Privacy Policy

1.1 What Personal Data We Collect and How

We only collect personal data that is necessary to provide and improve our services.
The type of data we collect depends on your relationship with us:

1.2 From Creators (Content Contributors)

When you submit content or participate in campaigns,
we collect:

• Email address (required).

• Phone number and address (optional).

• Images or videos you submit (which may include identifiable features like your face or voice).

• Answers to campaign forms (e.g., ratings, product feedback, testimonials).

• Optional demographic data (e.g.  age, date of birth, gender, or inferred gender) may be requested. Given that companies have the flexibility to create their own custom questions, the range of demographic data collected may vary. 

• Any metadata included with your uploaded image or video file. This may include, but is not limited to: capture date, camera type, image settings (e.g. shutter speed, aperture), location data, device model, and software version.

• We collect and store information using unique identifiers linked to your browser, application, or device. This data may include technical information, usage statistics, and interaction data. 

• Consent confirmation, Consent records and licensing agreements (to show you’ve agreed to how your content is used).

Why We Collect It:

• To enable participation in campaigns and submit content under a valid license.

• To verify rights, consent, and eligibility for rewards.

• To securely transfer licensed content to client companies
  (who become the Data Controller).

• To support GDPR data rights requests (e.g. access, correction, consent withdrawal).

• Fulfill contractual and legal obligations.

• Analyse usage Improve our services, support product development, and optimise system performance.

• Manage user accounts and support communications.

• Comply with legal requirements and contractual obligations.

• Detect, investigate, and prevent misuse or unauthorised access.

• To ensure legal compliance, including notifying companies of Creator data subject requests (e.g. consent withdrawal or deletion).

Data Handling:

• Your personal data is stored securely by 82DASH during the license period.

• It is then transferred to the company that licensed your content, who becomes the Data Controller and takes over responsibility for that data.

• Even after transfer, 82DASH may retain a record of your consent and licensing status as required by law.

 1.3 Companies

When you use our platform for campaigns,
we collect:

• Company name and business contact information.

• User credentials (email, username, password).

• Campaign setup and performance data.

• Third-party integration metadata (e.g., Meta pixel, Klaviyo tracking).

Why We Collect It:

• To set up and manage company accounts.

• To support the creation and execution of campaigns.

• To facilitate campaign planning, execution, and performance tracking.

• To deliver Creator content and coordinate related data rights requests.

• To ensure legal compliance, including notifying companies of Creator data subject requests (e.g., consent withdrawal or deletion).

• Comply with legal requirements and contractual obligations.

• Detect, investigate, and prevent misuse or unauthorised access.

• To ensure legal compliance, including notifying companies of Creator data subject requests (e.g., consent withdrawal or deletion).

• Analyse usage Improve our services, support product development, and optimise system performance.

1.4 Legal Bases for Processing Personal Data

Where required by GDPR or similar laws, we rely on:

Consent: We rely on your consent when you voluntarily agree to specific uses of your data, such as:

• Enabling campaign creation and content access (where optional)

• Receiving marketing communications

• Use of cookies and similar technologies

You may withdraw your consent at any time.

82DASH does not intentionally collect or process special categories of personal data as defined under Article 9 of the GDPR (e.g., data revealing racial or ethnic origin, political opinions, religious beliefs, health data, or sexual orientation).

However, as a user-generated content platform, there may be instances where you voluntarily upload or submit content (such as images, videos, text, or responses to forms) that includes such sensitive data. By doing so, you acknowledge that this information is being provided at your discretion and with your explicit consent.

If special category data is processed, 82DASH will implement appropriate safeguards in accordance with applicable data protection laws, including limiting access and ensuring secure processing.

Contractual Necessity : When you upload content to the 82DASH platform, you enter into a contract with us, as defined by our Terms of Service. We process your personal data as necessary to perform that contract, including:

Examples:

• Creating and managing your account

• Manage your content when you upload it

• Processing and licensing submitted content

• Enabling platform features

• Providing customer support

• Sending service-related communications

• Managing rewards, where applicable

• Supporting our clients in managing their licensed content

Please note: If you’ve submitted content that has been licensed to a client company, you retain your rights under applicable data protection laws (such as the GDPR). However, content that has already been licensed and distributed may continue to be used by the client under the terms of the original license agreement. In some cases it may not be possible to remove it entirely from all channels or platforms.

Legitimate Interests:
We process data to support our legitimate interests, provided these do not override your rights and freedoms. This includes:

• Securing our platform and preventing fraud

• Improving user experience and services

• Analysing usage to develop new features

• Communicating with you about platform updates or policies

Legal Obligation:
We may process your data to comply with legal requirements, including:

• Responding to lawful requests by public authorities

• Complying with applicable tax, corporate, or data protection regulations

• Managing and defending legal claims

1.5 How We Share Personal Data and With Whom

We do not sell personal data.

We only share it with:

• Companies who license Creator content.

• Trusted service providers (e.g., hosting, analytics).

• Legal or regulatory authorities, when required.

• Affiliates or successors in case of a merger or acquisition.

1.6 Data from Minors

Our services are not directed at users under 18.

We do not knowingly collect data from minors. If you believe a child has provided personal data, please contact us so we can remove it.

1.7 Our Role as Data Processor

In most cases, 82DASH acts as a Data Processor, which means we handle personal data on behalf of our client companies.

Specifically:

• We process personal data such as email, address, or submitted images or videos - under the instructions of the client company.

