Contents
- Summary for counsel
- Counsel desk
- What we do and don't do
- How the service works
- Roles and responsibilities
- Lawful basis by use case
- Prohibited uses
- Data and sources
- Retention and deletion
- Sub-processors
- Security and breaches
- AI Act position
- How you sign up
- Key terms at a glance
- Document library
- Notice templates
- Questions from counsel
- Contact
Summary for counsel#
- Signals, never decisions
You send an identifier (email, phone, country). We return information signals about it. By default we keep only a hashed log of each check for 30 days. Your business decides what to do.
- You are the controller
We act as your processor under Art. 28 GDPR. We keep no shared database of personal data across customers. We only keep anonymised statistics, with every identifier removed, for market benchmarks.
- No credit use, by contract and by design
The service must not be used to assess creditworthiness or to decide on credit, insurance, employment or housing. It returns no approve or decline output, no amounts and no terms.
- Two permitted purposes
Fraud prevention, and marketing insight (segments and customer personas). The Pixel adds measurement of your own website.
- EU company, EU processing
DSNTech LTD is established in Bulgaria. The application runs on Google Cloud and Firebase in the EU. Fraud-signal data comes from SEON in Hungary.
- Accepted online, before payment
You accept the Terms of Service and the DPA electronically at sign-up. Each acceptance is versioned and time-stamped, and you get a copy. No personal data is processed before the DPA is accepted.
Counsel desk#
We know a new data vendor means questionnaires, a DPIA and internal sign-off. Everything below is published or available on request, so you can finish your review without chasing us.
This page, the DPA with its appendices, the Terms of Service and the signal documentation.
DPA Appendix 1 (processing and security measures), § 08 on data and sources, and the signal documentation.
Send us your questions or your security and privacy questionnaire and we answer in writing (DPA Section 4.2).
The version of the DPA you accepted, with date and time, in your account and by email (DPA Section 1.2).
A DORA Art. 30 addendum for banks, payment and e-money institutions and other entities in scope, on request.
A negotiated agreement for larger volumes, starting from our standard terms.
What we do, and what we never do#
These two lists define the service. The same commitments appear in the Terms of Service and the DPA, so they bind both sides.
We do
- Turn an email address, phone number and country into Data Signals: validity and risk indicators, digital presence, public profiles on online platforms, interest and lifestyle segments, and a fraud risk indicator.
- Help you detect fraud: fake, disposable or synthetic identities, bots, multi-accounting and promotion abuse.
- Help you understand and segment your own customers for marketing, and export audiences to your ad platforms.
- Measure visits to your own website with the SocialScore Pixel, once your visitor has consented.
- Build anonymised market statistics, with every identifier removed, so each customer can compare its audience with its market.
- Process your data only on your documented instructions, and delete it on request or at the end of the contract.
We never
- Assess creditworthiness, calculate credit scores, or predict repayment, affordability or default.
- Approve, decline, price or limit credit, insurance, employment, housing or any other contract with a person.
- Act as a credit bureau, credit reference agency or credit intermediary.
- Infer special categories of data, such as health, religion, political opinions, ethnicity or sexual orientation.
- Sell or rent your data, pool personal data across customers, or use it to build products for other customers.
- Log in to, access or read the content of anyone's private accounts.
How the service works#
The data path from your system to your decision. API, dashboard or platform module: the legal analysis is the same.
Email, phone, country code. Optional: Pixel visit data from your site.
Checks public sources, contracted data providers and public profiles on online platforms. Runs in the EU.
Indicators and segments with their meaning documented. No recommendation to approve or reject.
Your rules and your people. Human review where a person could be significantly affected.
| Mode | What happens to the data | Applies |
|---|---|---|
| Pass-Through | Identifiers are used only to produce the response. Afterwards we keep only a log of the check, with the identifier in hashed form, for 30 days and only for you. | By default |
| Storage | Enriched profiles are kept in your account for analysis, segments and audiences, for up to 1 year from the query and then deleted. You can delete any profile from the dashboard immediately. | Only if you switch it on |
| Pixel | No names, emails or phone numbers are collected. IP addresses are truncated (last octet removed) at ingestion. Device fingerprints are hashed and the raw value is deleted immediately. We still treat this data as personal data. | On your website, after consent |
Switching on Storage is your documented instruction under the DPA (Section 8.6).
