1. Identity and privacy contact

Controller / responsible business: Ivan Kalinin, trading as Sparkm4n Webdesign (German sole proprietor). Address: Hof-Feldbachstr. 4, 35683 Dillenburg, Germany. Email: info@sparkm4n.de. Telephone: +49 176 82528387. Website: www.sparkm4n.de. For a privacy question or request, write to the email above and state the relevant website, product or communication channel.

The address and email above are the contact details of the controller, not a representation that a formally appointed data protection officer or a country-specific statutory representative exists. Where a representative or other local appointment is legally required for an activity, the appropriate appointment and disclosure must be arranged separately.

2. Roles: controller, processor, joint controller and independent third parties

For our own website, business contacts, sales pipelines, accounts, billing and staff or contractor management, we generally decide why and how data is used and act as a controller (or the corresponding term under local law). When a business client controls data in its CRM, ad account, website, store, application or SaaS tenant and Sparkm4n only processes those data on its documented instructions, the client will commonly be controller and Sparkm4n processor/service provider. The applicable data processing agreement (DPA/AVV) or other required service terms govern that processing.

Some providers, especially payment processors, advertising platforms and social networks, operate partly as independent controllers or joint controllers. Their own privacy notices and contractual role allocations may apply. A DPA is required where the law and factual roles require it; this notice does not claim that every provider is a processor or that every contract has already been executed. For data held by a client as controller, submit substantive access or deletion requests to that client; we assist it as required.

3. Categories of personal data and sources

Depending on the interaction, we process: identifiers (name, business email, telephone number, address, account IDs); professional and commercial information (business, job title, industry, company URL, enquiry source, CRM records, meeting notes, contract and proposal history); technical information (IP address, device/browser data, timestamps, logs, cookie and consent identifiers, referrer, page views, security events); marketing information (subscription status, preference, lawful consent evidence, campaign interactions, attribution); financial and transactional data (invoices, billing address, tax details, payment status, transaction identifiers, plan and licence status); project or support content supplied by the customer; applications and recruitment documents if someone applies for work; and, where relevant to software, account, authentication, usage, API and diagnostic records.

We obtain information directly from you or your company; automatically through your use of the site or an enabled service; from business communications, recommendations or public company directories; from business networking profiles and lawfully sourced B2B data providers; and from partners or service providers where there is a lawful basis for the disclosure. We do not assume that publicly available professional contact details may be used for any type of unsolicited marketing: separate marketing laws and objection rights still apply. We request that you do not submit sensitive information unless it is necessary and we have agreed an appropriate basis and secure method.

4. Purposes, GDPR legal bases and corresponding concepts

For activities subject to the GDPR, the legal basis depends on the particular context:

A statutory or contractual requirement may make particular information necessary to complete a transaction (for instance a billing address or tax information). If the data are not supplied, we may be unable to deliver the relevant service. Consent is not used as a universal legal basis where a contract, statutory obligation or legitimate interest is actually relevant. Where sensitive/special-category data are processed, an additional applicable condition must be established (e.g. Article 9 GDPR).

5. Website hosting, delivery, content delivery and logs

Our website uses WordPress and has been publicly described as hosted with Hostinger; Cloudflare is used for DNS, performance and/or security functions. Depending on enabled infrastructure, Google Cloud services or other infrastructure providers may support content delivery or site operations. In the course of routing requests, those services may handle IP addresses, time of access, requested URL, user agent, technical security indicators and similar metadata. Processing is aimed at reliable operation, abuse prevention, load management and incident analysis, generally on the basis of legitimate interests under Article 6(1)(f) GDPR where applicable.

Server and security logs are retained only as long as proportionate to their operational or security purpose, subject to legal preservation needs and provider settings. Hosting in an EU country does not by itself establish that no information is accessible outside the EU. We assess transfer routes as described below. Technical fonts and icons may be self-hosted; where an embedded asset contacts an external server, that provider and its transmission must be evaluated separately.