• The client company is the Data Controller. They decide why and how your data is used for example, in a social media campaign or on a brand’s website.

As a Data Processor, 82DASH is committed to the following:

• Processing data strictly in accordance with the documented instructions of the Data Controller (our client).

• Implementing robust technical and organisational measures to protect your personal data.

• Ensuring confidentiality all employees handling personal data are trained and subject to strict confidentiality obligations.

• Assisting our clients in responding to your privacy rights requests (e.g., access, correction, or deletion).

• Promptly notifying the Data Controller in the event of a personal data breach.
  
  

1.8 The Processor’s Independent Role as Data Controller:

In addition to acting as a Data Processor on behalf of the Controller, 82DASH may also act as an Independent Data Controller for its own purposes, including but not limited to the following:

• Conducting analytics, product improvement, and AI development based on aggregated, anonymised, or pseudonymised data.

• Collecting data for internal reporting and operational purposes, which may include system performance analysis, user engagement statistics, and other business-related metrics.

As an Independent Data Controller, we are responsible for ensuring that we comply with all applicable data protection laws, including the GDPR, and that we provide appropriate notices to data subjects about how their data is being used for these purposes. We will also handle any data subject rights requests directly related to its own processing activities.

1.9 Use of Subprocessors

We may work with trusted third-party subprocessors to help us deliver our Services. These subprocessors support tasks such as hosting, analytics, content delivery, customer support, and communication.

For a full and up-to-date list of our subprocessors,
please refer to our Subprocessor List.

Before we engage any subprocessor, we perform thorough due diligence to ensure they meet strong data protection and security standards.

Where required by law such as under the GDPR we enter into Data Processing Agreements (DPAs) with our subprocessors. These agreements include necessary safeguards (like Standard Contractual Clauses) for personal data transferred outside the European Economic Area (EEA), the United Kingdom, or other regions with similar transfer rules.

You can request a list of our current subprocessors, including their names, functions, and countries of operation, by emailing us at privacy@82dash.com.

1.10  Your Rights and Choices

Depending on your location, you may have the following rights:

• Access your personal data

You have the right to request confirmation as to whether personal data concerning you is being processed. If so, you have the right to access that data and obtain detailed information in accordance with Article 15 of the GDPR

• Correct inaccuracies

You have the right to request the correction of any inaccurate personal data about you. Where applicable, you may also request the completion of incomplete personal data without undue delay.

• Request deletion

You may request the deletion of your personal data without undue delay, provided that one of the conditions outlined in Article 17 of the GDPR applies.

• Restrict or object to processing

You have the right to request the restriction of processing where one of the conditions under Article 18 of the GDPR is met for example, if you have objected to the processing and the controller is assessing the objection.

• Data portability

In certain cases, as detailed in Article 20 of the GDPR, you have the right to receive your personal data in a structured, commonly used, and machine-readable format. You may also request that this data be transmitted directly to another controller, where technically feasible.

• Withdraw consent (where applicable)

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

California residents may also:

• Opt-out of sale or sharing (note: we do not sell your data)

• Correct or delete personal information

• Receive non-discriminatory treatment for exercising rights

To exercise your rights, email us at privacy@82dash.com.

1.11  How We Secure Your Personal Data

We apply a range of technical and organisational safeguards to protect your data:

• All data is transmitted securely using HTTPS encryption.

• Stored data is encrypted at the database level and protected with strict access controls.

• Non-public images and videos are only accessible through short-lived signed URLs issued to authorised users.

• User accounts are secured using industry-standard authentication practices.

• Access to production data is only granted when absolutely necessary and is always logged and audited.

• We regularly assess our systems for security risks and provide staff training to ensure ongoing compliance and awareness.

1.12 Data Retention:

We retain personal data only as long as necessary to:

• Fulfill the purposes outlined in this Policy

• Comply with legal or regulatory obligations

• Resolve disputes and enforce agreements

• Data may be anonymised or securely deleted when no longer needed. Company account data is deleted two years after deactivation, while content creator data is deleted 14 days after the associated company account is closed, or deleted by the company.

1.13  International Transfers of Personal Data

Personal data may be transferred to and processed in countries outside of your home jurisdiction, including the United States. These transfers are made with appropriate safeguards such as:

• EU Standard Contractual Clauses (SCCs)

• UK International Data Transfer Addendum

• Binding corporate rules or adequacy decisions (where applicable)
  
  

1.14 Use of AI Features

We use artificial intelligence (AI) tools to enhance our platform’s functionality and user experience.

These tools may process the following types of data:

• Content Inputs: Images, videos, and other media you upload (Creator Content)

• Metadata: Information such as timestamps, tags, and responses to submission forms

Purpose of Processing:

AI is used to:

• Automatically tag and categorise uploaded content

• Assess content quality or relevance

• Support filtering and search functions within the platform

How Your Data Is Stored and Processed:

• Content is stored in its original form unless it is deleted by the company. 

  
  Please note that creators do not have the ability to delete their content directly. Requests for deletion may be submitted to the company, which, as the data controller, will assess and respond in accordance with its obligations under applicable local privacy laws.
  
  

• AI-generated outputs (e.g., tags, relevance scores) remain internal and are not shared externally.
  
  

• We do not use or share your content or data with third-party AI tools or vendors.

Model Training:

Content and metadata may be used to refine and improve our in-house AI models to enhance platform performance. This processing is done securely and remains fully internal.