Roles and responsibilities#
Every integration has three parties. Your customer has a relationship with you, not with us, so every notice and every rights request runs through you.
| Party | GDPR role | Responsible for |
|---|---|---|
| Your business | Controller | Purpose and lawful basis · privacy notice (Art. 13 and 14) · consent where required · DPIA · Art. 22 safeguards · decisions about your customers · answering data subject requests |
| SocialScore | Processor | Processing only on your instructions · confidentiality · security measures · sub-processor management · help with rights requests, DPIAs and breach notification · deletion or return at the end |
| SocialScore | Controller, own data only | Your account users, billing and contract data, our website visitors and our own security logs. Covered by our Privacy Policy, not by the DPA. |
| Your customer | Data subject | Exercises their rights with you. If they contact us, we forward the request to you without undue delay. |
Public sources and data providers we query are independent controllers or third parties for their own data (DPA Section 6.1). Our sub-processors are listed in § 10.
Lawful basis by use case#
You choose the lawful basis as controller. This is how we see the usual cases. Your own counsel makes the final assessment.
Fraud prevention
Checks at registration, checkout, application, payment or account changes. Recital 47 recognises processing strictly necessary to prevent fraud as a legitimate interest.
- Document a legitimate interests assessment.
- Tell customers in your privacy notice (templates S1, F1).
- Honour the right to object under Art. 21(1).
Marketing insight and personas
Profile enrichment, segmentation, personalisation and ad audiences. Customers would not reasonably expect this use of external data, so we recommend consent collected before the check.
- Separate, unticked checkbox (templates S3, M2).
- Withdrawal as easy as giving consent.
- Objection to direct marketing is absolute (Art. 21(2) and (3)).
SocialScore Pixel
The Pixel reads and stores information on the visitor's device. EDPB Guidelines 2/2023 confirm that such techniques fall under Art. 5(3) even when the data is minimised.
- Load the Pixel only after consent in your cookie banner (template S4).
Data from other sources
Signals are compiled from sources other than your customer. Your privacy notice must name the categories of data and the types of source.
- All templates in § 16 cover these elements.
Prohibited uses#
SocialScore signals are informational. Using them to make or support decisions about a person's access to credit or other essential services is prohibited. This protects your customers, and it protects you: for a lender, the same use would breach its own regulatory obligations.
- Credit. Assessing creditworthiness, credit scoring, affordability or repayment prediction for natural persons. This includes BNPL, instalments, leasing, overdrafts, credit limits and pricing of credit, and use as an input to any credit model or credit decision rule.
- Other significant decisions. Deciding on, pricing or limiting insurance, employment, housing, education or access to public services.
- Sole or decisive automated decisions. Using a Data Signal as the sole or determining factor in a decision with legal or similarly significant effects on a person, without meaningful human review.
- Sensitive inferences and vulnerability. Inferring special categories of data, or targeting people because of a vulnerability such as age, financial difficulty or gambling behaviour.
- Surveillance and people search. Locating, monitoring or profiling individuals for third parties, background checks, employee screening, or checking persons you have no customer or prospect relationship with.
- Children. Checking identifiers you know or should know belong to persons under 18.
- Resale. Reselling or redistributing Data Signals, or using them to build a competing database or product.
- Unlawful use. Any use without a valid lawful basis or required notice, or in breach of sanctions, consumer protection or anti-discrimination law.
Why the line sits here
The Court held that automatically producing a probability value is itself an automated decision when a third party draws strongly on it to grant or refuse a contract. Prohibiting credit use keeps that outcome out of the service.
Creditworthiness assessment and credit scoring are high-risk. Fraud detection is expressly excluded. Under Regulation (EU) 2026/1744, Annex III obligations apply from 2 December 2027.
Creditworthiness assessments may not use special categories of data, and social networks are not an acceptable external source. National rules apply from 20 November 2026.
How it is enforced
- Contract: the prohibited uses are part of the Terms of Service (Section 8) and Section 8.7 of the DPA. Breach allows immediate suspension and termination and carries an indemnity.
- Product design: the service returns no approve or decline outcome, no credit amount, no repayment term and no probability of default (DPA Appendix 1, Section 2.3).
- Sign-up: every customer declares its use case and confirms the prohibited uses before it can pay or use the service.
Lenders, payment institutions and BNPL providers can use SocialScore for application fraud and account takeover detection. They must keep Data Signals out of credit models and credit decisions (template F3).
