Data processing terms
Last updated: 18 October 2026.
These terms form part of the Terms of Service between Borderless Talent Hub Ltd, trading as SocioRelay ("we"), and the business using SocioRelay ("you"). They meet Article 28 of the UK GDPR.
1. Roles
1.1 You are the controller and we are your processor for personal data in your SocioRelay app. That data includes:
- posts, images and comments;
- names, faces and details of people mentioned in your content;
- your team's and clients' details;
- review links and reviewers' comments;
- the data your connected platform accounts give your app.
1.2 We are the controller for your account, billing and support data (see the Privacy Policy). 1.3 If you are an agency acting for clients, you confirm each client has authorised you to use us as a sub-processor on these terms.
2. What we process
| Subject matter | Running your hosted SocioRelay app: planning, drafting, approving, scheduling and publishing content, and reporting on it |
| Duration | While you have a trial or plan, plus 30 days, plus up to 6 months in backups |
| Nature and purpose | Storage, hosting, backup, transmission to the platforms, website and AI services you choose, and support |
| Types of data | Content and images; names and contact details of your team, clients and reviewers; social account names and ids; platform access tokens; post performance figures |
| Data subjects | Your staff, clients, customers and anyone appearing in your content |
3. Our commitments
3.1 Your instructions only. We process the data only on your documented instructions, which include using the service as designed and these terms. The exception is processing UK law requires, in which case we will tell you unless the law forbids it. 3.2 Confidentiality. Everyone we allow to process the data is bound by confidentiality. 3.3 Security. We take appropriate technical and organisational measures:
- a separate app and data store for each business;
- platform logins and keys encrypted with a key for that business alone;
- encrypted connections;
- servers in the United Kingdom, reachable only by named staff with two-step sign-in;
- firewalls and automatic security updates;
- encrypted nightly backups held with a separate provider;
- support access to your app only with your permission, and logged.
3.4 Sub-processors. We use the sub-processors listed below. We will give at least 30 days' notice of a new one by email, and you may object; if we can't resolve it, you may cancel. We impose the same data protection obligations on them. 3.5 Your requests and rights. We will help you answer requests from people exercising their rights, and with security, breach notification, data protection impact assessments and consultations with the ICO, as far as reasonable. 3.6 Breaches. We will tell you without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting your data. We will give you the information we have. 3.7 When you leave. At the end of the service we delete your data after 30 days (or return it as an export if you ask within that time). Backups expire within 6 months. We keep only what the law requires. 3.8 Audits. We will make available the information needed to show we meet these terms, and allow audits by you or an auditor you appoint. Audits are on reasonable notice, at your cost, no more than once a year unless a breach makes it necessary.
4. Your commitments
4.1 You have a lawful basis for the personal data you put in your app and publish, and you have given any notices required. 4.2 You will not ask us to process special category or criminal offence data unless it is necessary for your posts and lawful.
5. Sub-processors
| Sub-processor | What for | Where |
|---|---|---|
| Hostinger International Ltd | Servers that run your app and its database | United Kingdom |
| Backblaze, Inc. (or Cloudflare, Inc.) | Encrypted backups | EU region |
| Amazon Web Services EMEA SARL | Sending email alerts and reports | London |
| Anthropic, PBC | AI drafts, only when you use AI credits | United States |
| OpenAI, L.L.C. | AI images, only when you use them | United States |
| Pexels GmbH | Photo search (search words only) | Germany |
| Pixabay GmbH | Photo search (search words only) | Germany |
| Keygen LLC | Licence and plan checks (no content) | United States |
The platforms and AI accounts you connect yourself (for example Meta, LinkedIn, X, TikTok, Google and your own AI provider) receive data because you instruct us to send it to them. They act under their own terms, not as our sub-processors.
6. Transfers outside the UK
Where a sub-processor is outside the UK, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum.
7. Liability
The liability terms in the Terms of Service apply to these terms.
Questions about this page: info@sociorelay.com.