6. Cookies, device access and Complianz consent management

We use Complianz as our WordPress consent management solution. Cookies and comparable technologies may be classified as necessary, preferences, statistics/analytics and marketing depending on the actual deployment. Technically necessary operations may be enabled without consent where a legal exception applies. For non-essential storage/access and consent-based analytics or marketing, we request the consent required by the visitor’s jurisdiction. In Germany, § 25 TDDDG applies to storage/access on user devices; in Austria, § 165 TKG 2021 is particularly relevant; EU GDPR rules apply to subsequent personal-data processing. Swiss and other regional rules are addressed later.

Complianz may retain consent choices and related technical records in order to respect and evidence your preferences. You can change or withdraw cookie consent at any time using the control below. Withdrawing consent does not retrospectively invalidate processing that was lawful before withdrawal. Refusing optional categories must not prevent access to core site information where they are not essential. A legally applicable right to opt out of sale/sharing for cross-context behavioural advertising is separate from ordinary cookie consent and must be respected when required.

The banner’s live cookie inventory, precise expiration periods, scripts and providers must match the real configuration. Browser settings may also delete stored cookies, but browser-only deletion is not a substitute for a functioning consent-management choice on our site. Enabling a regional mode in Complianz does not itself verify every script or guarantee GPC compliance.

7. Analytics, advertising pixels, remarketing and attribution

Depending on the pages, campaigns and enabled consent choices, digital measurement and advertising tools may include Google Analytics 4 / Google Tag Manager, Google Ads conversion tracking, Meta Pixel / Conversions API, LinkedIn Insight Tag, and campaign links or attribution technologies. Data can include online identifiers, interactions, page views, referrers, conversion events and advertising parameters. Where configured and permitted, matching identifiers may be used for audience creation, measurement, optimisation or retargeting. Website tracking should be configured to obey regional consent and opt-out requirements before it is activated.

Advertising platforms may independently process data under their own policies. Server-side conversion transmission, enhanced conversions and customer-list audiences may involve additional sharing with platforms beyond browser cookies, and therefore require a separate assessment. We do not represent that a specific platform event, matching feature or customer list is enabled for every visitor or campaign. See Google privacy, Meta privacy and LinkedIn privacy.

California and similar US state laws: in-scope disclosure of data to an advertising platform for cross-context behavioural advertising can constitute a legally defined “sharing” even without a monetary sale. Where applicable, a valid request to opt out of sale, sharing or targeted advertising can be made using the privacy contact options below. A legally required opt-out preference signal (including Global Privacy Control, where applicable) must be implemented and honoured at the technical level; this notice alone does not activate that functionality.

8. Contact, quotation, audit and project-request forms

Our forms include general contact, web development, SEO, ads, business audit and project briefs. The applicable form may collect name, email, business details, website, project requirements, preferred timing, budget or documents you choose to provide. We use them to review the request, contact the relevant representative, prepare quotations, assess feasibility and fulfil commitments. Submitting a form does not by itself subscribe you to general promotional email.

Depending on the integration, information may pass through WordPress forms, email systems, Google Forms or other providers and into the relevant CRM or project tool. A provider’s role depends on the service and agreement. Sensitive or confidential attachments should be shared only through suitable channels. Form data are not published.

9. CRM, HubSpot, B2B prospecting and outreach

We use HubSpot for business contacts, CRM pipelines, deals, appointment and communication records and, where enabled, automation. Contact sources may include a company’s public website, publicly listed business directories, professional profiles, existing business relationships, referrals and lawfully obtained commercial data providers. Data can include names, professional roles, business email/telephone, company, source, notes, interests and communications.

For EU/EEA contacts whose information was not collected directly, Article 14 GDPR may require additional information on categories, sources, purposes and rights at the legally applicable time, including no later than first communication where relevant. An Article 6(1)(f) legitimate-interest assessment is not a substitute for permission to contact someone under § 7 UWG, UK PECR, Canada’s CASL, US CAN-SPAM, or other national marketing rules. We may keep a minimal suppression record after an objection to prevent renewed outreach. Object to business marketing: info@sparkm4n.de.

10. Newsletters and campaigns: Brevo and Mailchimp

Depending on subscription or campaign, we use Brevo and Mailchimp (Intuit) to manage newsletter subscribers, mailing lists, opt-in proof, sends, bounces, unsubscribe status and campaign statistics. We process email address, optional professional information, subscription preferences, and, when legitimately enabled, delivery, opens, clicks and interactions. Marketing content requiring consent is sent on that basis; any permitted existing-customer exception is applied only when the statutory conditions are fulfilled.

