Privacy Policy

Introduction

Sparko Technologies Pte. Ltd. ("Sparko," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard information. Sparko plays two different roles depending on whose data it is, so Section 1 explains which role applies before anything else.

The entity responsible for the data described in this policy is Sparko Technologies Pte. Ltd., a private company limited by shares incorporated in Singapore (UEN 202642599C), with its registered office at 2 Fowlie Road, Sycamore Tree, Singapore 428505. Our services are hosted on AWS in Singapore (ap-southeast-1).

1. Sparko’s Two Roles

Depending on what data is involved, Sparko acts in one of two distinct roles under data protection law:

• As Controller: for data about you as a website visitor, a prospective customer, or an administrator/billing contact on a Sparko account. Here, Sparko decides why and how that data is used, same as any SaaS vendor’s own marketing and billing data.
• As Processor: for Employee Data, Applicant Data, Payroll Data, and Performance Data that a Customer inputs about their own employees and candidates, for Contract Data that a Customer uploads to Sparko Legal, for Signature Data on documents a Customer sends for signature in Sparko People, and for Ledger Data that a Customer records or uploads in Sparko Books (beta). Here, Sparko only processes that data on the Customer’s documented instructions, under the Data Processing Agreement. Sparko doesn’t decide why that data exists or what it’s used for.

Throughout this Policy, each data category is labeled [Controller] or [Processor] so it’s clear which role applies.

2. Information We Collect

2.1 Information You Provide

• Account Information [Controller]: Name, email, company name, job title
• Employee, Applicant, Payroll and Performance Data [Processor; see Section 1]: Data you input about your employees and job applicants, including payroll, compensation, and performance records
• Contract Data [Processor; Sparko Legal only]: Contracts, playbooks, and vendor assessment evidence you upload, including the names and contact details of counterparties' and vendors' representatives that appear in them; and, when you send a contract for signature, signers' names, email addresses, and signatures, with the IP address and browser details recorded as signing evidence
• Signature Data [Processor]: when a document is sent for signature in Sparko People, signers’ names, email addresses, and signatures, with the evidence recorded for the signature
• Ledger Data [Processor; Sparko Books beta only]: Accounts and journal entries you record, bank statements, bills, and receipts you upload, and payroll postings from Sparko People, including the names of people and businesses that appear in them
• Payment Information [Controller]: Billing details collected and processed by Polar, our Merchant of Record, which is the seller of record for your transaction and handles them as an independent controller under its own privacy policy
• Communications [Controller]: Messages you send to us

2.2 Information Collected Automatically

• Usage Data [Controller]: Features used, pages visited, actions taken
• Device Information [Controller]: Browser type, IP address, device identifiers
• Cookies and similar technologies [Controller]: Necessary storage, plus analytics and marketing identifiers only if you opt in (see Section 12)

3. How We Use Your Information

We use collected information to:

• Provide and maintain the Services
• Process transactions and send related information
• Send administrative communications
• Respond to inquiries and provide support
• Improve and personalize the Services
• Monitor usage and analyze trends
• Detect and prevent fraud or abuse
• Comply with legal obligations

4. AI and Your Data

Our Services include AI-powered features. Here's how we handle your data in relation to AI:

• No Model Training: We never use your data to train AI models, and our AI providers do not use it to train theirs
• Data Isolation: Your data is logically separated from other customers' data
• Transparency: AI features are clearly identified in the product
• Human Oversight: AI suggestions can always be reviewed and overridden by users
• AI Infrastructure: AI features are powered by third-party AI infrastructure providers bound by data-protection obligations; see the sub-processor list in our Data Processing Agreement. They process each request to return a response and do not use it to train models. Our AI provider deletes request inputs and outputs within 30 days, and keeps them longer only where a request is flagged for safety review or the law requires it

4a. AI Processing Data Flow

Here is what data reaches our AI providers for our main AI-powered features, and what is excluded:

5. Information Sharing

We may share your information with:

• Service Providers: Third parties who help us operate the Services (hosting, AI processing, email delivery, analytics)
• Our Merchant of Record: Polar, which sells your subscription to you and processes payment and tax details as an independent controller
• Legal Requirements: When required by law or to protect rights
• Business Transfers: In connection with a merger or acquisition
• With Your Consent: When you direct us to share information

We do not sell your personal information to third parties.

6. Data Retention

How long we keep information depends on its category:

Some data may be retained longer where required by law.

7. Data Security

We implement industry-standard security measures including:

• AES-256 encryption at rest
• TLS 1.2+ encryption in transit
• Regular security assessments using industry-standard tools
• Access controls and audit logging
• Hosting on AWS in Singapore (ap-southeast-1) with multi-availability-zone redundancy and automated backups

For more details, see our Trust Center.

