Your privacy matters to us.

This Privacy Policy (“Policy”) explains how 82DASH Ltd, a company registered in England and Wales (company number 16432005), with its registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ (“82DASH,” “we,” “us,” or “our”) collects, uses, shares, and protects your personal data when you use our website (the “Website”), platform (the “Platform”), or services (the “Services”), including tools to submit, manage, and publish content.

We are committed to complying with applicable data protection and privacy laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the UK GDPR and the Data Protection Act 2018, as amended (“UK GDPR”), the Privacy and Electronic Communications Regulations 2003 (“PECR”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA/CPRA”), and other relevant data protection laws.

This Policy is designed to be transparent and easy to understand. It applies to:

• Website visitors.

• Companies and their authorised users.

• Content creators & uploaders (referred to as “Creators”).

• Business partners, vendors, and other stakeholders.

• Individuals who are identifiable in Creator Content submitted by another person.

This Policy is a transparency notice; reading it does not constitute consent to any processing. In case of discrepancies between this Privacy Policy in other languages and the English version, the English version shall prevail.

1.0 Privacy Policy For All Users

1.1 What Personal Data We Collect and How

We only collect personal data that is necessary to provide and improve our services. The type of data we collect depends on your relationship with us:

1.2 From Creators (Content Contributors)

When you submit content or participate in campaigns, we collect:

• Email address (required).

• Phone number and address (optional).

• Images or videos you submit (which may include identifiable features like your face or voice).

• Answers to campaign forms (e.g., ratings, product feedback, testimonials).

• Optional demographic data (e.g. age, date of birth, gender) may be requested. Given that companies have the flexibility to create their own custom questions, the range of demographic data collected may vary.

• Any metadata included with your uploaded image or video file. This may include, but is not limited to: capture date, camera type, image settings (e.g. shutter speed, aperture), location data, device model, and software version.

• We collect and store information using unique identifiers linked to your browser, application, or device. This data may include technical information, usage statistics, and interaction data.

• Licence acceptance records, Creator Confirmations, permission evidence and, where applicable, separately collected consent records.

Why We Collect It:

• To enable participation in campaigns and submit content under a valid licence.

• To record Creator confirmations and supporting permission evidence, administer reward eligibility, and maintain licence and compliance records.

• To securely transfer licensed content to client companies (who become the Data Controller).

• To manage user accounts and support communications.

• To analyse usage patterns, support product development, and improve our services.

• To detect, investigate, and prevent misuse or unauthorised access.

• To fulfil contractual and legal obligations, including supporting data rights requests and notifying companies of Creator data subject requests (e.g. consent withdrawal or deletion).

Data Handling:

82DASH retains personal data in accordance with Section 1.11. The Requesting Company generally acts as an independent controller for its receipt and use of Creator Content. 82DASH may continue to process minimum licence, reward and compliance information in its capacity as an independent controller, as explained in this Policy.

1.3 Companies

When you use our platform for campaigns, we collect:

• Company name and business contact information.

• User credentials (email, username, authentication information).

• Campaign setup and performance data.

Why We Collect It:

• To set up and manage company accounts.

• To facilitate campaign planning, execution, and performance tracking.

• To deliver Creator content and coordinate related data rights requests.

• To analyse usage patterns, support product development, and improve our services.

• To detect, investigate, and prevent misuse or unauthorised access.

• To fulfil contractual and legal obligations, including notifying companies of Creator data subject requests (e.g., consent withdrawal or deletion).

1.4 Legal Bases and Purposes of Processing

The following table sets out the purposes for which we process personal data, 82DASH’s data-protection role, and the lawful basis relied upon. Where 82DASH acts as a processor, the Requesting Company determines the lawful basis.

Where we rely on legitimate interest, you may object at any time (see Section 1.9). We will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.

The Creator’s contract is with 82DASH under the Terms of Service. The direct content licence is between the Creator and the Requesting Company. References to “contractual necessity” apply to whichever contractual relationship supports the specific processing purpose.

Creator Content may incidentally contain information from which sensitive characteristics are apparent. 82DASH does not deliberately infer or classify special-category characteristics unless the processing has been specifically disclosed and an applicable Article 9 condition has been established.

A request to withdraw consent or erase personal data does not automatically determine whether all processing must cease. 82DASH and the Requesting Company must each assess the request according to their respective roles, the lawful basis relied upon, applicable exemptions, and other legal obligations. The content licence does not restrict or override mandatory data-protection rights.

1.5 How We Share Personal Data and With Whom

We do not sell personal data. We only share it with:

• Companies who license Creator content.

• Trusted service providers (e.g., hosting, analytics).

• Legal or regulatory authorities, when required.

• Affiliates or successors in case of a merger or acquisition.

1.6 Data from Minors

Our services are not directed at users under 18. We do not knowingly collect data from minors. If you believe a child has provided personal data, please contact us so we can remove it. Content depicting individuals under 18 is not permitted on the platform. See Section 1.6A.