We may use a confirmation or double-opt-in workflow to document subscriptions. A link in marketing emails lets recipients unsubscribe. You can also request unsubscribing through info@sparkm4n.de. Some limited suppression information may be retained to ensure that no further prohibited marketing is sent. Email-open tracking and individually attributable clicks are separate processing operations and are subject to applicable consent/privacy laws. See Brevo privacy and Intuit/Mailchimp privacy.

11. Business messages, calls, messaging and meetings

We may communicate through email, business telephony, WhatsApp Business, Zoom, Microsoft Teams, Calendly and similar channels selected by the parties. Depending on the interaction, we process meeting metadata, attendees, contact details and the substantive communication. A call, video recording or AI-generated transcript is not automatically authorised merely by joining a meeting. We obtain required permission, give notice and follow applicable recording and data protection requirements before recording/transcribing where needed. Third-party platform notices govern their separate processing.

12. Orders, payments, invoices, e-commerce and subscriptions

We process invoicing names and addresses, business and tax identifiers where required, ordered items, contract documents, subscription status, transactions, fulfilment history and disputes for service delivery, billing and legal compliance. Payment options may include bank transfer and payment services such as Stripe or other processors used at the point of sale. The payment service may process card or bank details under its own applicable role and terms. We generally do not need complete payment card credentials in order to supply a digital service. Stripe privacy.

For recurring plans we may retain the plan, billing cycle, payment token/reference, invoice status, renewal and cancellation status, licence status, refunds and chargeback details. Fraud prevention and payment disputes can require proportionate additional records. Financial records are held in accordance with the applicable statutory retention rules; deleting an account does not automatically erase records that must be preserved by law.

13. Software development, applications, APIs, SaaS and licences

In connection with development, implementation, integrations, support and SaaS-related activities, we may process usernames, roles, access entitlements, device/browser identifiers, licences, subscription status, API requests, diagnostic logs, error events, support communications and customer-supplied data. Purposes include provisioning, debugging, incident response, abuse control, licence compliance, billing and service reliability.

Important role separation: if a client controls data relating to the end users of its system and Sparkm4n hosts or maintains those data only on its instructions, the client commonly acts as controller and must issue the relevant end-user notice, while Sparkm4n acts as processor and complies with the DPA. When Sparkm4n separately operates a first-party SaaS platform and determines why account, billing or security data are processed, it may act as controller for those categories. A separate product or white-label deployment may require its own specific privacy notice, DPA, subprocessor list and retention schedule. This general website notice cannot substitute for a client’s own consumer-facing SaaS notice.

14. Artificial intelligence, automation, scoring and profiling

For writing assistance, translation, research, software coding, analysis, support workflows, lead categorisation or other permitted processes, we may employ AI-enabled software. Categories depend on the requested task and can include business contact details, prompts, client-provided text or technical information. We limit use of sensitive or confidential information and assess whether input/output data are retained or used by external providers to improve models. This policy does not grant an unrestricted right to use client data for training AI models. Client-specific processing follows the agreed instructions and relevant DPA.

We do not state that every AI-assisted recommendation is an automated decision with legal or similarly significant consequences. Where a process does fall within Article 22 GDPR or a comparable law, the legally required safeguards, information and human review rights apply. Particularly sensitive decisions (e.g. employment selection or regulated eligibility) require an additional legal and risk assessment. The EU AI Act can impose separate transparency and governance duties; an external interaction notice may be needed in addition to this privacy policy. Where relevant, a data protection impact assessment (DPIA) is carried out as required by law.

15. Recruiting, candidates, contractors and referrals

When someone applies for a role or contracting opportunity, we may handle CVs, contact details, work history, portfolios, interview notes, scheduling information, references and the information provided by applicants. We process them to assess applications, communicate, decide on engagement and comply with law. Sensitive data are requested only if necessary and lawfully justified. Candidate records that are no longer required are deleted or appropriately restricted after a reasonable retention period informed by applicable employment and anti-discrimination laws; a longer talent-pool retention requires an appropriate legal basis. Applicant data should not be reused for unrelated direct marketing without a separate lawful basis.

