Data Processing Addendum

The Social Selling Company Limited
71-75 Shelton Street
London
WC2H 9JQ
United Kingdom
E: [email protected] W: https://socialselling.co.uk

Effective from: 4th November 2026

This Data Processing Addendum ("Addendum") forms part of the Platform Terms of Use and the Subscription Terms and Conditions (together, the "Terms") between The Social Selling Company Limited ("We", "Us", "Our") and the business that holds a Silla account ("You", "Your"). It applies whenever We process personal data on Your behalf through the Silla platform. By accepting the Terms, You accept this Addendum. If this Addendum conflicts with the Terms on a matter of data protection, this Addendum applies.

1. Definitions

"Data Protection Law" means the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 and any law that replaces or amends them.

"Customer Data" means personal data that You, or people acting for You, load into or collect through the Silla platform about Your own visitors, leads, contacts, clients and customers. It does not include personal data We hold about You as Our customer, which We process as a controller under Our Privacy Policy at https://socialselling.co.uk/legal/privacy.

"Sub-processor" means a third party We engage to process Customer Data on Our behalf.

"Controller", "processor", "data subject", "personal data", "processing" and "personal data breach" have the meanings given in Data Protection Law.

2. Roles

2.1 For Customer Data, You are the controller and We are Your processor.

2.2 For personal data about You and the people who use Your account, We are the controller, and Our Privacy Policy applies.

2.3 Where You connect Your own account with a third-party service (for example Stripe, WhatsApp through Meta, Zoom, a calendar provider or an advertising platform), that service processes data under Your own agreement with it, not as Our Sub-processor. Annex 2 lists which services are which.

3. Details of the processing

3.1 Subject matter and purpose. Providing the Silla platform to You: hosting Your pages and forms, holding Your contact records, sending messages You compose or automate, running webinars, calls and client portals, measuring how people use Your pages, and the other features described in the Terms.

3.2 Duration. For as long as You hold a Silla account, and then for the deletion period in clause 10.

3.3 Nature of the processing. Collection, storage, organisation, analysis, transmission, display and deletion of Customer Data as directed by Your use of the platform.

3.4 Types of personal data. Names, email addresses, telephone numbers, job titles, company names and addresses; form answers and survey or diagnostic responses; messages exchanged with You; purchase and subscription records; login details for Your client portal; records of how people interact with Your pages, emails, links, videos and webinars, including a visitor identifier held in a cookie where the visitor has accepted it; call bookings and, where You switch them on, call recordings and transcripts.

3.5 Categories of data subject. Your website visitors, leads, contacts, event and webinar registrants, customers and clients, and people they refer.

3.6 Special category data. The platform is not designed for special category data (such as health, religion or sexual orientation) or data about criminal convictions. You must not load it unless You have a lawful basis to do so and have told Us in writing first.

4. Our obligations

We will:

4.1 process Customer Data only on Your documented instructions, which are the Terms, this Addendum and Your use of the platform's features and settings, unless the law requires Us to do otherwise, in which case We will tell You first unless the law prevents Us;

4.2 tell You if We believe an instruction breaks Data Protection Law;

4.3 make sure that everyone We authorise to process Customer Data is bound by a duty of confidentiality;

4.4 put in place the technical and organisational measures in Annex 1, and keep them under review;

4.5 help You, taking into account the nature of the processing, to respond to requests from data subjects exercising their rights, through the platform's own tools where they exist and otherwise within a reasonable time;

4.6 help You meet Your own obligations on security, breach notification, data protection impact assessments and consultation with the Information Commissioner, so far as the information is in Our hands;

4.7 delete or return Customer Data at the end of the processing as set out in clause 10;

4.8 make available the information You reasonably need to show that We meet this Addendum, and allow audits as set out in clause 9.

5. Your obligations

You will:

5.1 make sure You have a lawful basis for every piece of Customer Data You collect or load, including any consent needed for marketing, for cookies and similar technologies on Your pages, and for recording calls;

5.2 publish Your own privacy notice and cookie notice that tell Your visitors and contacts how You use their data, that You use a platform provider to process it, and about the cookies and identifiers the platform sets on Your pages (We provide guidance wording in the Silla help centre);

5.3 give Us only lawful instructions, and be responsible for how You configure the platform, including which features You switch on;

5.4 keep Your account credentials secure and manage who in Your organisation has access;

5.5 tell Us promptly if You receive a request or complaint from a data subject or a regulator that needs Our help.

6. Sub-processors

6.1 You authorise Us to use the Sub-processors listed in Annex 2 and at https://socialselling.co.uk/legal/sub-processors.