1.6A Individuals Featured in Creator Content

Creator Content submitted through 82DASH may contain images, video, or audio in which individuals other than the Creator are identifiable (“Featured Individuals”).

This personal data - which may include image, likeness, voice, and associated contextual information - is obtained from the Creator, not directly from the Featured Individual. It may be disclosed to the identified Requesting Company under the content licence.

Minors. Content depicting individuals under the age of 18 is prohibited on 82DASH. See Section 1.6 and Section 1.1 of the Terms of Service.

Featured Individuals’ rights. If you are identifiable in Creator Content submitted by another person, you may exercise your data-protection rights by contacting [email protected]. Where the Requesting Company is the controller for the relevant processing, 82DASH may transmit the request to that Company and will assist where required. See Section 1.9 for the full list of rights.

1.7 Our Data Protection Roles

82DASH’s role depends on the processing activity:

The Requesting Company generally acts as an independent controller for its receipt and use of Creator Content. 82DASH acts as a processor where it handles personal data solely on the Company’s documented instructions, and as an independent controller where it determines its own processing purposes, including account administration, platform security, legal compliance, and maintenance of licence and compliance records.

The direct content licence does not itself determine the parties’ data-protection roles.

1.8 Use of Subprocessors

We may work with trusted third-party subprocessors to help us deliver our Services. These subprocessors support tasks such as hosting, analytics, content delivery, customer support, and communication. For a full and up-to-date list of our subprocessors, please refer to our Subprocessor List.

Before we engage any subprocessor, we perform thorough due diligence to ensure they meet strong data protection and security standards.

Where required by law such as under the GDPR we enter into Data Processing Agreements (DPAs) with our subprocessors. These agreements include necessary safeguards (like Standard Contractual Clauses) for personal data transferred outside the European Economic Area (EEA), the United Kingdom, or other regions with similar transfer rules.

You can request a list of our current subprocessors, including their names, functions, and countries of operation, by emailing us at [email protected].

1.9 Your Rights and Choices

Depending on your location, you may have the following rights:

Access your personal data

You have the right to request confirmation as to whether personal data concerning you is being processed. If so, you have the right to access that data and obtain detailed information in accordance with Article 15 of the GDPR.

Correct inaccuracies

You have the right to request the correction of any inaccurate personal data about you. Where applicable, you may also request the completion of incomplete personal data without undue delay.

Request deletion

You may request the deletion of your personal data without undue delay, provided that one of the conditions outlined in Article 17 of the GDPR applies.

Restrict or object to processing

You have the right to request the restriction of processing where one of the conditions under Article 18 of the GDPR is met - for example, if you have objected to the processing and the controller is assessing the objection.

Data portability

In certain cases, as detailed in Article 20 of the GDPR, you have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may also request that this data be transmitted directly to another controller, where technically feasible.

Withdraw consent (where applicable)

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Right to object. You have the right to object to processing based on legitimate interest (Art. 6(1)(f)). We will cease the relevant processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims.

Automated decision-making. Where a decision is made solely by automated means and produces legal effects or similarly significantly affects you, you have the right to obtain human intervention, express your point of view, and contest the decision (see also Section 1.13).

Data-protection complaints. You may make a data-protection complaint by emailing [email protected]. We will acknowledge your complaint within 30 days, investigate it as appropriate, keep you informed of material progress, and communicate the outcome without undue delay.

Right to complain to a supervisory authority. You also have the right to lodge a complaint with a supervisory authority. In the United Kingdom, this is the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint.

Identity verification. We may ask you to verify your identity before acting on a rights request, to protect against unauthorised access. We will not request more information than is necessary for verification.

Which organisation handles your request. Where 82DASH is the controller, we handle your request directly. Where the Requesting Company is the controller, we may transmit the request to the Company and assist as required. See Section 1.7 for our roles by processing activity.

California residents may also:

• Opt-out of sale or sharing (note: we do not sell your data)

• Correct or delete personal information

• Receive non-discriminatory treatment for exercising rights

You may submit a privacy-rights request to 82DASH at [email protected]. Where the request concerns processing for which a Requesting Company is the controller, 82DASH may refer or transmit the request to that Company and will assist it where required. You may also contact the Requesting Company directly.

1.10 How We Secure Your Personal Data

We apply a range of technical and organisational safeguards to protect your data:

• All data is transmitted securely using HTTPS encryption.

• Stored data is encrypted at the database level and protected with strict access controls.

• Non-public images and videos are only accessible through short-lived signed URLs issued to authorised users.

• User accounts are secured using industry-standard authentication practices.

• Access to production data is restricted to authorised personnel on a need-to-know basis, and access events are logged.

• We regularly assess our systems for security risks and provide staff training to ensure ongoing compliance and awareness.

1.11 Data Retention

Original Creator Content is retained while required to operate the relevant campaign and Services, subject to deletion instructions and applicable law.

The content licence is perpetual; however, only the minimum evidence necessary to administer and evidence the licence is retained while the Requesting Company continues to rely on it. Retained evidence is subject to periodic review and, where possible, is reduced, pseudonymised, or anonymised. After review, evidence that is no longer necessary for legitimate purposes is deleted.