8. Your Rights

Depending on your location, you may have rights to:

• Access: Request a copy of your personal data
• Correction: Request correction of inaccurate data
• Deletion: Request deletion of your data
• Portability: Receive your data in a portable format
• Objection: Object to certain processing activities
• Restriction: Request restriction of processing

To exercise these rights, contact us at [email protected].

9. GDPR

For users in the EEA and the UK, we follow GDPR and UK GDPR requirements:

• We process data on the basis of contract performance, legitimate interests, consent (for optional analytics and marketing), and legal obligation (for tax and accounting records)
• Our Data Processing Agreement forms part of our Terms of Service for every customer
• We support data subject access requests
• We maintain records of processing activities

See our Data Processing Agreement for more details.

10. CCPA Compliance

For California residents, we comply with CCPA requirements:

• We disclose categories of personal information collected
• We do not sell personal information
• We honor requests to know, delete, and opt-out
• We do not discriminate against users who exercise their rights

11. Singapore PDPA

Sparko is incorporated in Singapore, so the Personal Data Protection Act 2012 ("PDPA") applies to us. Where we act as Controller, we handle personal data in line with the PDPA obligations, including:

• Consent, Purpose and Notification: we collect, use, and disclose personal data with your consent or as the PDPA otherwise permits, for purposes a reasonable person would consider appropriate, and we tell you what those purposes are.
• Access and Correction: you may ask what personal data we hold about you and how it has been used, and you may ask us to correct it.
• Accuracy and Protection: we take reasonable steps to keep personal data accurate and to protect it, as described in Section 7 and on our Trust Center.
• Retention Limitation: we stop retaining personal data once the purpose it was collected for no longer applies, subject to Section 6.
• Transfer Limitation: where we transfer personal data out of Singapore, we take steps to ensure a standard of protection comparable to the PDPA, as described in Section 14.
• Data Breach Notification: we assess incidents against the PDPA notification thresholds and notify the PDPC and affected individuals where the law requires it.

We have designated a Data Protection Officer as required by Section 11 of the PDPA. You can reach the DPO at [email protected], or by post at the registered address in Section 16.

Where Sparko acts as Processor (see Section 1), the Customer that put the data into Sparko (for example, your employer or prospective employer) is the organisation responsible for it under the PDPA, and we handle it on the Customer’s instructions under our Data Processing Agreement.

12. Cookies

When you visit sparko.app, a cookie banner lets you choose which categories of cookies to allow:

• Necessary: Required for the site to function: session handling and security. These cannot be turned off.
• Analytics: Helps us understand which pages are useful, using a random visitor identifier stored in your browser, with the page, referrer, campaign, device type, browser, operating system, time on page, and scroll depth. Only set if you opt in. Separately, we count page views with no identifier at all.
• Marketing: Remembers, for the rest of your browser session, which campaign link brought you to the site (its source, medium and campaign name), and sends it with a demo or beta request so we know which campaigns bring in customers. Only stored if you opt in, and deleted if you withdraw that choice.

You can change your choices at any time using the “Cookie Preferences” link in the site footer, or through your browser settings. Declining Analytics or Marketing cookies does not affect core site functionality.

13. Children's Privacy

Our Services are not intended for children under 16. We do not knowingly collect personal information from children. If we learn we have collected such information, we will delete it promptly.

14. International Transfers

Sparko is established in Singapore and hosts customer data on AWS in Singapore (ap-southeast-1), so your information may be transferred to and processed in a country other than your own. We ensure appropriate safeguards are in place for each direction of transfer:

• Into Singapore: Singapore is not covered by a European Commission adequacy decision, so personal data transferred from the EEA, the UK, or Switzerland is transferred under the Standard Contractual Clauses (Module Two), with Sparko as data importer, together with the UK International Data Transfer Addendum where the UK GDPR applies and the amendments required by the Swiss Federal Act on Data Protection where it applies.
• Out of Singapore: where we transfer personal data outside Singapore, for example to a sub-processor, we do so under contractual terms that provide a standard of protection comparable to the PDPA, in line with the Transfer Limitation Obligation.

See the Data Processing Agreement for the specific transfer mechanism and the current sub-processor list.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Services. Your continued use after changes constitutes acceptance.

16. Contact Us

For privacy-related questions or to exercise your rights, contact our Data Protection Officer:

Data Protection Officer
Sparko Technologies Pte. Ltd.
UEN 202642599C
2 Fowlie Road, Sycamore Tree, Singapore 428505
Email: [email protected]

If you are in Singapore and you are not satisfied with how we have handled your request, you may lodge a complaint with the Personal Data Protection Commission (PDPC). If you are in the EEA or the UK, you may lodge a complaint with your local supervisory authority.