16. Affiliates, white-label partners, referrals and suppliers

When partners, resellers, creators, suppliers or affiliates collaborate with us, we may process business contacts, relationship status, referral records, contract details, attribution, commissions, bank/tax information and compliance information. This supports contract performance, settlement, partner communication and fraud prevention. Payments and commission records may be retained for statutory accounting purposes. A partner receiving end-user or lead information must have its own legitimate processing basis and, where applicable, the appropriate data-sharing or processor agreement. Partner remuneration is not a licence to disclose personal data freely.

17. Third-party links, social profiles and embedded content

Links to LinkedIn, Facebook, Instagram, YouTube, X, Pinterest and other third-party websites do not themselves provide those companies access to your visit merely by being displayed as ordinary hyperlinks. Embedded videos, social plugins, maps, chat widgets or remote assets can establish external connections and transmit technical information. Depending on the specific integration and jurisdiction, we provide the necessary choices before loading them. After you follow a link to a separate platform, that platform’s privacy notice applies to its independent processing.

WordPress-related extensions and anti-abuse checks: The site may use Elementor or other layout/form plugins, WooCommerce or another checkout component, SEO extensions, caching, anti-spam measures and security plugins depending on the active deployment. Where services such as Google reCAPTCHA, embedded maps, videos or externally loaded fonts are enabled, they may transmit technical data to their providers; their loading, notice and consent requirements must be checked independently. Merely installing a WordPress plugin does not necessarily mean that it sends personal data to its vendor on every page view.

18. Recipients and international service providers

To the extent actually used for the relevant purpose, recipients or service categories can include: Hostinger (hosting), Cloudflare (CDN/security), Complianz (consent software), Google (analytics, advertising, forms, cloud, reCAPTCHA where installed), Meta, LinkedIn, HubSpot (CRM), Brevo and Mailchimp (email), Stripe (payments), Zoom, Microsoft and Calendly (meetings), WhatsApp Business (messaging), infrastructure providers, professional advisers, tax/accounting suppliers and authorised subcontractors. Some services may process data only when activated, when a particular form is submitted or when a customer chooses to use them.

Service-provider contracts and privacy terms must be reviewed for each applicable role, processing purpose, retention, subprocessor and transfer. Data are not made publicly available through this notice. Legally required disclosures to public authorities and proportionate disclosures to resolve disputes may occur where lawfully justified.

19. International transfers and safeguards

Personal information may be accessed or processed in countries different from the visitor’s location, including countries where chosen suppliers operate. For EU/EEA GDPR transfers, we rely, as applicable and demonstrably valid, on adequacy decisions (including UK, Switzerland, Brazil, Japan and relevant participating US organisations), EU Standard Contractual Clauses, binding corporate rules or specific statutory exceptions. SCC-based transfers may call for a transfer impact assessment and supplementary measures. For the UK, UK adequacy rules and the UK International Data Transfer Agreement/addendum may apply. For Switzerland, Swiss adequacy rules and adjusted transfer safeguards under the Federal Act on Data Protection (FADP) may apply.

Brazil and the EU adopted mutual adequacy decisions in January 2026, simplifying covered transfers between those jurisdictions. Other destinations may require different national mechanisms (e.g. Brazil’s ANPD Resolution 19/2024 when relevant, Singapore PDPA, Saudi PDPL or Australia’s APP 8). Neither use of an EU-hosted service nor publication of this notice alone proves that all onward transfers are lawful. Information about the applicable transfer basis for a particular service may be requested from our privacy contact.

20. Retention, deletion and suppression

We keep information no longer than is necessary for each stated purpose, taking account of legal duties, the security risk, the age of records, reasonable dispute periods and contractual instructions. The following are retention criteria, not a claim that every tool has identical deletion settings:

When retention is no longer justified, data are deleted, anonymised or blocked from ordinary use as technically and legally appropriate. Backups may be removed in scheduled cycles and remain protected until overwritten; a statutory hold may delay deletion. We do not promise a uniform six-month period for all data.