Data we process, and where signals come from#
| Category | Details |
|---|---|
| Data subjects | Your customers and prospects, and visitors to your website where you use the Pixel. |
| Input you send | Email address, phone number, country code. Pixel: truncated IP address, hashed device identifier, pages and events. |
| Signals we return | Validity and type of the email and phone (for example disposable, newly created, carrier type) · digital presence and public profiles on online platforms · exposure in publicly reported data breaches, used only as a fraud indicator · interest and lifestyle segments · composite fraud risk indicator. |
| Never processed | Special categories of data · passwords or credentials of data subjects · content of private accounts or messages · payment card or bank account data · national identification numbers. |
Sources
- Publicly available sources: public web pages, public registers, telecom numbering data, domain data and publicly reported breach data.
- Contracted data providers: specialised fraud-data providers under written agreements, named in § 10.
- Public profile checks: whether an identifier is associated with a publicly visible profile on an online platform, and what that profile publicly shares. We do not log in to accounts, use credentials, read private content or bypass access controls (DPA Section 6.3).
Online information changes and can be incomplete or outdated. Signals are probabilistic indicators, not verified facts about a person.
Retention and deletion#
| Data | Retention |
|---|---|
| Pass-Through queries (default) | No profile is stored after the response is returned. |
| Check log (all modes) | 30 days from the check, then deleted. The identifier is stored only in hashed form, with the time and the result. Kept separately for each customer, to document your checks, handle disputes and support, verify billing and protect against abuse (DPA Section 3.4). |
| Storage mode profiles (optional) | Until you delete them, and no longer than 1 year from the query, after which they are deleted. Deletion from the dashboard takes effect immediately. |
| Pixel data | 30 days by default, configurable by you. |
| End of contract | Deleted or returned at your choice within 30 days, unless EU or Member State law requires storage. |
| Anonymised statistics | No names, emails, phones, IP addresses or keys that could link back to a person. Not personal data, so not subject to these periods (DPA Section 3.3). |
| Your account and billing data | For the contract term, then as required by Bulgarian accounting and tax law. Governed by our Privacy Policy. |
We do not sell your data and do not use it to build products for other customers. Model training and market statistics use anonymised data only, and statistics are shared only in aggregated form that identifies neither a person nor your company (DPA Section 3.3).
Sub-processors#
You give a general authorisation for the sub-processors below when you accept the DPA. We tell you about any new sub-processor by email at least 14 days in advance. You can object within those 14 days, and if we cannot resolve a reasonable objection you can terminate the affected service without penalty (DPA Section 5.3).
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Google Cloud (Google Ireland Limited, Dublin) | Hosting, storage and computing for the SocialScore application | EU | Google Cloud Data Processing Addendum · ISO 27001 |
| Firebase (Google Ireland Limited) | Hosting of the SocialScore web application | EU | Google Cloud Data Processing Addendum · ISO 27001 · SCCs for any transfer within the Google group |
| SEON Technologies Kft. | Email, phone and IP signal data, including breach exposure flags | Hungary, EU | Data processing agreement · ISO 27001 |
| Hetzner Online GmbH | Bare-metal server hosting | Germany / Finland, EU | Data processing agreement · ISO 27001 |
Not sub-processors of your customers' data: Paypercut, which processes your payments to us, and HubSpot, our CRM for your business contacts. Our marketing website socialscore.io is hosted separately in Bulgaria and does not process your customers' data. All three are covered by our Privacy Policy.
Security and breach notification#
Our practices are aligned with ISO/IEC 27001:2022. We are not certified, and the DPA says so. Below are the measures in place today, which bind us under DPA Appendix 1, and what comes next.
| In place today | Measure |
|---|---|
| Minimisation by design | Pass-Through by default. The check log keeps identifiers only in hashed form, for 30 days. Storage only when you switch it on, for up to 1 year. |
| Hosting and encryption | Google Cloud and Firebase in the EU. Data at rest is encrypted by default (AES-256) by the hosting provider. TLS 1.2 or higher in transit. |
| Access | Production access only for named, authorised people, through individual accounts with multi-factor authentication, on a least-privilege basis. |
| Logging | Administrative access to production is logged by the hosting provider's audit logs. |
| Backups | Regular backups of Storage mode data through the hosting provider's managed services. |
| People | Signed confidentiality undertakings from everyone with access to customer data. |
| Incidents | Written incident response procedure. We notify you without undue delay and within 72 hours of becoming aware, with the information you need for your own notification under Art. 33 (DPA Section 7.1). |
| Sub-processors | Data processing agreements with every sub-processor. Google Cloud, SEON and Hetzner hold ISO/IEC 27001 certification. |
| Review | We test and evaluate these measures at least once a year, as Art. 32(1)(d) GDPR requires. |
Next on our security roadmap
- Written information security policy and a periodic access review routine.
