Social-238 Data Sharing Agreement (controller to controller)

Last updated 2026-10-26 · Not legal advice: a plain-words agreement for customers in the EU, the UK and Brazil.

1. Parties and purpose

This agreement is between the operator of the radar, an individual established in Argentina, which operates Social-238 ("the operator"), and the business customer that receives creator data from Social-238 ("the customer"). It forms part of the Terms of Service and sets out how each party handles the personal data that the operator shares with the customer.

2. Roles

• The operator decides what public data to collect, how to read it and what to estimate from it. It is an independent controller of the list (GDPR Art. 4(7)).
• The customer decides why and how it uses the data it receives. It is an independent controller of that data from the moment it receives it.
• The parties are not joint controllers (Art. 26). The operator is not the customer's processor, and Art. 28 does not apply to this sharing.
• Each party is responsible on its own for its own compliance.

3. Subject matter and categories of data

Data subjects: people who run public creator accounts on TikTok and Instagram and do not look under 16. Some may be 16 or 17.

Data shared:

• handle, display name, follower counts, bio text, links and posting dates, as shown publicly, with the history of counts by day;
• contact details, only when the creator published them in the profile;
• a place (country, region, town) inferred from public signals;
• an apparent-age band estimated from public video;
• engagement scores and a yes or no judgment on whether the account is one real person;
• a suppression state that shows whether the creator was removed.

• No special-category data (Art. 9) is shared on purpose, and none is used as a filter or a score.
• The age band is a broad range estimated from video. The operator stores no face template and no other biometric code, so the band is not biometric data under Art. 4(14) and Art. 9.
• Accounts that may belong to people under 16 are kept out of what is shared.

4. Lawful basis

• The operator relies on legitimate interest (Art. 6(1)(f)): helping businesses find and work with public creators. It keeps a written legitimate interest assessment and a record of processing.
• The customer relies on its own legitimate interest (Art. 6(1)(f)) for its own purposes, and carries out its own assessment before use.
• Public availability alone is not a lawful basis. Each party weighs the creator's reasonable expectations, and neither party reads data behind a login wall or a block.

5. Transparency

• The operator meets Art. 14 for its collection: a public privacy notice naming sources, fields, purposes, basis, retention, recipients, rights and a contact, and a self-lookup and removal page.
• The customer gives its own Art. 14 information about its own use, at the latest when it first contacts a creator, or within one month of receiving the data, whichever is sooner. Its notice says that the data came from Social-238.

6. Data subject requests

• Each party answers requests made to it (access, correction, erasure, objection, restriction) for the data it controls, within the legal deadline.
• If a request concerns the other party's data, the party that receives it passes it on within 10 working days, and both cooperate.
• Requests to the operator go to hello@social238.com.
• An objection under Art. 21 is honoured by both parties: the creator is removed and not contacted again for marketing.

7. Suppression pass-through

• When a creator is removed from Social-238, the operator stops sharing that creator and marks the suppression state in the API.
• The customer deletes that creator from every copy it holds within 30 days, unless it has its own separate lawful basis (for example a contract with the creator).
• The customer checks the suppression state at least once a month.

8. Security

Each party keeps measures suited to the risk (Art. 32). At least:

• all traffic over TLS;
• access by named seats and secret API keys, one key per organisation, revoked when exposed;
• access logs on both sides (who, what operation, when), without storing the answers in the logs;
• staff access limited to those who need it, under a duty of confidentiality.

9. No onward transfer

• The customer does not share the data outside its own group of companies, except with its own processors bound by Art. 28 terms.
• An agency customer may share a campaign shortlist with its own client, under the limits of the Terms of Service, and passes these duties on to that client.
• The customer does not sell, sublicense or publish the data.

10. International transfers

• The operator is in Argentina. The European Commission found that Argentina gives adequate protection (Decision 2003/490/EC), so data sent from the EU to the operator needs no standard contractual clauses (Art. 45).
• When the operator shares data with a customer outside the EU or the European Economic Area, in a country without an adequacy decision, the parties sign the EU standard contractual clauses, Module One (controller to controller, Decision (EU) 2021/914), which then prevail over this agreement where they differ (Art. 46).
• For the UK, the UK addendum to those clauses is used where needed.

11. Personal data breaches

• Each party tells the other without undue delay, and within 72 hours of becoming aware, of a breach that affects the shared data.
• The notice says what happened, which data and how many creators are affected, and what is being done.
• Each party notifies its own regulator and the affected creators where Art. 33 and Art. 34 require it.

12. Brazil and the United Kingdom

• For customers in the UK, this agreement applies to the UK GDPR in the same way (mutatis mutandis), with the UK regulator in place of EU regulators.
• For customers in Brazil, it applies to the LGPD in the same way: legitimate interest (Art. 7(IX) and Art. 10) with a balancing test, never for sensitive data, and transfers under LGPD Art. 33.

13. Term and precedence

• This agreement lasts as long as the customer holds data from Social-238, including after the plan ends.
• If this agreement and the Terms of Service differ on personal data, this agreement prevails. If signed standard contractual clauses differ from both, the clauses prevail.

14. Governing law

This agreement follows the governing law and courts of the Terms of Service, except where the standard contractual clauses or the GDPR require the law and courts of an EU member state.

15. Contact

Notices, requests and breach reports: hello@social238.com.