21. Security, incidents and confidentiality

We apply technical and organisational measures appropriate to the nature and risk of processing, which can include controlled accounts and permissions, access restrictions, encryption in transit where implemented, provider security features, backups, software updates, audit or security logging and confidential handling of project data. No Internet service can warrant perfect security or 24/7 monitoring unless expressly provided. If an incident occurs, we assess the actual legal notification duties, including the respective obligations of a controller and processor and any shorter/longer local periods. Where a client is controller, we inform and assist it under the applicable agreement and legal rules.

22. Rights requests, identity verification and accessible contact

Subject to applicable law and exceptions, rights may include information, access, correction, deletion, restriction, objection, consent withdrawal, portability, opting out of sale/sharing/targeted advertising or certain profiling, and requesting human involvement in certain automated decisions. We will not retaliate or discriminate against you for exercising a privacy right where prohibited by law. We may need proportionate information to verify identity or authority to prevent unauthorised disclosure, and we will not ask for more verification information than reasonably necessary.

Send any privacy request to info@sparkm4n.de. Relevant deadlines vary: for example, many EU GDPR requests are answered without undue delay and generally within one month; PIPEDA usually requires response to access requests within 30 days, subject to extensions; some other laws set different periods. We will apply the legally relevant deadline. You may also complain to the applicable privacy authority; see the regional addenda.

23. Ready-to-use privacy request templates

You can send these pre-addressed emails; adjust only the text you wish to provide. A formal government form is not required just to contact us where the law does not mandate one.

24. Children and highly sensitive information

This site primarily addresses business customers and is not designed as a service specifically directed at children. We do not knowingly solicit children’s sensitive personal information through this corporate site. Where a separate software product involves children, family accounts, education, health or other sensitive activity, its applicable terms and privacy notices must address the age of consent, parental rights, special data conditions, security and jurisdiction-specific requirements. Contact us if you believe a minor has submitted information contrary to law.

25. EU, EEA and Germany – regional rights

Where the EU GDPR applies, data subjects have rights under Articles 12–22 and 77 GDPR, subject to statutory conditions and exceptions. These include access, rectification, erasure, restriction, portability where applicable, objections to processing based on legitimate interests and an unconditional right to object to personal-data processing for direct marketing. Article 22 gives additional protection for certain solely automated decisions with legal or similarly significant effects. A complaint may be filed with a competent EU/EEA supervisory authority. As Sparkm4n is established in Hesse, Germany, the Hessian Commissioner for Data Protection and Freedom of Information (HBDI) is a relevant German authority; other competent authorities may also be approached.

For Germany, device storage/access may be governed by § 25 TDDDG, in addition to the GDPR and German Federal Data Protection Act (BDSG). Electronic direct marketing is separately regulated (notably by § 7 UWG). The general GDPR rights and controller/contact information are provided in Sections 1–24; Germany is fully included in this global notice and not omitted in favour of a separate German-only document.

26. Austria and the remainder of the EU/EEA

For Austria, the GDPR and Austrian Datenschutzgesetz (DSG) apply where relevant, and electronic-device/cookie rules include § 165 TKG 2021. The Austrian Data Protection Authority accepts eligible complaints. For France, Spain, Italy, the Netherlands, Belgium, Ireland, Luxembourg, Portugal, Poland, Czechia, Slovakia, Hungary, Romania, Bulgaria, Greece, Croatia, Slovenia, the Baltic states, Nordic countries, Cyprus, Malta, and other EU/EEA territories, the GDPR framework generally applies together with each country’s additional privacy and e-communications provisions. Some sectors, marketing activities, employment data or regulated services may require country-specific notices or safeguards. Individuals may contact their competent national authority; EU/EEA rights are explained in Sections 22 and 25.

27. Switzerland and Liechtenstein

For Swiss individuals and processing subject to the Swiss Federal Act on Data Protection (FADP/DSG) and its ordinance, we provide information about the controller, purposes, recipient types and, for relevant foreign disclosures, destination states or categories of states and appropriate safeguards. Applicable rights can include access, correction and other remedies under Swiss law. The Federal Data Protection and Information Commissioner (FDPIC/EDÖB) is the relevant federal authority. Transfers are assessed under Swiss adequacy decisions and relevant guarantees, including applicable adjusted contractual safeguards. Liechtenstein participates in the EEA and is principally covered by the EEA/GDPR provisions, not automatically by the Swiss FADP simply because it is a German-speaking market.