- Independent penetration test, with a summary available to customers.
- Tested recovery plan for Storage mode data.
- ISO/IEC 27001 certification, targeted for 2027.
Roadmap items are plans, not contractual commitments. Each one moves into the DPA when it is in place.
AI Act position#
SocialScore uses machine learning to produce Data Signals and offers an AI assistant in the dashboard. This is how the service sits under Regulation (EU) 2024/1689, as amended by Regulation (EU) 2026/1744.
| Question | Position |
|---|---|
| Prohibited practice (Art. 5)? | No. Despite the name, SocialScore is not social scoring under Art. 5(1)(c). It does not evaluate people on their social behaviour so as to treat them unfavourably in unrelated contexts. Customers are contractually barred from such use. |
| High-risk (Annex III)? | No. Fraud detection is expressly excluded from point 5(b). Marketing segmentation is not listed. Creditworthiness and other Annex III uses are prohibited by contract and not supported by the product. |
| Transparency (Art. 50)? | The AI assistant in the dashboard, Inspector MarSel, tells users they are talking to an AI system. |
| Your role | You are the deployer. Using the service within § 03 and § 07 keeps your use outside the high-risk categories. We provide signal documentation to support your own assessment. |
How you sign up#
Contracting is fully online. Nothing is sent for signature, and no personal data is processed before the DPA is in force. Art. 28(9) GDPR allows the DPA to be concluded in electronic form.
- Create a business account
Business email and company details. The service is for businesses only and is not offered to consumers.
- Company verification
We check your company against the trade register before activation.
- Declare your use case
Fraud prevention, marketing insight, or both. You confirm that you will not use the service for any prohibited use in § 07.
- Accept the documents
The Terms of Service and the DPA, each with its own checkbox. We record the version, time and user, and email you a PDF copy.
- Choose a plan
Your order summary shows the plan, price, included checks and start date. It forms the Order Form under the Terms.
- Pay and start
Payment by card through Paypercut, our payment provider. The service activates when payment succeeds.
Enterprise customers can sign a negotiated agreement using our standard terms as the starting point. Contact us before sign-up.
Key terms at a glance#
A summary of the Terms of Service you accept at sign-up. The documents in § 15 prevail over this summary.
| Parties | DSNTech LTD (SocialScore) and the business that registers the account. |
| Term | Monthly subscription that renews automatically. You can cancel at any time, effective at the end of the current billing period. |
| Fees | Standard prices and terms are published on socialscore.io. Your plan, price and any custom terms appear in your order summary. Prices exclude VAT. |
| Fee changes | At least 30 days' notice by email. You can cancel before the change takes effect. |
| Availability | 99% monthly, excluding scheduled maintenance. Service credits are the sole remedy for downtime. |
| Support | Email support on Bulgarian business days, 9:00 to 17:00 EET, with a response within one business day. |
| Liability | Each party's total liability is capped at the fees paid in the 12 months before the claim. Data protection claims have a separate cap of twice that amount. Each party bears administrative fines imposed on it. Neither party is liable for indirect or consequential loss. The caps do not apply to intent or gross negligence, which Bulgarian law (Art. 94 Obligations and Contracts Act) does not allow to be limited. |
| Prohibited use | Immediate suspension and termination right, and an indemnity from the customer for claims caused by prohibited use. |
| Data on exit | Deleted or returned at your choice within 30 days. |
| Publicity | We use your name or logo only with your prior written consent. |
| Law and courts | Bulgarian law. Courts of Sofia, Bulgaria. |
Document library#
Documents marked "Accepted at sign-up" form your contract with us. On data protection matters the DPA prevails over the Terms. On price and plan the order summary prevails.
Terms of Service
Accepted at sign-upVersion 2.0. One agreement for the website and the Services: Part A covers every visitor, Parts B to F the customer relationship, with the Acceptable Use Policy, service levels and support.
Data Processing Agreement
Accepted at sign-upArt. 28 GDPR terms, version 2.0. Appendix 1 covers the processing and security measures, Appendix 2 the sub-processors, Appendix 3 the SCCs for customers outside the EEA.
