Vellacott Payments - Data Processing Agreement (signed)
Documentexecuted Vellacott Payments · dpa · executed · 26 Jun 2025
Executed DPA effective 26 Jun 2025 between Vellacott Payments (controller) and BG-Demo (processor). It keeps Customer Data inside the customer's own Snowflake account. It states no price, availability or response times.
What it says
What this says
As at Fri 9 Oct 2026Executed DPA effective 26 Jun 2025 between Vellacott Payments (controller) and BG-Demo (processor). It keeps Customer Data inside the customer's own Snowflake account. It states no price, availability or response times.
What it is: an executed data processing agreement that forms part of the master agreement and order form. Vellacott Payments is the controller and BG-Demo the processor, signed by Lewis Kerr for BG-Demo on 26 Jun 2025.
Commits: BG-Demo "will not move Customer Data outside that environment, or to another country, without the Customer's prior written agreement". It must notify breaches "without undue delay" and delete or return data on termination or expiry.
Unusual: the sub-processor clause is a general authorisation with notice and a right to object. If the DPA conflicts with the master agreement on personal data, the DPA prevails.
Not settled: no price, service levels, renewal date or term length. The customer signatory is shown only as "Authorised signatory", with no named person.
As found in this document
As at Fri 9 Oct 2026- Date signed26 Jun 2025Source: the AI read of this record
- Date start26 Jun 2025Source: the AI read of this record
- Data locationThe Supplier will not move Customer Data outside that environment, or to another country, without the Customer's prior written agreement.Source: the AI read of this record
- Breach notificationThe Supplier will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data.Source: the AI read of this record
- Return and deletionOn termination or expiry of the Services, and at the Customer's choice, the Supplier will delete or return Customer DataSource: the AI read of this record
- Sub-processorsThe Supplier will give the Customer notice of any intended addition or replacement so the Customer can object on reasonable grounds.Source: the AI read of this record
- Auditon reasonable notice and during business hours, subject to confidentialitySource: the AI read of this record
The document
Body
Vellacott Payments - Data Processing Agreement (signed)
Status: Executed Effective date: 26 Jun 2025
This Data Processing Agreement (the "DPA") is made between Vellacott Payments, an FCA-authorised e-money and payments firm based in London (the "Customer"), and BG-Demo, a London data business (the "Supplier"). It forms part of the master agreement and order form between the parties and applies to all personal data the Supplier handles when providing B-Glass to the Customer.
Clause one: Definitions
Terms such as "personal data", "processing", "controller", "processor" and "data subject" have the meanings given in UK data protection law. "Services" means B-Glass and the implementation and support services described in the order form. "Customer Data" means any personal data processed by the Supplier on the Customer's behalf.
Clause two: Roles and scope
Read the whole document (5,254 characters)
- The Customer is the controller of Customer Data and the Supplier is its processor.
- The Supplier processes Customer Data only to provide the Services and only on the Customer's documented instructions, including this DPA and the order form.
- The subject matter, nature and purpose of processing are the connection of the Customer's business systems to the brain and the answering of queries over that data by the Customer's authorised users.
Clause three: Categories of data and data subjects
| Item | Description |
|---|---|
| Data subjects | The Customer's employees and contractors, its clients and their representatives, merchants, and individuals who contact the Customer, including complainants |
| Categories of data | Contact details, account and relationship records, call and email content, support and complaint records, and usage data from connected systems |
| Special category data | None is intended to be processed. If the Customer connects a source that holds such data, it will tell the Supplier first |
| Duration | The term of the order form and any period needed to return or delete data under clause nine |
Clause four: Where the data lives
B-Glass is built and run inside the Customer's own Snowflake account. Customer Data therefore stays within an environment the Customer controls. The Supplier will not move Customer Data outside that environment, or to another country, without the Customer's prior written agreement.
Clause five: Security
The Supplier will keep appropriate technical and organisational measures in place to protect Customer Data, including:
- access limited to staff who need it, bound by confidentiality duties;
- role-based access and logging of administrative actions;
- encryption of data in transit and at rest within the Customer's Snowflake account;
- regular review of measures, and support for the Customer's own security review.
Clause six: Sub-processors
The Customer gives general authorisation for the Supplier to use sub-processors. The Supplier will give the Customer notice of any intended addition or replacement so the Customer can object on reasonable grounds. The Supplier remains responsible for its sub-processors and will bind them to obligations no less protective than this DPA.
Clause seven: Assistance and data subject rights
The Supplier will, taking account of the nature of the processing, help the Customer to respond to requests from data subjects, and to meet its obligations on security, impact assessments and consultation with the regulator. If the Supplier receives a request directly from a data subject, it will pass it to the Customer without undue delay and will not respond itself unless instructed.
Clause eight: Personal data breaches
The Supplier will notify the Customer without undue delay after becoming aware of a personal data breach affecting Customer Data. The notice will describe the nature of the breach, the data and people affected where known, the likely consequences and the steps taken or proposed. The Supplier will cooperate with the Customer's investigation and with any notification the Customer must make.
Clause nine: Return and deletion
On termination or expiry of the Services, and at the Customer's choice, the Supplier will delete or return Customer Data and remove its access to the Customer's Snowflake environment, unless the law requires retention. The Supplier will confirm completion in writing on request.
Clause ten: Audit
The Supplier will make available the information reasonably needed to show compliance with this DPA and will allow and contribute to audits by the Customer or an auditor it appoints, on reasonable notice and during business hours, subject to confidentiality.
Clause eleven: General
- If this DPA conflicts with the master agreement on the handling of personal data, this DPA prevails.
- This DPA is governed by the law that governs the master agreement, and the courts named there have jurisdiction.
- Changes must be in writing and signed by both parties.
Signatures
Signed by the duly authorised representatives of the parties on 26 Jun 2025.
| For Vellacott Payments | For BG-Demo | |
|---|---|---|
| Name | Authorised signatory | Lewis Kerr |
| Title | Authorised signatory of Vellacott Payments | Account Executive |
| Date | 26 Jun 2025 | 26 Jun 2025 |
Unusual terms
As at Fri 9 Oct 2026- DPA prevails over master agreement on personal data
- General sub-processor authorisation with right to object
- Customer Data stays in customer's Snowflake account