Calderbrook Housing Group - Data Processing Agreement (signed)
Documentexecuted Calderbrook Housing Group · dpa · executed · 16 Aug 2024
Executed DPA dated 16 Aug 2024 between Calderbrook Housing Group (controller) and BG-Demo (processor), signed electronically by both sides. It sets no price, availability or response-time figures; it covers processing scope, security, breach notice, audit and deletion.
What it says
What this says
As at Fri 9 Oct 2026Executed DPA dated 16 Aug 2024 between Calderbrook Housing Group (controller) and BG-Demo (processor), signed electronically by both sides. It sets no price, availability or response-time figures; it covers processing scope, security, breach notice, audit and deletion.
What it is: a data processing agreement forming part of the agreement under which BG-Demo provides B-Glass. Calderbrook is the controller and BG-Demo the processor, with processing "only on the Customer's documented instructions".
Commits: BG-Demo will notify a personal data breach "without undue delay", will not engage a sub-processor without "prior written authorisation", and will not transfer data outside the United Kingdom except on documented instructions. On termination it returns or deletes Customer Data at the Customer's choice.
Unusual: audit is on "reasonable notice" with no fixed period. The DPA prevails over the main agreement on personal data handling.
Not settled: it states no price, term length, renewal date, service levels or breach-notice deadline in hours. The Calderbrook signatory is not named, only "Authorised signatory of Calderbrook Housing Group".
As found in this document
As at Fri 9 Oct 2026- Date signed16 Aug 2024Source: the AI read of this record
- Processing instructionsBG-Demo will process Customer Data only to provide the Services and only on the Customer's documented instructionsSource: the AI read of this record
- Personal data breach noticeBG-Demo will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer DataSource: the AI read of this record
- Sub-processorsBG-Demo will not engage another processor for Customer Data without the Customer's prior written authorisation, general or specificSource: the AI read of this record
- International transfersBG-Demo will not transfer Customer Data outside the United Kingdom except on the Customer's documented instructionsSource: the AI read of this record
- Return and deletionOn termination or expiry of the Services, BG-Demo will, at the Customer's choice, return or delete Customer DataSource: the AI read of this record
The document
Body
Calderbrook Housing Group - Data Processing Agreement (signed)
Status: Executed Date of agreement: 16 Aug 2024
This Data Processing Agreement (the "DPA") forms part of the agreement between BG-Demo and Calderbrook Housing Group under which BG-Demo provides B-Glass. It sets out how BG-Demo handles personal data on behalf of Calderbrook Housing Group.
Parties
| Role | Party | Description |
|---|---|---|
| Controller (the "Customer") | Calderbrook Housing Group | Housing association, headquartered in Leeds, United Kingdom |
| Processor (the "Supplier") | BG-Demo | London data business providing B-Glass |
The Customer's account owner at BG-Demo is Tom Ashdown, Account Executive. The Customer's customer success manager is Daniel Okafor.
Clause one: Definitions
Terms such as "personal data", "controller", "processor", "data subject", "processing" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act. "Services" means the implementation and subscription services provided by BG-Demo to the Customer. "Customer Data" means all personal data processed by BG-Demo on the Customer's behalf in providing the Services.
Read the whole document (6,867 characters)
Clause two: Roles and scope
The Customer is the controller and BG-Demo is the processor of Customer Data. BG-Demo will process Customer Data only to provide the Services and only on the Customer's documented instructions, which are this DPA and the order form and any written instruction the Customer gives during the term. If BG-Demo believes an instruction breaches data protection law, it will tell the Customer promptly.
