Harcastle Environmental - Data Processing Agreement (signed)

Terms such as "personal data", "controller", "processor", "data subject", "personal data breach" and "processing" have the meanings given in the UK GDPR and the Data Protection Act 2018. "Customer Personal Data" means personal data processed by the Supplier on the Customer's behalf under the master services agreement.

Roles of the parties

The Customer is the controller and the Supplier is the processor of Customer Personal Data. Each party will comply with the data protection law that applies to it.

Scope and purpose of processing

The parties do not intend special category data to be processed. The Customer will not configure a connector to bring such data into the brain without first agreeing it in writing with the Supplier.

Supplier obligations

The Supplier will:

• process Customer Personal Data only on the Customer's documented instructions, which include this DPA, the order form and the Customer's configuration of the service, unless the law requires otherwise, in which case the Supplier will tell the Customer first where it is lawful to do so;
• make sure that everyone authorised to process Customer Personal Data is bound by a duty of confidentiality;
• tell the Customer promptly if it believes an instruction breaches data protection law;
• keep Customer Personal Data logically separated from the data of its other customers; and
• not sell Customer Personal Data or use it to train models for the benefit of anyone other than the Customer.

Location of processing

The brain is built and run inside the Customer's own Snowflake account. Customer Personal Data therefore remains in the location and environment the Customer has chosen for that account. The Supplier will not move Customer Personal Data outside the United Kingdom without the Customer's prior written agreement.

Security

The Supplier will keep appropriate technical and organisational measures in place to protect Customer Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. These include:

• access controls based on least privilege and named accounts for Supplier staff;
• encryption of data in transit and at rest within the Customer's Snowflake account;
• logging of administrative access to the service;
• regular review of who at the Supplier can reach the Customer's environment; and
• documented procedures for incident response and for staff joining and leaving.

Sub-processors

The Customer gives general authorisation for the Supplier to use sub-processors needed to deliver the service. The Supplier will keep a current list, give the Customer notice of any intended addition or replacement, and allow the Customer a reasonable opportunity to object. The Supplier will bind each sub-processor to obligations no less protective than those in this DPA and remains responsible for their performance.

Assistance to the Customer

Taking account of the nature of the processing, the Supplier will give the Customer reasonable help with:

• requests from data subjects to exercise their rights;
• data protection impact assessments and consultations with the regulator; and
• security reviews and reasonable audit questions about the service.

Personal data breach

The Supplier will tell the Customer without undue delay after becoming aware of a personal data breach affecting Customer Personal Data. The notice will describe, as far as known, the nature of the breach, the data and data subjects affected, the likely consequences and the measures taken or proposed. The Supplier will keep the Customer updated as more is learned.

Audit

The Supplier will make available the information reasonably needed to show compliance with this DPA and will allow reasonable audits by the Customer or an auditor it appoints, on reasonable notice, during business hours and without unreasonable disruption to the Supplier's other customers.

Return and deletion

Because the brain runs inside the Customer's Snowflake account, the Customer controls the underlying data. On the end of the services the Supplier will remove its access and delete any Customer Personal Data it holds outside that account, unless the law requires it to keep a copy, and will confirm this in writing on request.

Liability

Liability under this DPA is subject to the limits and exclusions in the master services agreement.

Governing law

This DPA is governed by the law of England and Wales, and the courts of England and Wales have exclusive jurisdiction over any dispute arising from it.

Contacts

Signatures

Signed by the authorised representatives of the parties on Friday 28 March 2025.