Penwortham Mutual - Data Processing Agreement (signed)
Documentexecuted Penwortham Mutual · dpa · executed · 14 May 2026
Executed UK GDPR Data Processing Agreement between BG-Demo Limited (Processor) and Penwortham Mutual (Controller), effective 14 May 2026 under the Master Services Agreement of the same date. It states no price, availability or response-time terms.
What it says
What this says
As at Fri 9 Oct 2026Executed UK GDPR Data Processing Agreement between BG-Demo Limited (Processor) and Penwortham Mutual (Controller), effective 14 May 2026 under the Master Services Agreement of the same date. It states no price, availability or response-time terms.
What it is: an executed DPA with effect from 14 May 2026, covering processing for B-Glass platform under the Master Services Agreement dated 14 May 2026.
Commits: the Processor acts only on "documented instructions from the Controller", must not engage sub-processors without prior authorisation, and must not transfer Personal Data outside the UK without prior written authorisation.
Also binds the Processor to assist with data subject requests, delete or return data at the Controller's choice at the end of services, and allow audits and inspections.
Not settled: the document sets no price, service levels, notice period or renewal date. The Penwortham Mutual signature block reads only "Authorised Representative", so the evidence does not show who signed for the customer.
As found in this document
As at Fri 9 Oct 2026- Date signed14 May 2026Source: the AI read of this record
- Date start14 May 2026Source: the AI read of this record
- Processing instructionsThe Processor shall process Personal Data only on documented instructions from the Controller and for no other purpose.Source: the AI read of this record
- Sub-processorsThe Processor shall not engage sub-processors without prior authorisation from the Controller.Source: the AI read of this record
- International transfersThe Processor shall not transfer Personal Data outside the UK except with the Controller's prior written authorisation and in accordance with the UK GDPR.Source: the AI read of this record
- Deletion and returnThe Processor shall, at the Controller's choice, delete or return all Personal Data after the end of the provision of services, except where UK law requires storage.Source: the AI read of this record
Body
Data Processing Agreement
Penwortham Mutual and BG-Demo Limited
Status: Executed
This Data Processing Agreement ("DPA") is entered into between BG-Demo Limited ("Processor") and Penwortham Mutual ("Controller") with effect from 14 May 2026, in accordance with the UK GDPR and Data Protection Act 2018.
1. Definitions
"Personal Data" means any information relating to an identified or identifiable natural person.
"Processing" means any operation performed on Personal Data including collection, storage, use, analysis and deletion.
"Processor" means BG-Demo Limited, which processes Personal Data on the Controller's instruction.
"Controller" means Penwortham Mutual, which determines the purposes and means of Processing.
2. Scope
This DPA covers the processing of Personal Data by the Processor in the course of providing B-Glass platform under the Master Services Agreement dated 14 May 2026.
3. Processing Instructions
The Processor shall process Personal Data only on documented instructions from the Controller and for no other purpose. The Processor shall not process Personal Data for its own purposes.
4. Personnel Confidentiality
Read the whole document (2,871 characters)
The Processor ensures that persons authorised to process Personal Data have committed to confidentiality or are under an appropriate legal obligation of confidentiality.
5. Security Measures
The Processor implements technical and organisational measures to ensure a level of security appropriate to the risk, including:
- Encryption at rest and in transit
- Access controls and authentication
- Regular security testing and vulnerability management
- Incident response procedures
- Staff security training
6. Sub-Processors
The Processor shall not engage sub-processors without prior authorisation from the Controller. The Processor remains liable to the Controller for the performance of any sub-processor.
7. Data Subject Rights
The Processor shall assist the Controller in fulfilling obligations to respond to data subject access requests and other rights requests under the UK GDPR.
8. Deletion and Return of Personal Data
The Processor shall, at the Controller's choice, delete or return all Personal Data after the end of the provision of services, except where UK law requires storage.
9. Audit and Inspection
The Processor shall make available to the Controller all information necessary to demonstrate compliance with the UK GDPR and allow for and contribute to audits and inspections by the Controller or its auditors.
10. International Transfers
The Processor shall not transfer Personal Data outside the UK except with the Controller's prior written authorisation and in accordance with the UK GDPR.
Signatures
Executed on 14 May 2026.
For BG-Demo Limited:
Matteo Ricci Account Executive
For Penwortham Mutual:
Authorised Representative