1.12 International Transfers of Personal Data

Where personal data is transferred outside the United Kingdom or EEA, we use an applicable transfer mechanism, which may include adequacy regulations or decisions, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, as applicable. We also carry out any required data-protection or transfer-risk assessment. You may request further information about the relevant safeguards by contacting [email protected].

1.13 Use of AI and Automated Tools

82DASH uses automated tools, including services provided by approved subprocessors, to perform AI inference, classification, tagging, and moderation.

Depending on the relevant feature, these tools may process Creator Content. Details of the relevant providers, processing locations, and processing purposes are available in our Subprocessor List.

82DASH does not use Creator Content or associated personal data to train, fine-tune, or otherwise improve AI models operated by 82DASH or any third party.

AI-generated classifications and tags may be included in content delivered to Requesting Companies. They do not, by themselves, determine reward eligibility, campaign selection, or licence activation.

Where an automated output may materially affect a user, 82DASH applies appropriate human review and provides a means of challenging the result.

1.14 Tracking Technologies and Third-Party Platforms

82DASH uses the following tracking technologies on its website and platform. None of these fire until you grant consent via the cookie banner.

Lawful basis: Consent (Art. 6(1)(a)). You may withdraw consent at any time via the cookie settings on our website.

These providers receive data in their own capacity as independent controllers. They are not 82DASH subprocessors. Their use of data is governed by their own privacy policies. For details of specific cookies, see our Cookie Policy.

1.15 Campaign-Specific Privacy Information

Requesting Companies may create custom campaign questions, so the specific data categories collected may vary by campaign. Before you submit content, the campaign page will display:

• The Requesting Company’s registered legal name;

• What information is being requested and which questions are optional;

• A link to the Requesting Company’s privacy notice (where provided by the Company); and

• A link to these Terms and this Privacy Policy.

For questions about how a specific Requesting Company uses your data after it is licensed, contact that Company directly. For questions about 82DASH’s processing, contact [email protected].

2.0 Regional Terms

2.1 EU/EEA (GDPR)

If you are located in the European Economic Area (EEA), your personal data is processed in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

Both 82DASH and client companies agree to comply with the General Data Protection Regulation (Regulation (EU) 2016/679) in all processing activities involving personal data of individuals in the European Economic Area (EEA).

82DASH Ltd is established in the United Kingdom. As 82DASH offers services to individuals in the European Economic Area, it has appointed an EU representative in accordance with Article 27 of Regulation (EU) 2016/679. The EU representative may be contacted at [email protected].

2.2 United Kingdom (UK GDPR)

If you are located in the United Kingdom, your personal data is processed in accordance with the UK GDPR and the Data Protection Act 2018, as amended.

2.3 Switzerland (FADP)

If you are located in Switzerland, your personal data is processed under the Swiss Federal Act on Data Protection (“FADP”).

For more information about how personal data is processed between 82DASH and its client companies, please refer to our Data Processing Agreement (DPA).

2.4 California Consumer Privacy Act (CCPA)

If you are a California resident, your personal data may be protected under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

82DASH does not sell your personal data as defined under the CCPA/CPRA. Where you consent to non-essential tracking technologies (such as the Meta Pixel), personal data may be disclosed to third-party advertising platforms for cross-context behavioural advertising, which may constitute “sharing” as defined under the CCPA/CPRA.

You may opt out of this sharing at any time by:

• Using the “Do Not Sell or Share My Personal Information” link on our website;

• Enabling Global Privacy Control (GPC) in your browser - 82DASH honours GPC signals as a valid opt-out request; or

• Contacting [email protected].

As a California resident, you have the following rights:

• Right to Know: Request details about the personal data we collect, including the categories, specific pieces of data, sources, purposes for collection, and any third parties with whom it is shared.

• Right to Delete: Request the deletion of your personal data, subject to certain legal exceptions.

• Right to Correct: Request correction of inaccurate personal data we hold about you.

• Right to Non-Discrimination: Exercise your privacy rights without being denied services or treated unfairly.

• Right to Opt-Out of Sharing: You may opt out of the sharing of your personal data for cross-context behavioural advertising using any of the methods described above.

The CCPA/CPRA applies to businesses operating in California that meet specific revenue or data processing thresholds. If a client company using 82DASH qualifies as a “business” under these laws, they are responsible for meeting their legal obligations even if the Creator is not located in California.

To exercise your rights or request more information, please contact us at [email protected].

3.0 Updates to This Policy

We may amend or update this Privacy Policy from time to time. We will notify you of any material changes to this policy by a notice provided through the Platform or by other means. The “Last Updated” date at the top of this policy reflects the effective date of such policy changes.

4.0 Contact Us

For questions, data access, or privacy concerns, please contact:

82DASH Ltd (company number 16432005)

Email: [email protected]

71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom

You may also contact your local data protection authority or supervisory body.