Thackwray Logistics - Data Processing Agreement (signed)
Documentexecuted Thackwray Logistics · dpa · executed · 2025-03-21
Executed DPA signed on 21 Mar 2025 between Thackwray Logistics (controller) and BB-Demo (processor). It sets processing terms for the brain inside the customer's Snowflake account. It states no price, availability or response-time figures.
What it says
What this says
Current to 13 Oct 26Executed DPA signed on 21 Mar 2025 between Thackwray Logistics (controller) and BB-Demo (processor). It sets processing terms for the brain inside the customer's Snowflake account. It states no price, availability or response-time figures.
What it is: an executed DPA that forms part of the agreement under which BB-Demo provides the company brain. It states that "The Customer is the controller of the personal data. The Supplier is the processor".
Commits: BB-Demo to process data only on documented instructions, keep access controls, encryption and logging, and notify breaches "without undue delay". It also commits BB-Demo to return or delete data at the end of the service.
Unusual: nothing off standard terms. Sub-processors are under general authorisation with notice of changes and a fair opportunity to object.
Not settled: the text gives no breach notification deadline in hours, no price, no service levels and no renewal date. Customer signatory is named only as "Authorised signatory", so their role and seniority are not shown.
As found in this document
Current to 9 Oct 26- Date signed21 Mar 2025Source: object_read:doc_157_006
- Processing instructionsprocess personal data only on the Customer's documented instructions, unless the law requires otherwiseprocess personal data only on the Customer's documented instructions, unless the law requires otherwise · Source: object_read:doc_157_006
- Personal data breachnotify the Customer without undue delay after becoming aware of a personal data breachnotify the Customer without undue delay after becoming aware of a personal data breach · Source: object_read:doc_157_006
- Sub-processorskeep a current list available to the Customer, give notice of any intended change, and allow the Customer a fair opportunity to objectkeep a current list available to the Customer, give notice of any intended change, and allow the Customer a fair opportunity to object · Source: object_read:doc_157_006
- Return and deletionreturn or delete the personal data it holds on the Customer's behalf and remove its access to the Customer's Snowflake accountreturn or delete the personal data it holds on the Customer's behalf and remove its access to the Customer's Snowflake account · Source: object_read:doc_157_006
- Location of dataThe Supplier will not move personal data outside that account except to provide support the Customer has asked forThe Supplier will not move personal data outside that account except to provide support the Customer has asked for · Source: object_read:doc_157_006
The document
Body
Thackwray Logistics - Data Processing Agreement (signed)
Status: Executed. Signed on 21 Mar 2025.
Parties
This Data Processing Agreement (the "DPA") is made between:
- Thackwray Logistics, a contract logistics and e-commerce fulfilment business based in Doncaster (the "Customer"); and
- BB-Demo, a London data business (the "Supplier").
It forms part of the agreement under which the Supplier provides the company brain to the Customer, and applies for as long as the Supplier processes personal data on the Customer's behalf.
Purpose and scope
The Supplier provides one AI-queryable layer over the Customer's business systems, built and run inside the Customer's own Snowflake account. In doing so the Supplier may process personal data contained in those systems, such as the names and business contact details of the Customer's staff, of its clients' contacts and of individuals who appear in service reviews and returns tickets. This DPA sets out the terms on which that processing takes place.
Roles of the parties
Read the whole document (4,941 characters)
The Customer is the controller of the personal data. The Supplier is the processor and acts only on the Customer's documented instructions, which are the order form, this DPA and the Customer's configuration of the service.
Categories of data and data subjects
| Item | Description |
|---|---|
| Data subjects | Customer employees, client contacts, supplier contacts and other individuals recorded in connected systems |
| Types of personal data | Names, business email addresses, job titles, message and ticket content, and similar business records |
| Special category data | None is intended; the Customer will not connect sources that hold it without agreeing this in writing |
| Nature of processing | Indexing, storage, retrieval and summarisation within the Customer's Snowflake account |
| Duration | The term of the order form, plus the period needed to return or delete data |
Supplier obligations
The Supplier shall:
- process personal data only on the Customer's documented instructions, unless the law requires otherwise, and tell the Customer if it believes an instruction breaches data protection law;
- ensure that everyone authorised to process the data is bound by a duty of confidentiality;
- apply appropriate technical and organisational measures, including access controls, encryption and logging of access to the Customer's brain;
- assist the Customer, taking the nature of the processing into account, in responding to requests from data subjects;
- assist the Customer with security, breach notification, impact assessments and consultation with the regulator where needed;
- make available the information needed to show compliance, and allow reasonable audits by the Customer on reasonable notice.
Location of data
Because the brain runs inside the Customer's own Snowflake account, the data stays in the region the Customer has chosen for that account. The Supplier will not move personal data outside that account except to provide support the Customer has asked for.
Sub-processors
The Customer gives general authorisation for the Supplier to use sub-processors. The Supplier shall keep a current list available to the Customer, give notice of any intended change, and allow the Customer a fair opportunity to object. The Supplier remains responsible for its sub-processors and shall bind them to terms no less protective than this DPA.
Personal data breach
The Supplier shall notify the Customer without undue delay after becoming aware of a personal data breach affecting the Customer's data, and shall give the information reasonably needed for the Customer to meet its own notification duties. The Supplier shall take prompt steps to contain and remedy the breach.
Return and deletion
On the end of the service, and at the Customer's choice, the Supplier shall return or delete the personal data it holds on the Customer's behalf and remove its access to the Customer's Snowflake account, unless the law requires it to keep a copy.
International transfers
The Supplier shall not transfer personal data to a country without adequate protection unless an approved transfer mechanism is in place and the Customer has agreed.
Liability and governing law
Liability under this DPA is subject to the limits in the main agreement between the parties. This DPA is governed by the law of England and Wales, and the courts of England and Wales have jurisdiction.
Signatures
Signed by the authorised representatives of the parties on 21 Mar 2025.
| For the Customer | For the Supplier | |
|---|---|---|
| Organisation | Thackwray Logistics | BB-Demo |
| Name | Authorised signatory, Thackwray Logistics | Lewis Kerr |
| Title | Authorised signatory | Account Executive |
| Date | 21 Mar 2025 | 21 Mar 2025 |
BB-Demo contacts for this account: Sophie Ling (account owner) and Amara Obi (customer success manager).