Privacy Policy

1. Data controller

Sparks Business Development is the data controller for personal data processed through go-sparks.com and related contact channels.

Contact for privacy matters: caroline@go-sparks.com · Amsterdam, The Netherlands.

2. Personal data we process

Depending on how you use our website, we may process:

• Identity and contact details (name, email address, company name) when you submit our contact form, book a meeting, or email us.
• Message content and enquiry details you choose to provide.
• Technical data such as IP address, browser type, device information, and pages visited when analytics cookies are accepted.
• Language preference stored in a cookie and browser storage.
• Chatbot conversation history stored locally in your browser (not on our servers).
• Admin account data (email address, authentication metadata) for authorised Sparks ADMIN users via Clerk.

3. Purposes and legal bases

We process personal data only where a legal basis applies under Article 6 GDPR:

• Responding to enquiries and providing consultancy — legitimate interest and, where applicable, pre-contractual steps at your request.
• Scheduling meetings via Cal.com — performance of steps at your request prior to a contract.
• Operating and securing the website — legitimate interest.
• Website analytics (Google Analytics) — your consent (Art. 6(1)(a) GDPR). Analytics is disabled until you accept analytics cookies.
• Language preference — legitimate interest / technical necessity for site functionality.
• Admin authentication — legitimate interest and performance of our internal access management.

4. Recipients and processors

We do not sell your personal data. We share data only with service providers that help us operate our business, under data processing agreements where required:

• Cloudflare — website hosting, CDN, and security (infrastructure).
• Resend — transactional email delivery for contact form notifications.
• Clerk — authentication for Sparks ADMIN users only.
• Supabase — event content storage and admin backend (no public visitor profiles).
• Google Ireland Limited — Google Analytics (only after consent).
• Cal.com, Inc. — online meeting scheduling embed (only after consent for third-party embed cookies/scripts).
• WhatsApp / Meta — if you contact us via WhatsApp, your communication is subject to WhatsApp's terms and privacy policy.

5. International transfers

Some processors are located outside the European Economic Area (EEA), including in the United States. Where transfers occur, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and/or the EU–US Data Privacy Framework where applicable. You may request more information about transfer safeguards by contacting us.

6. Retention

We retain personal data only as long as necessary:

• Contact form enquiries — up to 24 months after our last communication, unless a longer period is required for legal or business records.
• Email correspondence — according to our mailbox retention practices, typically up to 24 months.
• Analytics data — according to Google Analytics settings (default up to 14 months for user-level data where configured).
• Language preference — up to 12 months.
• Cookie consent record — up to 12 months.
• Chatbot history — stored in your browser until you clear site data or use "Start new conversation".
• Admin account data — for the duration of the admin relationship and as required by law thereafter.

7. Your rights

Under the GDPR, you have the right to access, rectify, erase, restrict, or object to processing of your personal data, and to data portability where applicable. Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise your rights, email caroline@go-sparks.com. We will respond within one month, as required by law.

8. Complaints

If you believe we have not handled your personal data correctly, you have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens): https://autoriteitpersoonsgegevens.nl.

9. Cookies and similar technologies

We use cookies and browser storage. Non-essential cookies (analytics and third-party booking embeds) are placed only after your consent. See our Cookie Policy for details and to change your preferences at any time.

10. Security

We implement appropriate technical and organisational measures to protect personal data, including HTTPS encryption, access controls for admin systems, and processor due diligence. No method of transmission over the internet is 100% secure.

11. Children

Our website is intended for business professionals and is not directed at children under 16. We do not knowingly collect personal data from children.

12. Changes

We may update this Privacy Policy from time to time. The "Last updated" date at the top indicates the latest revision. Material changes may require renewed consent where applicable.