow reasonable audits, including inspections, by the Customer or an auditor it appoints. The Customer will give reasonable notice, keep audits proportionate, and respect BG-Demo's confidentiality and the security of its other customers. Because B-Viz runs in the Customer Snowflake Account, the Customer can also review access and activity logs directly.

Clause twelve: Return and deletion

On the end of the Services, or earlier on the Customer's written request, BG-Demo will remove its access to the Customer Snowflake Account and Connected Systems and delete any Customer Personal Data it holds outside that account. Data inside the Customer Snowflake Account remains the Customer's to keep or delete. BG-Demo may keep data only where the law requires it, and will then keep it confidential and protected.

Clause thirteen: Liability and precedence

Liability under this DPA is subject to the limits in the master agreement. If this DPA conflicts with the master agreement or the order form on the processing of personal data, this DPA prevails.

Clause fourteen: Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction, subject to anything the master agreement says to the contrary.

Contacts

Signatures

Signed by the authorised representatives of the parties on Thursday 22 May 2025.