sidlee

 

This Addendum supplements the main Sid Lee Privacy Policy and applies specifically to the data collected and processed by our social media monitoring application. This application is designed to enhance our engagement with users on social media platforms like Instagram and Twitter by identifying and analyzing publicly available content that mentions or tags our brand.

1. Data Controller and Owner

Sid Lee
12102-1 Place Ville Marie
Montreal, QC, H3B 3Y1,
Canada

privacy@sidlee.com

2. Data We May Collect from Social Media and How We Use It

Our social media monitoring application collects publicly available videos, images, tweets, and other media, along with associated captions, hashtags, usernames/account handles, and timestamps, when users on Instagram and Twitter use specific hashtags and tag our official Sid Lee accounts.

• Types of Data Collected:
  • Video and image content from posts/tweets.
  • Associated captions, tweet text, and hashtags.
  • Usernames and account handles of the posters/tweeters.
  • Timestamps of the posts/tweets.
  • Any public comments or replies on those posts/tweets (if applicable).
• Purpose of Collection and Use:
  We collect and process this information to:
  • Analyze user-generated content for sentiment, trends, and feedback related to our brand, products, and services.
  • Identify and review content submitted as part of social media marketing campaigns and challenges.
  • Enable us to respond directly and appropriately to users who have engaged with our brand through hashtags or mentions.
  • Improve our marketing strategies, products, and services based on insights derived from public social media engagement.
• Legal Basis for Processing (GDPR): Our legal basis for processing this data is our Legitimate Interest. We have a genuine and legitimate interest in promoting our brand, understanding public sentiment, engaging with our audience, and running effective marketing campaigns on social media. When users participate in public challenges, tag our accounts, or use specific hashtags, they are doing so with an expectation of interaction and potential response from our brand. We have assessed that this processing is necessary for our legitimate interests and that the interests or fundamental rights and freedoms of data subjects are not overridden, especially given the publicly available nature of the data and the user's explicit action to draw our attention.

3. Data Storage and International Data Transfers

• Storage Location: All videos, images, and associated social media data downloaded by our application will be stored in an Azure cloud data center located in the Eastern United States.
• International Data Transfers: As our company is based in Canada, and the collected social media data is transferred to and processed in the United States, this constitutes an international data transfer.
• Safeguards for Transfers: To ensure the protection of your personal information when transferred to and processed in the United States by Azure AI services, we rely on the Standard Contractual Clauses (SCCs), which are incorporated into our contractual agreements with Microsoft Azure (specifically their Data Processing Addendum and Online Services Terms). Microsoft also maintains various certifications and compliance programs to support these transfers, ensuring an adequate level of data protection. All communications and data stored within the Azure cloud are encrypted, providing a high level of technical security.

4. Data Retention
We retain the Instagram and Twitter videos, images, and associated media downloaded by our application for a strict period of 3 months from the date of collection. After this 3-month period, the data is permanently deleted from our systems. There are no exceptions to this retention period unless we obtain explicit, specific permission from the content owner to preserve their media for a longer duration for a defined purpose.


5. Third-Party Access and Sharing

Sid Lee is committed to protecting your information. No part of the Instagram or Twitter media collected by this application (including video content, detected objects, or associated metadata) will be sold, rented, or otherwise disclosed to any third parties, nor will it be processed by any third parties other than Microsoft Azure services and the respective social media platforms (Instagram and Twitter) through their standard public APIs. Our strict commitment not to sell, rent, or otherwise disclose user information to third parties, as outlined in our main Privacy Policy, fully applies to the data collected by this application.


6. Your Rights and Choices

In addition to the rights outlined in our main Privacy Policy (including the right to access, rectification, deletion, restriction of processing, data portability, and objection), you specifically have the right to object to the processing of your data obtained through our social media monitoring application.

• Exercising Your Rights: To exercise any of these rights regarding your Instagram or Twitter data collected by this application, please contact us at: socialrequests@sidlee.com.
• Identity Verification for Social Media Data Requests: To help protect your privacy and ensure security, we must verify your identity before responding to requests related to your Instagram or Twitter data. When you send a request to the email address above, we will respond with specific instructions for a verification challenge. This challenge will involve a low-friction, temporary action on your Instagram or Twitter account that only the account owner could perform. Examples include:
  • For Instagram: Temporarily adding a unique code to your Instagram bio, making a temporary Instagram Story/Post tagging our account with a unique code, or sending a Direct Message to our official Instagram account with a unique code.
  • For Twitter: Sending a Direct Message to our official Twitter account with a unique code, or posting a temporary public tweet tagging our account with a unique code (which you can delete immediately after verification).
• Upon successful completion of the verification challenge, we will proceed to fulfill your request in accordance with applicable laws, typically within 30 days. We will not charge a fee for this process, unless permitted by law. We will not store any additional Personally Identifiable Information collected during the verification process beyond what is necessary to confirm your identity for the specific request.

Last Updated: June 20, 2025