Data Processing Addendum

This Data Processing Addendum (the “DPA”) forms part of the terms of service at /terms. It is an agreement between you, the customer, and Colosseum Market Intelligence Ltd (“we”, “us”, “our”).

It applies whenever we process personal data on your behalf while we provide the service. It also sets out one thing that is true for every customer: fleet learning, in section 9. It is written in plain English.

Questions go to [email protected]. Our Data Protection Officer is at [email protected].

In short

• You decide what personal data we process for you. We act on your instructions.
• We keep it confidential and we protect it.
• We use only the sub-processors listed at /trust. We give 30 days’ notice before we add one.
• We tell you about a personal data breach within 24 hours of becoming aware of it.
• COLOSSEUM has one central brain. It learns from every customer’s content and results, post by post, and uses what it learns for every customer. This is a condition of using the service. Section 9 explains it.
• Other customers never see your identity, your channels, your dashboards or your figures.
• When you leave, we erase the personal-data identifiers in your data within 30 days. Your content and results stay in the brain’s training data.

1. Definitions

• Agreement — the terms of service at /terms, including this DPA.
• Customer Personal Data — personal data we process on your behalf to provide the service. One example: the public handles and comments of people who engage with your posts.
• Data Protection Law — the UK GDPR, the Data Protection Act 2018 and, where it applies, the EU GDPR.
• Sub-processor — a third party we engage to process Customer Personal Data.
• Personal Data Breach — a security breach that leads to the loss, destruction, alteration or disclosure of Customer Personal Data, or to unauthorised access to it.
• Central brain — the part of COLOSSEUM that learns what works from every customer’s content and results.
• Fleet learning — training the central brain on your data, and using what it learns for every customer, as section 9 describes.

“Controller”, “processor”, “data subject” and “processing” have the meanings given in Data Protection Law.

2. Our roles

• When we run the service for you, you are the controller of Customer Personal Data and we are your processor.
• For fleet learning (section 9), we decide why and how the central brain learns. For that use, we are an independent controller.
• For our own account, billing, security and website data, we are also an independent controller. The privacy policy at /privacy covers that data.
• You confirm that you have a lawful basis for the personal data you ask us to process. You also confirm that your instructions comply with Data Protection Law.

3. Your instructions

We process Customer Personal Data only on your documented instructions. Those instructions are the Agreement, this DPA, and the settings and approvals you give in the operator dashboard.

If we believe an instruction breaks Data Protection Law, we will tell you. We need not follow it. If the law requires us to process Customer Personal Data in another way, we will tell you first, unless the law forbids that.

4. Confidentiality

Everyone we allow to process Customer Personal Data is bound by a duty of confidentiality. Access is limited to the people who need it to run the service.

5. Security

We apply the technical and organisational measures in Annex 2. They protect Customer Personal Data against a Personal Data Breach. They take into account the state of the art, the cost, and the risks to the people concerned. We may update them, but never in a way that lowers the overall level of protection.

6. Sub-processors

• You give us general authorisation to use the sub-processors listed at /trust.
• Before we add or replace a sub-processor, we give at least 30 days’ notice. We update /trust and email the account holder.
• You may object on reasonable data-protection grounds within that notice period. If we cannot resolve the objection, you may end the affected part of the service before the change takes effect.
• Each sub-processor is bound by data-protection terms at least as protective as this DPA. We remain liable to you for their work.

7. Helping you meet your obligations

• Someone may ask us directly to exercise their rights over Customer Personal Data. If so, we pass the request to you without undue delay. We do not answer it ourselves unless you ask us to.
• We help you respond to those requests, taking into account the nature of the processing.
• We help you with security, breach notification, data protection impact assessments and consultation with a regulator. That help is limited to the information available to us.

8. Personal data breaches

• We notify you without undue delay, and within 24 hours of becoming aware of a Personal Data Breach affecting Customer Personal Data.
• The notice describes what happened, the data and people likely affected, the likely consequences, and what we are doing about it. If we do not have all of that at once, we send it in stages.
• A notice is not an admission of fault or liability.

9. Fleet learning

9.1 What it is

COLOSSEUM has one central brain. It learns from the content and results of every customer, post by post. What it learns is used to create content for every customer, including you. That is how the service gets better as more customers use it.

Fleet learning is a condition of using the service. There is no opt-out. If you do not want your data used this way, please do not use COLOSSEUM.

