Sparks Data Processing Agreement
Last updated: 11 October 2026
This Data Processing Agreement ("DPA") covers the personal data of your site's visitors that Sparks processes for you: contact-form messages, newsletter subscribers and the emails sent to them, and the people named or shown in your site's content. For that data you are the controller and Sparks is your processor. It doesn't cover your own account data, where Sparks is the controller; that's in our Privacy Notice.
How it works. This page is the Cover Page of the Common Paper Data Processing Agreement, Version 1.1. The Common Paper DPA Standard Terms, published at commonpaper.com/standards/data-processing-agreement/1.1, are incorporated into this DPA by reference. Together they form one agreement, and words with capitals (Provider, Customer, Agreement, Approved Subprocessors and so on) have the meanings given there or on this page. Where this page changes the Standard Terms (section 3 below), this page applies.
How it's agreed. This DPA forms part of the Terms of Service. You accept it when you accept the Terms; no signature is needed.
1. Parties and agreement
| Cover Page field | Entry |
|---|---|
| Provider | Nir Ninio, a registered business in Israel (Osek Murshe no. 034134452), trading as "Sparks". If we form a company to run Sparks, it takes Nir Ninio's place under this DPA, as under the Terms |
| Customer | The person who holds the Sparks account for the site, as named in that account |
| Agreement | The Sparks Terms of Service, as updated (during the beta: the Sparks Private Beta Terms of Service) |
| Effective date | The date you accept the Terms |
2. Key terms
| Cover Page field | Entry |
|---|---|
| Approved Subprocessors | The list at bysparks.com/subprocessors, as updated under section 2.6 of the Standard Terms. We give notice of changes by email to the account's email address |
| Provider Security Contact | privacy@bysparks.com |
| Security Policy | The security measures in Annex II below |
| DPA Covered Claim | None |
| DPA Liability Cap | None stated here: the limits of liability in the Agreement apply (section 8 of the Standard Terms) |
| Governing Member State (EEA SCCs, Clauses 17 and 18) | Ireland |
| UK Addendum (governing law and courts) | England and Wales |
| Service Provider relationship (US state privacy laws) | Not selected |
3. Changes to the Standard Terms
- Security reports (section 5.2). Section 5.2 of the Standard Terms is replaced by: "Provider has not been audited by an independent third-party auditor. Upon written request, Provider will point Customer to the then-current security reports or certifications (such as SOC 2 or ISO 27001) of its hosting and infrastructure Subprocessors, where those Subprocessors make them available." Section 5.3 (security due diligence: questionnaires and information requests) applies as written.
- No AI training. Provider will not use Customer Personal Data to train AI models, and requires its AI Subprocessors not to use it for training.
- Deletion schedule (section 7). When Customer deletes a message, a subscriber or a site, Provider starts deleting that Customer Personal Data at once. When the Agreement ends, the site is suspended (Customer can still sign in, view and export), then deleted 14 days later (30 days if the site was on a paid plan), unless Customer instructs earlier deletion. Copies in backups expire within 90 days; if a backup is ever restored, Provider deletes again anything that was erased.
Annex I: processing details
A. List of parties
| Data exporter | Data importer | |
|---|---|---|
| Name | Customer, as named in its Sparks account | Nir Ninio, a registered business in Israel (Osek Murshe no. 034134452), trading as Sparks |
| Address | As given in Customer's account, or on request | Available on request |
| Contact | The account's email address | privacy@bysparks.com |
| Activities | Using the Sparks service to run its website | Providing the Sparks service |
| Role | Controller | Processor |
| Signature and date | Accepted electronically with the Agreement | Accepted electronically with the Agreement |
B. Description of the processing
| Cover Page field | Entry |
|---|---|
| Service | Sparks: website building and hosting, the site's contact form and newsletter |
| Categories of Data Subjects | Visitors to Customer's site; people who contact Customer through it; newsletter subscribers; people named or shown in Customer's site content |
| Categories of Personal Data | Contact details (name, email address); message content; newsletter subscription and consent records (subscribed at, confirmed at, source, unsubscribe status); email delivery data (delivery, bounces, complaints); IP addresses, used to rate-limit the site's forms and held in memory only, not stored |
| Special Category Data | None intended. A visitor may volunteer it in a message |
| Special Category Data Restrictions or Safeguards | Messages are visible only to Customer and its editors, and to Provider's staff only when Customer asks for support |
| Frequency of Transfer | Continuous |
| Nature and Purpose of Processing | Collecting, storing and displaying form messages and subscriber records to Customer; sending notification and newsletter emails on Customer's instructions; exporting and deleting on Customer's instructions |
| Duration of Processing | For the term of the Agreement, then until deletion under section 3.3 above |
C. Competent supervisory authority
The supervisory authority determined under Clause 13 of the EEA SCCs. For transfers under the UK Addendum, the UK Information Commissioner's Office.
Annex II: security measures
- Encryption in transit: HTTPS for every page and API. At rest: our hosting and database providers' storage encryption.
- Separation: every record belongs to one site, and access is checked against that site.
- Access control: owners and editors sign in through single sign-on. Staff access is limited to support and recovery, and it's logged.
- Logging: every sign-in and staff action is logged and kept for 12 months.
- Unpublished sites stay private: sites that are coming soon, in preview, suspended or hidden serve none of their content.
- Backups and deletion: backups expire within 90 days; erasure is applied again after any restore; deletion is confirmed by each of our systems.
- Monitoring: uptime and error monitoring, with alerts to our operations mailbox.
- Suppliers: sub-processors are bound by written data-processing terms; we prefer providers with SOC 2 or ISO 27001 reports.
- Incidents: we notify Customer without undue delay and no later than 72 hours after becoming aware of a Security Incident (section 4 of the Standard Terms).
Annex III: sub-processors
The Approved Subprocessors listed at bysparks.com/subprocessors.
This DPA uses the Common Paper Data Processing Agreement (Version 1.1), free to use under CC BY 4.0. The Cover Page entries and the changes in section 3 are Sparks' own.