Privacy Policy

last updated may 4th, 2026 1\ who we are spark layer ltd ("sparklayer", "we", "us", "our") provides b2b ordering software to merchants, delivered as an app on ecommerce platforms including shopify, wix, bigcommerce, woocommerce, and magento registered office trimbridge house, first floor, trim street, bath, ba1 1hb, united kingdom company registration number 12881913 ico registration zb074246 this policy explains what personal data we handle, why, the legal bases we rely on, who we share it with, and the rights available to you it covers our website, dashboard and apps, and our sales and support activity 2\ do we process personal data when providing our services? yes providing b2b ordering requires us to process personal data belonging to your customers in that processing you are the data controller and sparklayer is your data processor — we act only on your documented instructions, and only to deliver the service section 7 sets out exactly what we process and why; section 21 sets out the terms on which we do it 3\ the two roles we act in controller — for the personal data of people who visit our site, hold or administer a sparklayer account, and deal with our sales and support teams this policy governs that data processor — for the personal data of your customers, handled on your behalf to provide b2b ordering you are the controller; your own privacy notice governs that data 4\ personal data we handle as a controller category examples source identity & contact name, company name, company website, email you, at sign up account login credentials (hashed), settings, time zone, user role you / generated billing billing contact, plan, transaction records card details are handled by shopify or stripe and are not stored by us you / the platform / stripe usage & technical ip address, device and browser, pages viewed, feature usage, log data automatically support & sales messages, call notes, support tickets you / our tools marketing preferences and engagement with our emails you 5\ how we collect it directly from you — when you sign up, complete a form, or contact support or sales automatically — through cookies, logs and analytics (section 13) from third parties — including the ecommerce platform your store runs on when you install our app, and our billing and crm providers 6\ why we process it, and our legal bases purpose legal basis provide, operate and secure the service performance of a contract authenticate users and prevent abuse legitimate interests (security) bill and take payment contract / legal obligation provide support contract / legitimate interests improve and develop the product legitimate interests send service and transactional messages performance of a contract send marketing where permitted consent, or soft opt in for existing customers meet legal obligations (tax, accounting) legal obligation where we rely on legitimate interests , we have assessed that our interests are not overridden by your rights and freedoms you can ask us for details of that assessment 7\ data we process on behalf of merchants to provide the service we process personal data belonging to your customers, accessed through the ecommerce platform your store runs on the fields we process are field what it covers name first and last name email email address phone default and billing phone numbers address shipping and billing addresses we also process customer and order records available through the platform’s apis on shopify, these fields are approved under shopify’s protected customer data requirements we process this data only to provide b2b ordering functionality — including linking a customer to their customer specific pricing, and creating and managing their orders; enable your sales agents to search for and view customers on your behalf; and provide customer service we do not use this data for our own purposes, we do not sell it, and we do not use it to build marketing profiles section 21 sets out our contractual obligations as your processor 8\ sub processors we use the sub processors below, carry out due diligence on each, and bind them by contract to appropriate data protection terms we keep this list current and notify account holders of material changes sub processor purpose location transfer safeguard google cloud hosting and storage uk / eu — stripe billing and payments us / eu sccs / uk idta hubspot sales crm us sccs / uk idta intercom customer support us / eu sccs / uk idta google analytics usage analytics us sccs / uk idta cookiebot cookie consent management eu — the ecommerce platform your store runs on (e g shopify)is the source of the customer data we process on your behalf, under your own agreement with that platform 9\ international transfers where personal data is transferred outside the uk/eea, we rely on uk international data transfer agreements, the eu standard contractual clauses, or an adequacy decision, with supplementary safeguards where required you can request details of the safeguards in place 10\ how we keep data secure we protect personal data with technical and organisational measures including encryption in transit and at rest, least privilege access, multi factor authentication, logging and monitoring, and prompt access revocation when people leave full detail is in our security policy 11\ your rights under the uk gdpr you have the right to be informed; to access your data; to have inaccurate data corrected; to erasure; to restrict processing; to data portability; to object (including to direct marketing); and not to be subject to solely automated decisions with significant effects where we rely on consent, you may withdraw it at any time to exercise any right, email contact\@sparklayer io we will respond within the statutory period — normally one month, extendable by two further months for complex requests, which we will tell you about we may need to verify your identity 12\ rights over data we process for merchants if you are a customer of one of our merchants and wish to exercise rights over data we hold as a processor , please