9.2 What the brain learns from

The central brain learns from everything the service creates, publishes or reads for you. That is per post, per stream and per account. It includes:

• Your content — scripts, captions, hooks, titles, thumbnails, video, audio, images and other assets.
• The choices behind each piece — voice, template, format and posting time.
• Engagement on your posts — views, retention, likes, shares, comments and clicks.
• Money results — revenue, paid-ad, email, bridge-page and funnel outcomes.

The brain learns from this data in full, at the level of each post. It is not limited to summaries or averages.

9.3 Your permission

By using the service, you agree to fleet learning. You confirm that you have the right to let us use the content and data you supply in this way.

9.4 What other customers see

Other customers never see:

• your identity, or your business’s identity;
• your channels, streams or handles;
• your dashboards, credentials, billing or account settings;
• the figures for your individual posts, shown as yours.

Other customers do receive content the central brain creates for them. That content draws on what the brain learned from every customer. Some customer screens show a fleet estimate, such as a benchmark for a niche. A fleet estimate is computed from every customer’s posts in that niche. It never names the customers behind it. Where a niche has few customers, an estimate can closely reflect one customer’s results.

9.5 Never sold

We never sell what the central brain learns, or the data it learns from. We never publish either of them outside COLOSSEUM. We do not use your data to train models for any third party.

9.6 Your audience

Comments and engagement on your posts, including the text of comments, may train the central brain. The personal data of the people who comment, such as handles and display names, is handled under our privacy policy at /privacy. Anyone can ask us to erase it through /data-rights.

9.7 When your account ends

Within 30 days of the Agreement ending, we erase or strip the personal-data identifiers in your data. That means the handles, names and other identifiers of people. Your content and per-post results stay in the central brain’s training data. What the brain has learned stays in its models.

10. International transfers

We and our sub-processors may process Customer Personal Data outside the UK and the EEA, for example in the United States. Where no adequacy decision or data bridge applies, transfers rely on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses. Those are part of each sub-processor’s data protection terms. /trust shows each sub-processor’s terms.

Transfers from the EEA to us in the UK rely on the European Commission’s adequacy decision for the UK. If that decision stops applying, they rely on the EU Standard Contractual Clauses.

11. At the end of the Agreement

• Within 30 days of the Agreement ending, we erase or strip the personal-data identifiers in Customer Personal Data, unless the law requires us to keep them.
• If you ask before the Agreement ends, we first return a copy of your data in a common machine-readable format.
• Copies in backups leave the backup cycle within 7 days of being erased.
• Your content and per-post results stay in the central brain’s training data, as section 9.7 describes.

12. Audits and information

We make available the information you reasonably need to show that we comply with this DPA. You, or an independent auditor bound by confidentiality, may audit that compliance. Audits need 30 days’ written notice. They happen at most once a year, unless a regulator requires more, and they are at your cost. We may first offer documents and existing reports, if those are enough to show compliance.

13. Liability, precedence and changes

• Liability under this DPA is subject to the limits in section 11 of the terms, except where the law does not allow a limit.
• If this DPA conflicts with the terms on data protection, this DPA takes precedence.
• We change this DPA the same way we change the terms. Material changes get a dated change-log entry and at least 30 days’ email notice, as section 15 of the terms describes.
• This DPA is governed by the law of England and Wales, as set out in section 14 of the terms.

Annex 1 — Details of the processing

Annex 2 — Security measures

• Encryption in transit. Data sent over public networks, between our systems, our sub-processors and the platforms, is encrypted with TLS.
• Encryption at rest. Customer data is stored at our database provider, which encrypts it at rest. API keys and other secrets are encrypted by our application before they are stored.
• Our own equipment. Processing that does not run at a cloud provider runs on equipment we operate in the United Kingdom. The primary copy of customer data stays at our database provider. Our equipment holds the working copies the service needs: generated media files, short-lived cache entries and operational logs.
• Separation between customers. Every customer-facing read and write is scoped to that customer by database row-level security. The central brain’s separate read-only login reads every customer’s content and results to train the brain (section 9).
• Access control. Production access is limited to the people who run the service. Multi-factor authentication is on for every administrator account.
• Audit log. Agent actions, decisions and approvals are recorded in an audit log.
• Backups. Our database provider takes a backup every day. Erased data leaves the backups within 7 days.
• Incident response. Automated alerting on service errors, and the breach commitments in section 8.

Annex 3 — Sub-processors

The current list is at /trust. It shows each sub-processor’s purpose, location and data protection terms.

Change log

• 2026-10-18 — first published. No prior versions.

This document was Claude-drafted in line with the deferred-counsel policy at /research. Tier-2 solicitor review will fire when the first paying customer subscribes.