28. United Kingdom

If the UK GDPR, Data Protection Act 2018 or Privacy and Electronic Communications Regulations (PECR) apply, individuals can request access, correction, erasure, restrictions and other applicable rights, and complain to the Information Commissioner’s Office (ICO). As amended by the Data (Use and Access) Act 2025, the UK framework includes the ability to complain first to the controller; you may send this complaint through the privacy contact above. UK international transfers may require an applicable UK adequacy arrangement or UK-specific safeguards. Whether an organisation established outside the UK must appoint a UK representative depends on Article 27 UK GDPR and the facts of its UK activities; this notice does not invent a representative’s name or claim that an exemption has been established.

29. United States – general state privacy framework

Several US states grant residents rights to access, correction, deletion, portability or to opt out of targeted advertising, sale or certain profiling. Applicability differs by state, revenue, data-volume thresholds, exemptions and processing types. In addition to California, relevant comprehensive privacy laws include those of Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Texas, Oregon, Montana, Delaware, New Hampshire, Nebraska, New Jersey, Minnesota, Maryland, Kentucky and Rhode Island, among others, as and when effective. Other federal or sectoral rules may apply (e.g. health, financial and children’s privacy). A business-to-business relationship alone does not negate all potential US privacy rights.

For a US resident whose law applies to our activities, send requests using Section 23. If we deny a request and the applicable state law requires an appeal mechanism, reply to our decision asking for an appeal of the privacy-rights decision, and we will apply the legally required appeal procedure and timeline. A genuine universal opt-out preference signal must be honoured where mandatory and technically implemented at the advertising and consent layers; a text declaration cannot implement it.

30. California – detailed CCPA/CPRA notice

This section applies to California residents where Sparkm4n qualifies as a covered “business” for the particular processing under the California Consumer Privacy Act, as amended by the CPRA and the regulations in force from 1 January 2026. The following data categories may be collected depending on interaction: identifiers, business contact information, commercial and payment records, Internet/network activity, approximate geolocation derived from IP, professional information, communications, and inferences about professional service interests. Data sources, purposes, recipients and retention criteria are described in Sections 3–20. The policy is not a statement that Sparkm4n processes every statutory category, sensitive category or feature.

Eligible California residents may request to know/access, delete, correct, opt out of sale/sharing, limit certain uses of sensitive personal information where the statutory right is triggered, and exercise applicable rights in relation to automated decisionmaking technologies at the relevant implementation date. There is no discrimination for exercising protected rights. We do not advertise personal information as a product for sale in return for money, but this fact alone does not establish that disclosures to advertising partners are not legally defined “sharing” for cross-context behavioural advertising. If that sharing occurs and the CCPA applies, we must offer compliant opt-outs and honour relevant opt-out signals. Submit a Do Not Sell or Share / targeted advertising request at info@sparkm4n.de and adjust cookie preferences through Complianz. Privacy requests may be made by a lawfully authorised agent subject to lawful verification.

We do not claim to knowingly sell or share personal information about children under 16; if any related processing were introduced, special CCPA requirements would apply. The 2026 CCPA regulations also establish phased obligations concerning risk assessments, cybersecurity audits and automated decisionmaking for covered uses; this site notice cannot replace a required assessment or technical compliance process. Relevant regulator: California Privacy Protection Agency.

31. Canada – federal and provincial rules

Where Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) applies, individuals may request access, corrections and details of use/disclosure, subject to exceptions; privacy concerns may be raised with our contact and the Office of the Privacy Commissioner of Canada. PIPEDA generally requires a response to access requests within 30 days unless a lawful extension applies. Quebec’s private-sector privacy legislation (including Law 25 reforms) and substantially similar provincial laws may impose additional requirements on notices, assessments, breach handling, consent, transfers or automated decisions where applicable.

Canada’s Anti-Spam Legislation (CASL) applies separately to covered commercial electronic messages; legitimate-interest processing of a business contact under the GDPR does not itself authorise messages governed by CASL. Requests concerning marketing are handled through the suppression and unsubscribe mechanisms described above.