contact that merchant, who is the controller if you contact us, we will forward your request to them and assist them in responding 13\ how long we keep it we keep personal data only as long as we need it for account data, that means for the life of your account and for a limited period afterwards for personal data we process on a merchant’s behalf, we retain it while the merchant uses the service, and delete or return it on their instruction and after they uninstall our app where the law requires us to keep records — for example billing and tax records — we keep them for the period the law specifies you can ask us what applies to your data at any time 14\ cookies and analytics we use strictly necessary cookies to run the service and, with your consent, analytics cookies (google analytics) to understand usage we manage cookie consent through cookiebot — you can review or change your choices at any time through the cookie banner, and through your browser settings 15\ marketing we send marketing only with your consent, or on a soft opt in basis to existing customers for similar products every marketing email carries an unsubscribe link, and you can opt out at any time by emailing contact\@sparklayer io 16\ automated decision making we do not make decisions producing legal or similarly significant effects based solely on automated processing 17\ children’s data the service is aimed at businesses and is not directed at children we do not knowingly collect the personal data of children 18\ data breaches if a breach affects personal data, we follow our incident management policy where we are the controller and the breach is likely to risk individuals’ rights, we notify the ico within 72 hours where required, and affected individuals without undue delay where the risk is high where we are a processor, we notify the affected merchant without undue delay, as set out in 21 8 19\ third party links our site and apps may link to third party services we do not control this policy does not cover them; please read their own privacy notices 20\ changes to this policy we version this policy and show the effective date above we notify account holders of material changes 21\ data processing terms these terms apply where we process personal data on your behalf as your processor (section 3), and form part of the agreement between us they are intended to satisfy article 28(3) of the uk gdpr 21 1 subject matter and duration we process personal data in order to provide the sparklayer b2b ordering service, for as long as you use the service 21 2 nature and purpose of processing collection, storage, retrieval, use and transmission of your customers’ personal data, in order to provide b2b ordering functionality (including customer specific pricing, and creating and managing orders); enable your sales agents to search for and view customers on your behalf; and provide customer service 21 3 types of personal data name (first and last), email address, phone numbers (default and billing), addresses (shipping and billing), and customer and order records — as set out in section 7 21 4 categories of data subject your customers, including the individual contacts at your business customers 21 5 our obligations as your processor we will (a) process personal data only on your documented instructions, including in relation to transfers outside the uk/eea, unless required to do otherwise by law — in which case we will inform you before processing, unless the law prohibits it; (b) ensure that people authorised to process personal data are subject to a duty of confidentiality; (c) implement and maintain appropriate technical and organisational security measures as required by article 32 — see section 10 and our security policy; (d) engage sub processors only in accordance with 21 6; (e) taking account of the nature of the processing, assist you by appropriate technical and organisational measures in fulfilling your obligation to respond to requests from individuals exercising their rights; (f) assist you in meeting your obligations on security, breach notification, data protection impact assessments and prior consultation (articles 32 to 36), taking into account the nature of the processing and the information available to us; (g) at your choice, delete or return all personal data to you at the end of the provision of the service, and delete existing copies unless the law requires us to keep them; (h) make available to you all information necessary to demonstrate compliance with article 28, and allow for and contribute to audits, including inspections, conducted by you or an auditor you mandate 21 6 sub processors you give us general written authorisation to engage the sub processors listed in section 8 we will inform you of any intended addition or replacement, giving you a reasonable opportunity to object we impose data protection obligations on each sub processor that are no less protective than these terms, and we remain fully liable to you for their performance 21 7 international transfers where we transfer personal data outside the uk/eea in providing the service, section 9 applies and we will ensure an appropriate transfer mechanism is in place 21 8 personal data breaches we will notify you without undue delay after becoming aware of a personal data breach affecting personal data we process on your behalf, providing the information available to us so that you can meet your own notification obligations 21 9 your obligations as controller you confirm that you have a lawful basis for the processing you instruct us to carry out, that you have provided any privacy information required to your own customers, and that your instructions to us comply with data protection law 22\ contact and complaints spark layer ltd, trimbridge house, first floor, trim street, bath, ba1 1hb, united kingdom contact\@sparklayer io ico registration zb074246 you have the right to complain to the information commissioner’s office (ico org uk, 0303 123 1113), though we would appreciate the chance to resolve your concern first