Clause three: Details of processing
| Item | Detail |
|---|---|
| Subject matter | Provision of B-Glass: a queryable layer over the Customer's connected business systems |
| Duration | The term of the agreement, and any period needed to return or delete Customer Data afterwards |
| Nature of processing | Indexing, storage, retrieval and analysis of Customer Data so the Customer's teams can ask questions of it |
| Purpose | Giving the Customer's business-intelligence team and other authorised users a single, board-ready view across tenant calls, repairs tickets, complaints and rent arrears |
| Data subjects | Tenants and residents, applicants, employees and contractors of the Customer, and staff of third parties who appear in the Customer's records |
| Types of personal data | Contact details, call recordings and transcripts, case and ticket records, account and arrears information and any other personal data held in the systems the Customer chooses to connect |
| Location | Inside the Customer's own Snowflake account, under the Customer's control |
Clause four: Customer obligations
The Customer confirms that it has a lawful basis for the processing it instructs, that it has given any required notices to data subjects, and that it decides which systems are connected to the brain. The Customer is responsible for the accuracy and quality of the data in those systems.
Clause five: Supplier obligations
BG-Demo will:
- process Customer Data only on the Customer's documented instructions;
- ensure that everyone authorised to process Customer Data is bound by a duty of confidentiality;
- apply appropriate technical and organisational measures, described in the security schedule below;
- help the Customer respond to requests from data subjects exercising their rights, so far as is reasonably possible;
- help the Customer meet its obligations on security, breach notification, impact assessments and prior consultation;
- make available the information reasonably needed to show compliance with this DPA.
Clause six: Security measures
Because the brain is built and run inside the Customer's own Snowflake account, Customer Data stays within the Customer's environment and under its access controls. BG-Demo will:
- limit access to the Customer's environment to named staff who need it to deliver and support the Services;
- use role-based access and keep records of who has access;
- protect credentials and connection details used for the connected systems;
- keep Customer Data separate from the data of other customers;
- test and review its security practices regularly.
Clause seven: Sub-processors
BG-Demo will not engage another processor for Customer Data without the Customer's prior written authorisation, general or specific. Where authorisation is given, BG-Demo will impose data protection obligations on the sub-processor that are no less protective than those in this DPA and remains responsible for the sub-processor's performance. The Customer's Snowflake account is provided under the Customer's own arrangements with its platform provider.
Clause eight: International transfers
BG-Demo will not transfer Customer Data outside the United Kingdom except on the Customer's documented instructions and with an appropriate transfer mechanism in place under data protection law.
Clause nine: Personal data breach
BG-Demo will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data. The notice will describe, so far as known, the nature of the breach, the data and data subjects affected, the likely consequences and the steps taken or proposed. BG-Demo will cooperate with the Customer's investigation and any notification to the regulator or to data subjects.
Clause ten: Audit
The Customer may, on reasonable notice and no more than is needed to verify compliance, audit BG-Demo's processing of Customer Data or appoint an independent auditor bound by confidentiality. BG-Demo will cooperate and will provide relevant records and access to the relevant staff.
Clause eleven: Return and deletion
On termination or expiry of the Services, BG-Demo will, at the Customer's choice, return or delete Customer Data and remove the brain's indexes and derived copies, unless the law requires retention. Because the data sits in the Customer's own Snowflake account, the Customer keeps control of the underlying records throughout.
Clause twelve: Liability and governing law
Liability under this DPA is subject to the limits in the main agreement. This DPA is governed by the law of England and Wales and the courts of England and Wales have jurisdiction over any dispute arising from it.
Clause thirteen: Order of precedence
If there is a conflict between this DPA and the main agreement on the handling of personal data, this DPA prevails.
Signatures
Signed by the parties' authorised representatives on 16 Aug 2024.
| For Calderbrook Housing Group | For BG-Demo | |
|---|---|---|
| Name | Authorised signatory of Calderbrook Housing Group | Tom Ashdown |
| Title | Authorised signatory | Account Executive |
| Signed | Signed electronically | Signed electronically |
| Date | 16 Aug 2024 | 16 Aug 2024 |
Unusual terms
As at Fri 9 Oct 2026- Audit on reasonable notice with no fixed period
- DPA prevails over main agreement on personal data
- No breach-notice deadline in hours