Kingdon Diagnostics - Data Processing Agreement (signed)
Documentexecuted Kingdon Diagnostics · dpa · executed · 2024-12-23
Executed Data Processing Agreement signed 23 Dec 2024 under the Master Services Agreement, with Kingdon Diagnostics as Controller and BB-Demo as Processor. It states no price, availability or response-time figures, and no renewal date.
What it says
What this says
Current to 13 Oct 26Executed Data Processing Agreement signed 23 Dec 2024 under the Master Services Agreement, with Kingdon Diagnostics as Controller and BB-Demo as Processor. It states no price, availability or response-time figures, and no renewal date.
What it is: an executed DPA signed on 23 Dec 2024, sitting under the Master Services Agreement signed the same date. Kingdon Diagnostics is the "Controller" and BB-Demo the "Processor".
Commits: BB-Demo processes personal data "only on the Controller's documented instructions", needs prior written authorisation for any sub-processor, and must report breaches "without undue delay". On exit it returns or deletes data and removes its access to the Snowflake account.
Unusual: no transfers outside the United Kingdom except on the Controller's written instruction. Audits are allowed on reasonable notice and during business hours.
Not settled: price, service levels, term length, renewal and data residency. Residency is "a separate matter under the Master Services Agreement". The Kingdon Diagnostics signatory is not named, only the title.
As found in this document
Current to 9 Oct 26- Date signed23 Dec 2024Source: object_read:doc_083_006
- Processing instructionsThe Processor processes personal data only on the Controller's documented instructionsThe Processor processes personal data only on the Controller's documented instructions · Source: object_read:doc_083_006
- Sub-processorsThe Processor will not engage a sub-processor for personal data without the Controller's prior written authorisationThe Processor will not engage a sub-processor for personal data without the Controller's prior written authorisation · Source: object_read:doc_083_006
- Personal data breachesThe Processor will tell the Controller without undue delay after becoming aware of a personal data breachThe Processor will tell the Controller without undue delay after becoming aware of a personal data breach · Source: object_read:doc_083_006
- International transfersThe Processor will not transfer personal data outside the United Kingdom except on the Controller's written instructionThe Processor will not transfer personal data outside the United Kingdom except on the Controller's written instruction · Source: object_read:doc_083_006
- Return and deletionOn the end of the services, the Processor will, at the Controller's choice, return or delete personal data it holdsOn the end of the services, the Processor will, at the Controller's choice, return or delete personal data it holds · Source: object_read:doc_083_006
- Auditreasonable audits by the Controller or its appointed auditor, on reasonable notice and during business hoursreasonable audits by the Controller or its appointed auditor, on reasonable notice and during business hours · Source: object_read:doc_083_006
The document
Body
Kingdon Diagnostics - Data Processing Agreement (signed)
Status: Executed Signed: 23 Dec 2024
This Data Processing Agreement sits under the Master Services Agreement between BB-Demo and Kingdon Diagnostics signed on the same date.
Parties
- Kingdon Diagnostics of Newcastle upon Tyne, the "Controller".
- BB-Demo, a London data business, the "Processor".
Purpose and scope
The Processor provides the company brain to the Controller under the Master Services Agreement. The brain is built and run inside the Controller's own Snowflake account. This agreement applies to any personal data that the Processor handles on the Controller's behalf in doing so.
Roles
The Controller decides the purposes and means of processing. The Processor processes personal data only on the Controller's documented instructions, which are the Master Services Agreement, this agreement and any written instruction the Controller gives during the term.
Subject matter and data
Read the whole document (4,090 characters)
| Item | Description |
|---|---|
| Subject matter | Provision, configuration and support of the company brain |
| Duration | The term of the Master Services Agreement and any period needed to return or delete data |
| Nature of processing | Indexing, searching, summarising and displaying data from the sources the Controller connects |
| Data subjects | Staff, contacts at referring trusts and insurers, and other individuals appearing in connected systems |
| Types of data | Business contact details, referral and ticket records, invoice records and related correspondence held in connected systems |
The parties agree that the Controller will decide which sources are connected and will not connect sources it has no lawful basis to process.
Processor obligations
The Processor will:
- process personal data only as instructed, and tell the Controller if it believes an instruction breaches data protection law;
- ensure that everyone with access to personal data is bound by confidentiality;
- apply appropriate technical and organisational measures, including access controls and logging within the Controller's Snowflake account;
- help the Controller respond to requests from individuals exercising their rights;
- help the Controller with security reviews, impact assessments and consultations where reasonably asked.
Security
Because the brain runs inside the Controller's own Snowflake account, the Controller's existing account controls apply. The Processor will use only the access the Controller grants and will keep that access to what is needed for implementation and support.
Sub-processors
The Processor will not engage a sub-processor for personal data without the Controller's prior written authorisation, and will put in place written terms with any authorised sub-processor that give the same protection as this agreement.
Personal data breaches
The Processor will tell the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and will give the information the Controller reasonably needs to meet its own obligations.
International transfers
The Processor will not transfer personal data outside the United Kingdom except on the Controller's written instruction and in line with applicable data protection law. Data residency options are a separate matter under the Master Services Agreement.
Return and deletion
On the end of the services, the Processor will, at the Controller's choice, return or delete personal data it holds and remove its access to the Controller's Snowflake account, unless the law requires it to keep the data.
Audit
The Processor will make available the information reasonably needed to show compliance with this agreement and will allow reasonable audits by the Controller or its appointed auditor, on reasonable notice and during business hours.
Signatures
Signed for BB-Demo
Name: Tom Ashdown Title: Account Executive Date: 23 Dec 2024
Signed for Kingdon Diagnostics
Title: Authorised signatory, Kingdon Diagnostics Date: 23 Dec 2024
Unusual terms
Current to 9 Oct 26- UK-only transfers without written instruction
- Prior written authorisation for sub-processors
- Audit rights on reasonable notice