SocialScore · GDPR
How SocialScore is built for GDPR compliance
GDPR compliance is never a one-party question. When your business uses SocialScore, three parties are involved: your customer, whose data it is; your business, which decides how to use it; and SocialScore, which processes it on your instructions. This page shows how we structure our side and where the lines of responsibility sit.
- Our roleProcessor, Art. 28 GDPR
- Default modePass-Through: no profiles stored
- ProcessingEuropean Union
- DPAAccepted online before any data is processed
- Credit useProhibited by contract and by design
- AuthorityCPDP (КЗЛД), Bulgaria
The three parties in every integration
Every SocialScore integration rests on three clearly separated roles. Your customer has a relationship with you, not with us, so every notice and every rights request runs through you.
- Your customerData subject. Gives identifiers to your business and receives its privacy notice, decisions and answers to rights requests.
- Your businessController. Sends identifiers to SocialScore under the DPA and decides what to do with the result.
- SocialScoreProcessor. Returns Data Signals, never decisions. Has no direct relationship with your customer.
Your customer
The person whose data is checked. Their relationship is with your business, and every notice and right they exercise runs through you.
Your business
Decides to use SocialScore and what to do with the output. Owns the lawful basis, the privacy notice and every decision about its customer.
SocialScore
Processes the identifiers you send strictly on your instructions and returns Data Signals. Public sources and data providers we query are independent controllers of their own data.
Our data handling architecture
You choose how long we keep data. The choice is a data protection decision made at onboarding, not a silent default.
Pass-Through
Identifiers are used only to produce the response. No profile is stored afterwards.
Storage
Enriched profiles are kept in your account for analysis and audiences, for up to 1 year, then deleted. You can delete any profile at once from the dashboard.
Hashed check log
A log of each check, with the identifier hashed, kept for 30 days and only for your account, to document checks, handle disputes and prevent abuse.
Pixel
No names, emails or phone numbers. IP addresses truncated, device fingerprints hashed, 30-day default retention.
Lawful basis: two scenarios
The correct lawful basis depends on the purpose. Identify which scenario applies before launching an integration.
Scenario 1: fraud prevention
Checks at registration, checkout, application, payment or account changes, to detect fake identities, fraud and abuse. Legitimate interest applies, supported by a documented balancing test. Your customer can object under Art. 21(1).
Scenario 2: marketing insight
Personas, segmentation, personalisation and ad audiences. Your customer would not reasonably expect this use of external data, so obtain freely given, specific, informed and unambiguous consent before the check. Consent must be as easy to withdraw as to give, and the right to object to direct marketing is absolute.
Note on terminology. Consent under Scenario 2 is ordinary consent under Art. 6(1)(a). Explicit consent, a stricter standard, is required only for special categories of data, solely automated decisions and certain transfers. SocialScore does not infer special categories of data.
Signals, not decisions
SocialScore's Data Signals are informational. We do not decide about your customer: your business does. How your own systems use a signal remains yours to assess under Art. 22 GDPR.
Because Art. 22 can also apply to a score that a third party relies on heavily (CJEU C-634/21, SCHUFA), our contract prohibits using a signal as the sole or determining factor in decisions with legal or similarly significant effects, and prohibits any credit use.
- No credit scoring or creditworthiness assessment
- No approve or decline outcomes, amounts or terms
- No special category inferences
- No decisions about any person
Data subject rights we support
Deletion
Stored profiles can be deleted from your dashboard immediately, with no ticket.
Objection
In Pass-Through mode nothing is stored beyond the 30-day hashed log, so honouring an objection means not submitting the identifier again.
Requests to us
If one of your customers contacts us, we forward the request to you without undue delay and help you answer it.
Our Data Processing Agreement
Every production use, API or dashboard, is covered by our DPA before a single record moves. You accept it online at sign-up, and we record the version, date and time.
It contains the standard Art. 28 processor terms: processing only on your documented instructions, confidentiality, security measures, assistance with rights requests, breach notification within 72 hours, audit rights, and deletion or return of data at the end of the relationship.
Security and data residency
Security
Our practices are aligned with ISO/IEC 27001:2022. Encryption at rest and in transit, production access only for named people with multi-factor authentication, logged administrative access, backups, a written incident procedure and signed confidentiality undertakings.
Data residency
DSNTech LTD is established in Bulgaria, and the SocialScore application runs on Google Cloud and Firebase in the EU. Our sub-processors and their locations are listed in Appendix 2 of the DPA.
The SocialScore Pixel: privacy by design
- No names, email addresses or phone numbers are collected.
- IP addresses are truncated at ingestion (last octet removed).
- Device fingerprints are hashed; the raw value is deleted immediately.
- 30-day default retention, configurable by you.
Minimising data under the GDPR does not remove the separate ePrivacy question. The Pixel reads and stores information on the visitor's device, so it needs consent under Art. 5(3) of the ePrivacy Directive. Load it only after your visitor accepts it in your cookie banner. A ready-made banner text is in our notice templates.
Where signals come from
Signals are compiled from sources other than your customer, which is why your privacy notice must cover Art. 14.
Public sources
Public web pages, public registers, telecom numbering data, domain data and publicly reported data breaches, the latter used only as a fraud indicator.
Data providers
Specialised fraud-data providers under written agreements, listed in the DPA.
Public profiles
Whether an identifier is linked to a publicly visible profile on an online platform, and what that profile publicly shares. We never log in to accounts or read private content.
Data usage restrictions
Your data belongs to your business. We do not sell it and do not use it to build products for anyone else. We keep only anonymised statistics, with every identifier removed and stored separately from any hash, to provide market benchmarks in aggregated form that identifies neither a person nor your company.
Points to consider: summary
For your own diligence file, everything above in one place.
- Roles are clearly allocated: you are the controller, SocialScore is the processor.
- Pass-Through is the default; Storage is optional and limited to 1 year.
- A hashed check log is kept for 30 days, only for your account.
- Stored profiles can be deleted on demand from your dashboard.
- Lawful basis: legitimate interest for fraud prevention, consent for marketing insight.
- Every production use is covered by the DPA, accepted before any data is processed.
- Data Signals are information, never decisions; credit use is prohibited.
- Security practices are aligned with ISO/IEC 27001:2022.
- Processing takes place in the European Union.
- The Pixel is built for data minimisation and loads only after consent.
- We do not sell or resell your data.
Ready for your review
The Legal & Trust Center gathers every document, our counsel desk and notice templates for your website. Questions go to our data protection contact at dpo@socialscore.io.
Supervisory authority: Commission for Personal Data Protection (CPDP / КЗЛД), Sofia, Bulgaria. Last updated 20 October 2026. This page describes how SocialScore operates; it is not legal advice, and the accepted documents prevail.