Order summary
Accepted at checkoutGenerated at checkout: plan, price, included checks, start date. It serves as the Order Form.
Acceptable Use Policy
New in v2The prohibited uses in § 07. Binding through Section 8 of the Terms of Service and Section 8.7 of the DPA.
Signal documentation
ReferenceWhat each signal means, its sources by category and its known limitations. Use it for your DPIA and your answers to data subjects.
DORA ICT addendum
On requestFor EU financial entities. Covers the contractual provisions required by Art. 30 of Regulation (EU) 2022/2554.
Privacy Policy
Our own processingVersion 2.0. How we handle data as a controller: website visitors, business contacts, account users and billing.
Cookie Policy
Our websiteVersion 2.0. Cookies on socialscore.io only. For the Pixel on your own site, use template S4.
Notice templates for your website#
Short texts for your privacy policy, forms and cookie banner. Pick your type of business, replace the fields in brackets, and adapt the wording with your counsel.
For e-commerce: fraud checks at registration and checkout, optional personalisation, and the Pixel.
S1 · Privacy policy clause
Your privacy policyFraud prevention and personalisation. When you register or place an order, we check your email address and phone number with SocialScore (DSNTech LTD, Bulgaria), our processor, to prevent fraud and fake orders (legal basis: legitimate interest, Art. 6(1)(f) GDPR). If you agree, we also use publicly available information linked to your email to personalise our offers (legal basis: consent, Art. 6(1)(a) GDPR, which you can withdraw at any time). These checks never lead to an automatic decision about you. Objections and questions: [privacy email].
S2 · Note under the email field
Sign-up and checkoutWe check your email and phone to protect your order from fraud. [Privacy policy]
S3 · Personalisation checkbox
Checkout or account settingsPersonalise my offers using publicly available information linked to my email. I can withdraw at any time.
Unticked by default, separate from your terms, and never a condition of purchase (Art. 7(4) GDPR).
S4 · Cookie banner category for the Pixel
Your consent toolAnalytics and audiences. The SocialScore Pixel helps us understand visits and show relevant offers. IP addresses are shortened and devices are recognised by a hashed code. Active only with your consent.
Fire the Pixel only after the visitor accepts this category. Your consent tool's scan lists the exact cookie names for your cookie policy.
For lenders, BNPL, payment and e-money institutions: fraud and identity checks at onboarding, kept apart from credit decisions.
F1 · Privacy policy clause
Your privacy policyFraud and identity checks. When you apply or open an account, we check your email address and phone number with SocialScore (DSNTech LTD, Bulgaria), our processor, to detect fraud and fake identities (legal basis: legitimate interest, Art. 6(1)(f) GDPR). The results are fraud indicators only. We do not use them to assess your creditworthiness or to decide on your application, and a person reviews any case where a check affects you. Objections and requests for review: [privacy email].
F2 · Note on the application form
Onboarding and application formsWe check your email and phone number to protect you and us against fraud. This check does not affect your credit assessment. [Privacy policy]
F3 · Internal policy clause
Credit policy or model governanceSocialScore signals are used only for fraud prevention [and consented marketing]. They are excluded from creditworthiness assessment, credit models and decisions on price, limit or terms (Art. 18 Directive (EU) 2023/2225; Art. 22 GDPR). A fraud signal can trigger manual review, never an automatic rejection. Owner: [role].
For any business using personas, segments and ad audiences. Consent comes before the first check.
M1 · Privacy policy clause
Your privacy policyPersonalised offers (with your consent). If you agree, SocialScore (DSNTech LTD, Bulgaria), our processor, uses your email [and phone] and publicly available information to place you in general interest segments. We use them to personalise offers and to build ad audiences on [Meta / Google]. We do not infer sensitive data. You can withdraw consent or object to marketing at any time: [link].
M2 · Consent checkbox
Registration, newsletter or account settingsI agree that [Company] uses publicly available information linked to my email to personalise offers and ads for me. I can withdraw at any time.
Unticked by default. Store the time and wording of each consent.
M3 · Ad audiences
Your privacy policyAdvertising audiences. With your consent, we share your email in hashed (coded) form with [Meta / Google] to show you relevant ads or to exclude you from them. You can object at any time: [link].
For AI-driven personalisation, chat assistants and orders placed by AI agents.
