Data Processing Agreement

Last updated: 1/20/2026

Effective Date: 06/05/2025

Parties

  • Data Controller: The client receiving services.
  • Data Processor: Sparkware.

1. Purpose

This DPA governs the processing of personal data by the Data Processor on behalf of the Data Controller in connection with digital marketing, web development, and CRM services, in compliance with the General Data Protection Regulation (GDPR) and California Consumer Privacy Act (CCPA), as amended by the CPRA.

2. Definitions

  • Personal Data: Any information that identifies or can be used to identify a natural person, as defined by GDPR (Art. 4) and CCPA (as amended).
  • Processing: Any operation on personal data, including collection, use, storage, or deletion.
  • Sub-Processor: Any third party engaged by the Processor to process data on the Controller's behalf.
  • Consumer (CCPA): A natural person who is a California resident.

3. Roles and Responsibilities

  • The Data Controller determines the purposes and means of processing.
  • The Data Processor acts only on the Controller's documented instructions and ensures compliance with applicable data protection laws.

4. Processing Scope

  • Subject Matter: Marketing, web development, CRM solutions.
  • Nature and Purpose: Hosting, managing, and analyzing data for service delivery.
  • Duration: While services are active or as legally required.
  • Types of Personal Data: Names, email addresses, phone numbers, IP addresses, usage metrics, and CRM data.
  • Data Subjects/Consumers: End-users, leads, and customers of the Controller.

5. Processor Obligations

  • Process data solely for business purposes as outlined.
  • Comply with GDPR Art. 28–36 and CCPA §§ 1798.100–1798.199.95.
  • Do not "sell" or "share" personal data (per CCPA definitions).
  • Provide reasonable assistance with:
    • Data subject access, correction, and deletion requests
    • GDPR impact assessments and prior consultations
  • Implement technical and organizational measures to protect data.
  • Maintain confidentiality among personnel with access.

6. Sub-Processing

Authorized sub-processors may include:

  • Go High Level (CRM platform)
  • Web hosting and analytics providers

Sub-processors are subject to equivalent data protection obligations.

A current list is available upon request.

7. International Transfers

Personal data transfers outside the EEA or UK will be governed by appropriate safeguards, including Standard Contractual Clauses (SCCs), UK Addendum, or other valid mechanisms under GDPR.

8. Data Breaches

The Processor will notify the Controller without undue delay upon becoming aware of a personal data breach, providing details and mitigation efforts.

9. Data Return and Deletion

At the end of service provision, data will be returned or securely deleted, unless retention is required by law.

10. Audit Rights

The Controller may audit the Processor's compliance upon reasonable notice and under confidentiality obligations.

11. Liability

Each party is liable for its own non-compliance with data protection laws or this DPA.

12. Governing Law

This DPA is governed by the laws of the Commonwealth of Virginia, USA, without regard to conflict of laws principles.

13. Contact

Questions about this DPA can be sent to legal@sparkware.io.