32. Brazil – LGPD and ANPD

Where Brazil’s Lei Geral de Proteção de Dados (LGPD) applies, data subjects may request confirmation and access, correction, anonymisation/blocking/deletion in statutory circumstances, portability subject to applicable regulation, information on public/private sharing, withdrawal of consent, objections and review/information about certain automated decisions. Requests may be sent through the same privacy email. The Autoridade Nacional de Proteção de Dados (ANPD) is the relevant regulator.

Brazil’s ANPD Resolution CD/ANPD 19/2024 regulates relevant international transfers, including standard clauses. The Brazil–EU mutual adequacy decisions of January 2026 allow covered transfers between those areas under the respective frameworks without automatically needing an additional SCC mechanism solely for that Brazil–EU transfer. Transfers to other destinations still require an appropriate legal basis and safeguards when relevant. Sparkm4n does not claim to have executed Brazilian SCCs for providers with which no such transfer arrangement has been verified.

33. Mexico, Argentina, Colombia, Chile, Peru and the rest of Latin America

Mexico: Where the Federal Law on Protection of Personal Data Held by Private Parties applies, including the replacement law adopted 20 March 2025, eligible individuals can use the relevant access, correction, cancellation and opposition (ARCO) mechanisms and applicable consent/transfer rights. Argentina: Law 25,326 and implementing provisions may give access, rectification, updating and suppression rights where applicable. Colombia: the constitutional habeas data framework and Law 1581/2012 provide information, correction and complaint rights and regulate covered transfers. Chile: Law 21.719 reforms the personal-data regime and is scheduled to take effect on 1 December 2026; until then, the currently applicable regime must be distinguished from future obligations. Peru: the Personal Data Protection Law and its regulations apply where in scope, including rights and transfer rules.

For Uruguay, the existing data protection law and adequacy framework may be relevant; other Latin American and Caribbean jurisdictions may impose their own privacy notices, direct-marketing consent or export requirements. Residents may contact our privacy email with country and request type; the rights and time limits of the applicable law will control.

34. Singapore, Hong Kong and Southeast Asia

Singapore: the Personal Data Protection Act (PDPA) grants applicable access/correction and withdrawal rights and places retention, consent and overseas transfer limitations on covered organisations. We must meet the PDPA’s overseas transfer standards whenever those rules govern the disclosure. Authority: Personal Data Protection Commission.

Hong Kong: the Personal Data (Privacy) Ordinance (PDPO) includes data protection principles and specific direct-marketing rules; applicable requests for access/correction can be addressed through our contact. Authority: Office of the Privacy Commissioner for Personal Data.

Thailand: the Personal Data Protection Act (PDPA) governs relevant lawful processing, consent, transparency and rights, including applicable cross-border restrictions. Malaysia: the Personal Data Protection Act 2010, as amended, may apply to commercial data processing. Indonesia: the Personal Data Protection Law (Law 27/2022) and implementing rules must be reviewed for covered local activities. Philippines: the Data Privacy Act of 2012, overseen by the National Privacy Commission, provides statutory rights and duties. Vietnam: the national personal-data framework may impose distinct requirements on consent, notice, export and localisation for covered processing. Each country requires a separate applicability analysis before claiming local compliance solely from this global policy.

35. India

India’s Digital Personal Data Protection Act 2023 and Digital Personal Data Protection Rules 2025 have staggered commencement and compliance dates, following the official November 2025 notifications. Any applicable individual notice, data fiduciary duties, grievances, requests, children’s-data safeguards and transfer restrictions must be assessed against the precise provisions in force for the relevant date and processing. This policy does not suggest that all substantive DPDP obligations commenced at once or that every EU GDPR basis has a direct analogue in Indian law. Grievances and requests can be sent to our privacy email for routing and response in accordance with applicable provisions.

36. China, Japan, South Korea and Taiwan

China: where the Personal Information Protection Law (PIPL) governs processing, special conditions may apply to cross-border transfer, consent, sensitive personal information, profiling and overseas processors. Establishing an overseas service in China may require additional local arrangements or notices. Japan: the Act on the Protection of Personal Information (APPI) governs covered businesses, including specific requirements for provision to third parties in foreign countries; Personal Information Protection Commission. South Korea: the Personal Information Protection Act (PIPA) imposes distinct consent, notice, transfer and rights provisions; Korea has an EU adequacy decision subject to its scope. Taiwan: the Personal Data Protection Act (PDPA) imposes its own notice, purpose and rights rules. Specific national requirements must prevail if they apply; this policy is not an announcement that data are hosted in these countries.

