Astley Brook Packaging - Data Processing Agreement (signed)
Documentexecuted Astley Brook Packaging · dpa · executed · 20 Feb 2026
Executed DPA under the Master Services Agreement, signed 20 Feb 2026 by Sophie Ling for BG-Demo and an authorised signatory for the customer. Personal data stays in the customer's own Snowflake account. It states no price, availability or response times.
What it says
What this says
As at Fri 9 Oct 2026Executed DPA under the Master Services Agreement, signed 20 Feb 2026 by Sophie Ling for BG-Demo and an authorised signatory for the customer. Personal data stays in the customer's own Snowflake account. It states no price, availability or response times.
What it is: an executed data processing agreement that "sits under the Master Services Agreement", with the customer as Controller and BG-Demo as Processor. It covers personal data handled in providing B-Viz, not BG-Demo's own contact details for the customer's staff.
Commits: BG-Demo processes data only on documented instructions, keeps security measures in place and tells the customer "without undue delay" after a personal data breach. Data stays in the customer's Snowflake account, and any transfer outside the United Kingdom needs prior written agreement.
Unusual: nothing off the standard terms. Subprocessors are generally authorised, with notice and a fair chance to object. Audits are allowed on reasonable notice. On conflict over personal data, this agreement prevails over the Master Services Agreement.
Not settled: the document states no price, service levels, term or renewal date, and does not name the customer signatory. Liability limits sit in the Master Services Agreement, which is not in this document.
As found in this document
As at Fri 9 Oct 2026- Date signed20 Feb 2026Source: the AI read of this record
- Instructionsprocess personal data only on the Controller's instructionsSource: the AI read of this record
- Breach notificationtell the Controller without undue delay after becoming aware of a personal data breach affecting its dataSource: the AI read of this record
- Data residencyPersonal data stays in the Controller's own Snowflake accountSource: the AI read of this record
- Transfers outside the United Kingdomneeds the Controller's prior written agreement and a lawful transfer mechanismSource: the AI read of this record
- Subprocessorsgive the Controller notice of any new subprocessor and a fair chance to objectSource: the AI read of this record
- Auditon reasonable notice and during business hoursSource: the AI read of this record
- Return and deletionremove its access and delete any personal data copies it holds, unless the law requires it to keep themSource: the AI read of this record
Body
Astley Brook Packaging - Data Processing Agreement (signed)
Status: Executed Version: 1 Date of signature: 20 Feb 2026
Parties
This Data Processing Agreement sits under the Master Services Agreement between Astley Brook Packaging, of Bolton (the "Controller"), and BG-Demo, of London (the "Processor"). It was signed on 20 Feb 2026.
Purpose and Scope
The Processor provides B-Viz to the Controller. B-Viz is built and run inside the Controller's own Snowflake account and brings together data from the Controller's business systems, such as its CRM, calls, emails, tickets and finance records, so that its teams can see each brand's orders, complaints and invoices together.
This Agreement covers personal data the Processor handles on the Controller's behalf in providing B-Viz. It does not cover personal data the Processor holds for its own purposes, such as business contact details of the Controller's staff.
Roles
The Controller decides why and how personal data is processed. The Processor processes it only on the Controller's documented instructions, which are the Master Services Agreement, this Agreement and any later written instruction.
Read the whole document (4,128 characters)
Categories of Data and Data Subjects
| Item | Description |
|---|---|
| Data subjects | Staff of the Controller, and contacts at the Controller's customers and suppliers, as they appear in connected systems |
| Personal data | Names, business contact details, job titles, messages, call content and account or order references held in connected systems |
| Special categories | None are intended. The Controller will not connect systems for the purpose of processing them |
Processor Obligations
The Processor will:
- process personal data only on the Controller's instructions, unless the law requires otherwise, in which case it will tell the Controller first where permitted;
- make sure everyone with access to personal data is bound by confidentiality;
- keep appropriate technical and organisational security measures in place;
- help the Controller respond to requests from individuals exercising their data protection rights;
- help the Controller with security, impact assessments and consultation with the regulator, as far as the nature of the processing allows;
- tell the Controller without undue delay after becoming aware of a personal data breach affecting its data.
Location and Data Residency
Personal data stays in the Controller's own Snowflake account. The Processor will not move it out of that account except on the Controller's written instruction. Any transfer outside the United Kingdom needs the Controller's prior written agreement and a lawful transfer mechanism.
Subprocessors
The Controller gives general authorisation for the Processor to use subprocessors where needed to provide B-Viz. The Processor will:
- bind each subprocessor to data protection terms no less protective than these;
- give the Controller notice of any new subprocessor and a fair chance to object;
- remain responsible for its subprocessors' performance.
Audit
The Processor will give the Controller the information reasonably needed to show compliance with this Agreement and will allow audits, including inspections, by the Controller or an auditor it appoints, on reasonable notice and during business hours.
Return and Deletion
Because the data stays in the Controller's own Snowflake account, the Controller keeps control of it throughout. When the services end, the Processor will remove its access and delete any personal data copies it holds, unless the law requires it to keep them.
Liability and Order of Precedence
Liability under this Agreement is governed by the limits in the Master Services Agreement. If this Agreement conflicts with the Master Services Agreement on the handling of personal data, this Agreement prevails.
Signatures
| For BG-Demo (Processor) | For Astley Brook Packaging (Controller) | |
|---|---|---|
| Name | Sophie Ling | Authorised signatory |
| Title | Account Executive | Authorised signatory for the Controller |
| Date | 20 Feb 2026 | 20 Feb 2026 |