Duddingston Payroll - Data Processing Agreement (signed)
Documentexecuted Duddingston Payroll · dpa · executed · 27 Jan 2025
Executed data processing agreement signed on 27 Jan 2025, under the Master Services Agreement. Duddingston Payroll is controller and BG-Demo processor. It states no availability, response time or price.
What it says
What this says
As at Fri 9 Oct 2026Executed data processing agreement signed on 27 Jan 2025, under the Master Services Agreement. Duddingston Payroll is controller and BG-Demo processor. It states no availability, response time or price.
What it is: an executed DPA that sits under the Master Services Agreement signed the same day. It says "If the two conflict on the handling of personal data, this agreement prevails."
Commits: BG-Demo processes data only on documented instructions, notifies breaches "without undue delay", and will not engage another processor without the Customer's authorisation. It removes the B-Viz layer from the Snowflake account when services end.
Unusual: the breach duty has no fixed hour count, and the audit right is on "reasonable notice". Data stays in the Customer's Snowflake account, with no move to another country except on documented instruction.
Not settled: no price, service level, renewal date or end date. The Customer signatory is shown only as an authorised signatory, with no name or role. The Master Services Agreement itself is not in this document.
As found in this document
As at Fri 9 Oct 2026- Date signed27 Jan 2025Source: the AI read of this record
- Date start27 Jan 2025Source: the AI read of this record
- InstructionsBG-Demo will process personal data only on the Customer's documented instructionsSource: the AI read of this record
- Breach notificationwithout undue delay after becoming aware of a personal data breach affecting the Customer's dataSource: the AI read of this record
- Sub-processorsBG-Demo will not engage another processor for the personal data without the Customer's authorisationSource: the AI read of this record
- Location and transfersBG-Demo will not move it outside that account or to another country except on the Customer's documented instructionSource: the AI read of this record
- Return and deletionBG-Demo will remove the B-Viz layer from the Customer's Snowflake account and stop processing the personal dataSource: the AI read of this record
- Auditreasonable audits by the Customer or an auditor it appoints, on reasonable noticeSource: the AI read of this record
- Termstarts on signature and continues for as long as BG-Demo processes personal data for the Customer under the Master Services AgreementSource: the AI read of this record
The document
Body
Duddingston Payroll - Data Processing Agreement (signed)
Status: Executed. Signed on 27 Jan 2025.
This Data Processing Agreement sits under the Master Services Agreement between BG-Demo and Duddingston Payroll signed on the same date. If the two conflict on the handling of personal data, this agreement prevails.
Parties and roles
- Duddingston Payroll is the controller of the personal data it brings into B-Viz. It is an outsourced payroll and HR-administration bureau based in Edinburgh, and it acts for its own employer clients.
- BG-Demo is the processor and processes that personal data only to provide B-Viz.
Subject matter and nature of processing
B-Viz is built and run inside the Customer's own Snowflake account. BG-Demo indexes and makes searchable the data from the systems the Customer chooses to connect, so that its client managers can ask questions across payroll queries, deadlines, calls and fees.
The categories of data are those held in the connected systems, which may include employee and client contact details, payroll-related queries and call content. The Customer decides which sources are connected.
Clause A: Instructions
Read the whole document (3,991 characters)
BG-Demo will process personal data only on the Customer's documented instructions, which include the Master Services Agreement and the configuration the Customer sets in B-Viz. If BG-Demo believes an instruction breaches data protection law, it will tell the Customer promptly.
Clause B: Confidentiality
BG-Demo will make sure that everyone authorised to process the personal data is bound by a duty of confidentiality and has access only where their work requires it.
Clause C: Security
BG-Demo will keep appropriate technical and organisational measures in place to protect the personal data. Because B-Viz runs inside the Customer's Snowflake account, the data stays within the Customer's own environment and access controls, and BG-Demo works within the permissions the Customer grants.
Clause D: Sub-processors
BG-Demo will not engage another processor for the personal data without the Customer's authorisation. Where one is engaged, BG-Demo will bind it to obligations equivalent to these and remains responsible for its performance.
Clause E: Assistance to the Customer
Taking account of the nature of the processing, BG-Demo will help the Customer to:
- respond to requests from individuals exercising their rights;
- meet its security and impact-assessment obligations; and
- consult the regulator where that is needed.
Clause F: Personal data breaches
BG-Demo will tell the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data. It will give the information the Customer reasonably needs to meet its own notification duties, and will help to contain and investigate the incident.
Clause G: Location and transfers
The data is held in the Customer's Snowflake account, and BG-Demo will not move it outside that account or to another country except on the Customer's documented instruction.
Clause H: Return and deletion
When the services end, BG-Demo will remove the B-Viz layer from the Customer's Snowflake account and stop processing the personal data, unless the law requires otherwise. The Customer keeps its source systems and its own data throughout.
Clause I: Audit
BG-Demo will make available the information needed to show that it meets this agreement and will allow reasonable audits by the Customer or an auditor it appoints, on reasonable notice and without disrupting BG-Demo's other customers.
Clause J: Term
This agreement starts on signature and continues for as long as BG-Demo processes personal data for the Customer under the Master Services Agreement.
Signatures
| For BG-Demo | For Duddingston Payroll | |
|---|---|---|
| Name | Priya Raman | Authorised signatory |
| Title | Account Executive | Authorised signatory of the Customer |
| Date | 27 Jan 2025 | 27 Jan 2025 |
Unusual terms
As at Fri 9 Oct 2026- Breach notice with no fixed time limit
- Prevails over the Master Services Agreement on personal data
- Customer authorisation needed for any sub-processor