37. Australia and New Zealand

Australia: where the Privacy Act 1988 and Australian Privacy Principles apply, relevant rights and transparency requirements include access/correction and disclosures of overseas recipients; APP 8 regulates covered cross-border disclosures. A policy cannot override the statutory accountability rules for overseas recipients. Regulator: Office of the Australian Information Commissioner (OAIC). New Zealand: the Privacy Act 2020 includes rights and Information Privacy Principle 12 on disclosure overseas, and the new indirect-collection notice principle (IPP 3A) commenced in May 2026. Regulator: Office of the Privacy Commissioner.

38. South Africa, Nigeria, Kenya and other African jurisdictions

South Africa: the Protection of Personal Information Act (POPIA) provides rights, direct-marketing restrictions and specific requirements for cross-border transfers; regulator: Information Regulator. Nigeria: the Nigeria Data Protection Act 2023 establishes rights and obligations overseen by the Nigeria Data Protection Commission. Kenya: the Data Protection Act 2019 and regulations establish processing and transfer requirements under the Office of the Data Protection Commissioner. Other African markets such as Ghana, Rwanda, Mauritius, Egypt, Morocco and Uganda may have applicable privacy and sector-specific rules, including cross-border restrictions; a product-specific country review is required before large-scale targeted processing.

39. United Arab Emirates, Saudi Arabia and other Middle Eastern jurisdictions

United Arab Emirates: where Federal Decree-Law 45/2021 on Personal Data Protection applies, individual rights, transparency, security and transfer obligations require assessment; some free zones (including DIFC and ADGM) maintain separate data protection regimes. Saudi Arabia: the Personal Data Protection Law (PDPL) and its implementing regulations include notice, lawful processing, certain rights and international-transfer safeguards. Other Gulf states, including Qatar, Bahrain, Oman and Kuwait, as well as Israel, have distinct national privacy, electronic-marketing and/or sector-specific regimes. For regulated services, local hosting, financial, health or public-sector requirements can arise separately. Applicability is assessed by actual offering, location, role and data type.

40. Turkey, other European non-EEA jurisdictions and Russia

Turkey: Law 6698 on the Protection of Personal Data (KVKK) sets distinct information, lawful-processing and cross-border transfer rules. Serbia, Albania, North Macedonia, Bosnia and Herzegovina, Montenegro, Moldova and Ukraine have national privacy frameworks that may apply depending on local processing and targeting. Russia: Federal Law 152-FZ and related rules may impose data localisation and transfer obligations on activities within their territorial scope; a general EU privacy notice is not evidence that those duties have been met. A market-entry or sensitive-data project for any of these territories requires a specific compliance review.

41. Complaints, regulators and additional protections

Requests for statutory rights or a complaint about our own processing can be sent through info@sparkm4n.de. We assess which law applies and route the request accordingly. You may also contact a competent authority, including where applicable: Germany/Hesse HBDI, Austria DSB, Switzerland FDPIC, UK ICO, California CPPA, Canada OPC, Brazil ANPD, Singapore PDPC, Australia OAIC, New Zealand OPC, South Africa Information Regulator and Nigeria NDPC. This non-exhaustive list is for navigation; regulators‘ competence and procedural rules remain governed by local law.

42. Updates, language and precedence of law

We update this notice when there are material changes to our processing or applicable legal requirements and publish the revised date. Where legally required, we will provide additional notice or obtain a fresh consent before using data for a materially new purpose. This international English notice includes the general information and relevant EU/DACH coverage; it is not a waiver of information or language rights under national law. Where local law requires a notice in a local language, an additional local-language notice will be provided for the affected processing.

Last revised: 14 October 2026. This notice should be read together with the live Complianz consent choices and any applicable product-specific service notice. A privacy policy cannot by itself create a legal basis, activate consent blocking, establish a DPA, fulfil local representative obligations or certify international transfers. The actual technical and contractual implementation must be consistent with these disclosures.