Data Processing Agreement

Between NO82 SOCIAL WORLD LTD, company number 15480675, registered office 20 Wenlock Road, London, England, N1 7GU ("the Processor", "we")

and the customer identified in the Order or account registration ("the Controller", "you")

This Agreement forms part of the Tether.82 Terms of Service. Where it conflicts with those terms, this Agreement takes precedence on matters of data protection.

Last updated: 19 September 2026

1. Definitions

"UK GDPR", "controller", "processor", "personal data", "processing", "data subject" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018.

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018, and any other applicable data protection legislation.

2. Roles

You are the controller. We are the processor. You determine whose social media pages are connected, and why.

You confirm that you have a lawful basis for the processing you instruct, and that you are authorised to instruct it in respect of every page you connect.

3. Subject matter of the processing

Nature and purpose: retrieving, storing and analysing publicly reported performance data for social media pages, and generating draft content and reports from it.

Duration: for as long as your account is open, plus the retention period in clause 10.

Types of personal data:

• Names and email addresses of your personnel who use the service, and their billing details where they pay by card
• The text of social media posts published by the pages you connect, which may name or describe individuals
• Images and video thumbnails published in those posts, which may show individuals
• Any personal data contained in documents you choose to upload

Categories of data subject:

• Your personnel who use the service
• Individuals named or shown in posts published by the pages you connect
• Individuals named in documents you upload

Special category data: none is required by the service. You should not upload it. If you do, you are responsible for having an Article 9 condition for it.

4. Our obligations

We will:

a) process personal data only on your documented instructions, which for these purposes are your use of the service and any written instruction you give us, unless required otherwise by law, in which case we will tell you before processing unless the law prohibits that;

b) ensure that anyone authorised to process the personal data is under an appropriate duty of confidence;

c) implement the technical and organisational measures described in Annex A;

d) not engage a sub-processor except as set out in clause 6;

e) taking into account the nature of the processing, assist you by appropriate technical and organisational measures in responding to requests from data subjects exercising their rights;

f) assist you in complying with your obligations under Articles 32 to 36 of the UK GDPR, taking into account the nature of processing and the information available to us;

g) at your choice, delete or return the personal data at the end of the provision of services, as set out in clause 10;

h) make available to you the information necessary to demonstrate compliance with Article 28, and allow for and contribute to audits as set out in clause 9.

5. Your obligations

You will:

a) ensure you have a lawful basis for the processing you instruct;

b) ensure that your own privacy information covers the processing carried out through the service;

c) ensure that you are entitled to connect each page and to instruct processing of the data it holds;

d) not instruct us to process personal data in a way that would put us in breach of Data Protection Law.

6. Sub-processors

You give general authorisation for us to engage the sub-processors listed in Annex B.

We will give you at least 30 days written notice before adding or replacing a sub-processor. You may object on reasonable data protection grounds within that period. If we cannot resolve the objection, you may terminate the affected service without penalty and receive a pro-rata refund of prepaid fees.

We remain fully liable to you for the performance of any sub-processor's obligations.

7. International transfers

Some sub-processors operate outside the UK, including in the United States. We will only transfer personal data outside the UK where a transfer mechanism recognised under Data Protection Law is in place, being the UK International Data Transfer Agreement, or the EU Standard Contractual Clauses together with the UK Addendum. Details are available on request.

8. Personal data breach

We will notify you without undue delay, and in any event within 48 hours, of becoming aware of a personal data breach affecting your personal data.

The notification will describe the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, and the measures taken or proposed.

We will not notify the ICO or any data subject on your behalf about a breach concerning your personal data unless you instruct us to. That notification is yours to make as controller.

9. Audit

We will make available the information necessary to demonstrate compliance with this Agreement.

You may audit no more than once in any 12-month period, on 30 days written notice, during business hours, without unreasonable disruption, and subject to confidentiality. We may satisfy an audit request by providing a relevant third-party certification or report where one exists. You may audit more often following a personal data breach affecting your data.

10. Deletion and return

You may export your personal data yourself, as a JSON file, from your account page at any time while the account is open, and we will provide the same export on request for 30 days after closure.

Thirty days after termination the data is deleted from our live systems by a scheduled job, which removes the account, its stored files and every record attached to it. Backups are overwritten on their own cycle and are not retrieved to satisfy a deletion request; data held in backups remains subject to this Agreement until overwritten.

We may retain personal data where required by law, for as long as that requirement lasts.

11. Liability

Liability under this Agreement is subject to the limitations in the Terms of Service, except where Data Protection Law does not permit that limitation.

12. Governing law

This Agreement is governed by the laws of England and Wales.

Annex A. Technical and organisational measures

Access control. Row-level security is enforced at the database on every table holding customer data, so an account can only read records belonging to it. A customer cannot read another customer's pages, data, uploads or analytics under any circumstances.

Authentication. Managed by our authentication provider. Passwords are hashed and are not visible to us.

Privileged access. Credentials that bypass row-level security are held only in server-side code and scheduled jobs, in one module that can be audited on its own, and are not reachable from any browser-facing request path.

Platform tokens. Authorisation tokens for connected platforms are held in tables with no read policy for any application role, are used only server-side, and are deleted when a page is disconnected or an account closed.

Audit. Significant actions on an account (invitations, pages linked, members granted or revoked, exports, closure, deletion, billing events) are written to an append-only log that only the service itself can write to.

Encryption. Data is encrypted in transit using TLS, and encrypted at rest by our hosting and storage providers.

Segregation. Notes and documents we hold about an account are visible only to us, and are never exposed to the customer they concern or to any other customer.

Deletion. A daily job deletes accounts 30 days after closure. Deletion cascades through the schema, removing every associated record, and empties the account's storage folders.

Staff. Access to the production database and customer data is limited to one person (Chris Hunter, director). No employees or contractors currently have access. Confidentiality is governed by the director's fiduciary duties under the Companies Act 2006.

Annex B. Approved sub-processors

The current list is always at tether82.com/legal/subprocessors.

List last changed 26 September 2026. The current list is always at tether82.com/legal/subprocessors.

Anthropic does not train its models on data submitted through its API by default.