6.2 We will give You at least 30 days' notice before adding or replacing a Sub-processor, by updating that page and telling account holders by email or in the platform. If You object on reasonable data protection grounds within that period and We cannot resolve the objection, You may end Your subscription under the Terms and We will refund any prepaid fees for the period after termination.

6.3 We will have a written contract with each Sub-processor that imposes data protection obligations no less protective than this Addendum, and We remain responsible to You for their performance.

7. International transfers

7.1 We host Customer Data in the United Kingdom and the European Economic Area, except where Annex 2 says otherwise.

7.2 Where a Sub-processor processes Customer Data outside the United Kingdom, We rely on an adequacy decision, the UK International Data Transfer Agreement or Addendum, or another transfer mechanism permitted by Data Protection Law, and We will tell You which on request.

8. Personal data breach

8.1 We will tell You without undue delay, and in any case within 48 hours, after becoming aware of a personal data breach affecting Customer Data.

8.2 Our notice will describe, so far as We know, the nature of the breach, the categories and approximate number of data subjects and records involved, the likely consequences, and the measures taken or proposed. We will update it as We learn more.

8.3 We will not tell Your data subjects or any regulator about a breach of Customer Data on Your behalf unless You ask Us to or the law requires it.

9. Audit

9.1 Once in any 12 month period, and additionally after a personal data breach affecting Your Customer Data, You may ask Us for information to verify Our compliance with this Addendum. We will answer in writing within 30 days.

9.2 If that information is not enough to meet a requirement of Data Protection Law, You may carry out an audit, on at least 30 days' written notice, during business hours, no more than once a year, under confidentiality terms, by Yourself or an independent auditor We do not reasonably object to. You bear the cost of the audit and Our reasonable costs of supporting it beyond one working day.

10. Deletion and return

10.1 While Your account is open, You can export Customer Data and delete individual records through the platform. Deleting a contact removes their personal data in the way the Silla help centre describes, keeping only what the law requires Us or You to keep (for example invoice details for tax purposes, held out of ordinary view) and a one-way hash of an address that has opted out, so that We can honour the opt-out if the address is loaded again.

10.2 When Your account ends, We will keep Customer Data for 30 days so that You can export it, then delete it, unless the law requires Us to keep particular records for longer, in which case We will keep only those records, for only as long as required, and continue to protect them under this Addendum.

10.3 Copies in backups are overwritten in the ordinary backup cycle, within 35 days.

11. Liability

Each party's liability under this Addendum is subject to the limits and exclusions in the Terms. Nothing in this Addendum limits a party's liability where Data Protection Law does not allow it to be limited.

12. Changes

We may update this Addendum to reflect changes in the platform or in Data Protection Law. We will give You at least 30 days' notice of a material change in the way We notify changes to the Terms. The latest version is at https://socialselling.co.uk/legal/data-processing.

Annex 1: Technical and organisational measures

• Hosting. Production systems run on Amazon Web Services in the London region and on Cloudflare's network, with the web servers reachable only through a private tunnel and no public server ports.
• Encryption. Data is encrypted in transit (TLS) and at rest. Stored credentials for connected services are encrypted at the application level.
• Access control. Access to production systems is limited to named staff with a need, protected by multi-factor authentication. Staff actions in the administration system are logged. Staff can never sign in as a customer's own contact or client.
• Tenant separation. Every Customer Data record carries the identity of the organisation that owns it, and every read and write is scoped to that organisation. A visitor identifier is never resolved to another organisation's contact.
• Consent gating. On Your pages, the visitor identifier cookie is set and read only after the visitor accepts analytics cookies in the banner, and scripts You add run only after marketing consent.
• Abuse protection. Public forms and sign-ins are protected against automated abuse by rate limits, timing checks and bot detection.
• Deletion tooling. Contact deletion runs against a single maintained inventory of every table holding contact data, and the inventory is tested against the live database schema.
• Backups and recovery. Databases are backed up automatically with point-in-time recovery; backups are encrypted.
• Secure development. Changes are reviewed and tested before deployment, dependencies are monitored for known vulnerabilities, and the platform's security policies are published on request.
• Incident response. A written incident management procedure covers detection, containment, assessment and notification.

Annex 2: Sub-processors and connected services

Sub-processors We engage

Services You connect under Your own agreement (not Our Sub-processors): Stripe (payments, under Your own Stripe account), Meta Platforms (WhatsApp Business, Lead Ads, Conversions API and pixels, under Your own Meta accounts), Zoom, Google and Microsoft (calendar and meeting connections), and any other integration or script You add to Your pages.

Last updated: 4 November 2026