Carrowkeel Software - Data Processing Agreement (signed)
Documentexecuted Carrowkeel Software · dpa · executed · 1 Aug 2025
Executed DPA effective 1 Aug 2025 between Carrowkeel Software (Controller) and BG-Demo (Processor), forming part of the MSA and order form. It states no service levels, price or renewal date. The brain runs inside the Controller's own Snowflake account.
What it says
What this says
As at Fri 9 Oct 2026Executed DPA effective 1 Aug 2025 between Carrowkeel Software (Controller) and BG-Demo (Processor), forming part of the MSA and order form. It states no service levels, price or renewal date. The brain runs inside the Controller's own Snowflake account.
What it is: an executed data processing agreement, signed 1 Aug 2025 by Sophie Ling for BG-Demo and an unnamed authorised signatory for Carrowkeel Software. It "forms part of the Master Services Agreement and any order form agreed between the parties".
Commits: the Processor acts only on documented instructions, keeps security measures including "access controls, encryption and logging", and notifies a breach "without undue delay". It will "return or delete personal data" at the Controller's choice when the services end.
Unusual: the Controller gives general authorisation for sub-processors, with notice of changes so it can object. Data stays in the Controller's Snowflake account unless it instructs otherwise in writing.
Not settled: no price, service levels, term, renewal date or connector dates appear. The document does not name the Carrowkeel signatory or give a numeric breach notification deadline.
As found in this document
As at Fri 9 Oct 2026- Date signed1 Aug 2025Source: the AI read of this record
- Date start1 Aug 2025Source: the AI read of this record
- Processing instructionsonly on documented instructions from the Controller, unless required to do otherwise by lawSource: the AI read of this record
- Security measuresappropriate technical and organisational security measures in place, including access controls, encryption and loggingSource: the AI read of this record
- Personal data breachnotify the Controller without undue delay after becoming aware of a personal data breachSource: the AI read of this record
- Location of datawill not move personal data outside that account except on the Controller's written instructionSource: the AI read of this record
- Return and deletionat the Controller's choice, return or delete personal data it holds and confirm in writingSource: the AI read of this record
- Auditreasonable audits by the Controller or an auditor it appoints, on reasonable notice and during business hoursSource: the AI read of this record
The document
Body
Carrowkeel Software - Data Processing Agreement (signed)
Status: Executed Effective date: 1 Aug 2025
Parties
This Data Processing Agreement is made between Carrowkeel Software, of Dublin (the "Controller"), and BG-Demo, of London (the "Processor"). It forms part of the Master Services Agreement and any order form agreed between the parties.
Background
The Controller is a vendor of lettings and property-management software. It has asked the Processor to deliver B-Glass, a layer that lets the Controller's customer success team query support tickets, renewals and product usage. The Processor builds and runs the brain inside the Controller's own Snowflake account.
Definitions
Terms such as "personal data", "processing", "data subject" and "personal data breach" have the meaning given in the General Data Protection Regulation as it applies in Ireland and in the UK GDPR, whichever applies to the processing concerned.
Scope and purpose of processing
Read the whole document (4,015 characters)
The Processor processes personal data only to provide the services described in the order form, and only on the Controller's documented instructions. The categories of data are those held in the systems the Controller chooses to connect: contact details of the Controller's staff and of its agency-group customers, support correspondence and product usage records. Processing lasts for the term of the order form and any period needed to return or delete data.
Obligations of the Processor
The Processor shall:
- process personal data only on documented instructions from the Controller, unless required to do otherwise by law, in which case it will tell the Controller first where it may lawfully do so;
- ensure that everyone authorised to process the data is bound by a duty of confidentiality;
- keep appropriate technical and organisational security measures in place, including access controls, encryption and logging;
- assist the Controller, as far as is reasonably possible, in responding to requests from data subjects;
- assist the Controller with security, impact assessments and consultation with supervisory authorities.
Location of data
Because the brain runs inside the Controller's Snowflake account, the data stays under the Controller's own account controls. The Processor will not move personal data outside that account except on the Controller's written instruction.
Sub-processors
The Controller gives general authorisation for the Processor to use sub-processors where needed to deliver the services. The Processor will bind each sub-processor to obligations no less protective than this Agreement, will remain responsible for their performance, and will give the Controller notice of any intended change so that it can object.
Personal data breach
The Processor will notify the Controller without undue delay after becoming aware of a personal data breach affecting the Controller's data, and will give the information the Controller reasonably needs to meet its own notification duties.
Audit
The Processor will make available the information needed to show compliance with this Agreement and will allow reasonable audits by the Controller or an auditor it appoints, on reasonable notice and during business hours.
Return and deletion
On the end of the services, the Processor will, at the Controller's choice, return or delete personal data it holds and will confirm in writing that it has done so, unless the law requires it to keep a copy.
Governing terms
If this Agreement conflicts with the Master Services Agreement on the processing of personal data, this Agreement prevails. Otherwise the governing law and dispute terms of the Master Services Agreement apply.
Signatures
Signed by the parties' authorised signatories on 1 Aug 2025.
| For Carrowkeel Software | For BG-Demo | |
|---|---|---|
| Name | Authorised signatory | Sophie Ling |
| Title | Authorised signatory of the Controller | Account Executive |
| Date | 1 Aug 2025 | 1 Aug 2025 |
Unusual terms
As at Fri 9 Oct 2026- General authorisation for sub-processors with notice of change
- DPA prevails over the MSA on personal data conflicts