A1 · Privacy policy clause
Your privacy policyAI-assisted personalisation. We use AI tools, including SocialScore, to group customers into segments and tailor content. They support our team and do not take decisions with legal or similarly significant effects on you. You can ask for human review or object: [privacy email].
A2 · Chat assistant notice
First message of your chatbotYou are chatting with an AI assistant. You can ask for a person at any time.
Art. 50(1) AI Act: people must be told when they interact with an AI system, unless it is obvious.
A3 · Orders placed by AI agents
Your privacy policy or termsOrders through AI agents. When an AI agent shops for you, we check the email and phone it provides to prevent fraud, as described in our privacy policy.
Questions from counsel#
Is SocialScore a credit bureau or a credit reference agency?
No. We do not collect credit data, do not report on payment behaviour and do not provide information for credit decisions. Credit use of the service is prohibited (§ 07).
Can a bank, lender or BNPL provider use SocialScore?
Yes, for fraud prevention, such as application fraud, synthetic identities and account takeover, and for marketing to its own customers with consent. Data Signals must stay out of creditworthiness assessment and credit decisions. Template F3 gives you the internal policy clause.
Does SocialScore make automated decisions under Art. 22 GDPR?
No. We return information, not decisions. Because Art. 22 can apply to a score that drives a third party's decision (CJEU C-634/21), the contract also prohibits using a signal as the sole or determining factor in decisions with significant effects. Your own decision process remains yours to assess.
Do we need a DPIA?
Probably yes, if you profile customers at scale or combine data from external sources. These are criteria in the EDPB DPIA guidelines (WP248). This page, DPA Appendix 1 and the signal documentation give you the processor-side input, and our data protection contact can walk you through it.
Do we have to tell our customers?
Yes. Art. 13 applies to what you collect and Art. 14 to data from other sources. The templates in § 16 cover both.
Why keep a hashed log of checks, and is it anonymous?
The log lets us document every check we performed for you, answer disputes and support requests, verify billing and detect abuse. Identifiers are hashed, so a leaked log reveals no readable email or phone. Hashing is pseudonymisation, not anonymisation, so we treat the log as personal data under the DPA, keep it separately for each customer and delete it after 30 days (DPA Section 3.4).
Do you use our data for other customers?
Not as personal data. We do not sell your data and do not use it to build products for other customers. We create anonymised statistics with every identifier removed, for example how common a platform or an interest category is in a country or sector, and share them only in aggregated form that identifies neither a person nor your company (DPA Section 3.3). Model training uses anonymised data only and never serves credit, lending or insurance models (DPA Section 3.1(d)).
Can we audit you?
Yes. We first answer your security questionnaire and share our measures and our sub-processors' certifications. If that is not enough, you can audit once every 12 months on 30 days' notice, at your cost, through an auditor bound by confidentiality, and also after a breach or at a regulator's request (DPA Section 4).
Are you subject to DORA or NIS2?
We are not a financial entity. For EU financial entities we are an ICT third-party service provider, and a DORA Art. 30 addendum is available on request. Based on our size and sector we are currently outside NIS2 scope.
Is SocialScore a KYC or AML tool?
No. Signals can support fraud controls, but they do not replace customer due diligence or identity verification under AML law.
What happens if a customer objects or asks for deletion?
In Pass-Through mode we keep only a hashed check log for 30 days, so honouring an objection means not submitting that identifier again. Profiles kept in Storage mode can be deleted from the dashboard immediately.
Are you ISO 27001 certified?
Not yet. Our practices are aligned with ISO/IEC 27001:2022, and certification is targeted for 2027. Our hosting and data providers are certified, and we provide evidence of our own controls on request.
What changed for existing customers in version 2.0?
The Data Sharing Addendum no longer applies: SocialScore now acts only as your processor and keeps no shared history or flag database of personal data across customers. Personal data held under that addendum is deleted or irreversibly anonymised within 30 days of 20 October 2026. Credit and BNPL use is expressly prohibited, and the DPA lists the security measures in place today.
Who is your data protection contact?
Write to our data protection contact at dpo@socialscore.io.
Contact#
Supervisory authority: Commission for Personal Data Protection (CPDP / КЗЛД), Sofia, Bulgaria.
This page summarises our legal framework for your review. It is not legal advice, and the accepted documents prevail.
Version 2.0 · 20 October 2026 · Credit and BNPL use prohibited · Data Sharing Addendum no longer applies · Acceptable Use Policy added · notice templates added.