Last updated: 14 September 2026
This Data Processing Agreement (“DPA”) forms part of the agreement between SparkIT AB, the company operating Adprove (“SparkIT”, “Adprove”, “Processor”, “we”, “us” or “our”), and the customer using Adprove (“Customer” or “Controller”) where SparkIT processes Personal Data on behalf of the Customer.
This DPA applies automatically where SparkIT acts as a processor for the Customer and is incorporated into the Adprove Terms of Use by reference. No separate signature is required unless the parties agree otherwise.
This DPA is intended to satisfy the requirements of Article 28 of Regulation (EU) 2016/679 (the “GDPR”).
1. Parties
Processor:
SparkIT AB
Company registration number: 559472-6407
VAT number: SE559472640701
C/o Apartment86
Rutger Fuchsgatan 11
116 67 Stockholm
Sweden
Privacy contact: privacy@sparkit.se
Controller:
The customer or organization that has entered into the applicable agreement for use of Adprove and determines the purposes and means of the processing of Personal Data submitted to the Services.
2. Definitions
Terms such as “Personal Data”, “Processing”, “Controller”, “Processor”, “Data Subject”, “Personal Data Breach” and “Supervisory Authority” have the meanings given to them in the GDPR.
“Customer Data” means data, files, content, comments, metadata and other information submitted to, stored in, or otherwise processed through Adprove by or on behalf of the Customer.
“Subprocessor” means a third party engaged by SparkIT to process Personal Data on behalf of the Customer in connection with the Services.
“Services” means the Adprove services provided under the applicable Terms of Use or other agreement between the parties.
3. Scope and Roles
The Customer is the Controller and SparkIT is the Processor with respect to Personal Data contained in Customer Data that SparkIT processes on behalf of the Customer in providing the Services.
Each party shall comply with its respective obligations under applicable data protection law.
The Customer is responsible for determining the purposes and means of the Processing and for ensuring that its instructions to SparkIT comply with applicable law, including that the Customer has a lawful basis for the Personal Data it submits to or processes through Adprove.
SparkIT may separately act as a controller for Personal Data it processes for its own legitimate purposes, such as account administration, billing, security, legal compliance and its direct relationship with users. Such Processing is governed by the Adprove Privacy Policy and is outside the scope of this DPA.
4. Details of the Processing
4.1 Subject Matter
Processing of Personal Data as necessary to provide, operate, secure, maintain and support Adprove and the functionality requested by the Customer.
4.2 Duration
The Processing continues for the duration of the Customer’s use of the Services and thereafter only for the period permitted by this DPA, the applicable agreement, documented lawful instructions, or applicable law.
4.3 Nature and Purpose
4.5 Types of Personal Data
4.6 Special Categories of Personal Data
Adprove is not designed specifically for the Processing of special categories of Personal Data under Article 9 GDPR or Personal Data relating to criminal convictions and offences under Article 10 GDPR. The Customer is responsible for determining whether its use of the Services is appropriate for such data and for ensuring that all additional legal requirements applicable to such Processing are satisfied.
5. Documented Instructions
SparkIT shall process Personal Data only on documented instructions from the Customer, including with regard to transfers of Personal Data to a third country or international organization, unless Processing is required by European Union or Member State law applicable to SparkIT. In that case, SparkIT shall inform the Customer of that legal requirement before Processing, unless the law prohibits such information on important grounds of public interest.
The Customer instructs SparkIT to process Personal Data as necessary to provide the Services in accordance with the applicable agreement, this DPA, the Customer’s configuration and use of the Services, and other documented instructions agreed by the parties.
If SparkIT considers that an instruction infringes the GDPR or other applicable European Union or Member State data protection law, SparkIT shall inform the Customer without undue delay.
6. Confidentiality
SparkIT shall ensure that persons authorized to process Personal Data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality.
Access to Personal Data shall be limited to personnel and service providers that require such access for legitimate purposes connected with providing and supporting the Services.
7. Security of Processing
SparkIT shall implement and maintain appropriate technical and organizational measures in accordance with Article 32 GDPR, taking into account the state of the art, implementation costs, the nature, scope, context and purposes of Processing, and the risks to the rights and freedoms of natural persons.
Measures shall be designed, as appropriate to the risk, to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to Personal Data transmitted, stored or otherwise processed.
SparkIT may update its security measures over time, provided that such updates do not materially reduce the overall level of protection applicable to Customer Personal Data.
8. Personal Data Breaches
SparkIT shall notify the Customer without undue delay after becoming aware of a Personal Data Breach affecting Personal Data processed under this DPA.
To the extent information is available to SparkIT, the notification shall provide information reasonably necessary for the Customer to meet its obligations under Articles 33 and 34 GDPR, including the nature of the breach, categories of affected Personal Data and Data Subjects where known, likely consequences, and measures taken or proposed to address the breach.
SparkIT shall take reasonable steps to contain, investigate and mitigate the effects of a Personal Data Breach within its responsibility.
Notification of a Personal Data Breach shall not be construed as an acknowledgement of fault or liability by SparkIT.
9. Assistance with Data Subject Rights
Taking into account the nature of the Processing, SparkIT shall assist the Customer, insofar as reasonably possible and through appropriate technical and organizational measures, in fulfilling the Customer’s obligations to respond to requests from Data Subjects exercising their rights under Chapter III of the GDPR.
If SparkIT receives a request directly from a Data Subject relating to Personal Data processed solely on behalf of the Customer, SparkIT may refer the Data Subject to the Customer and shall not independently respond to the substance of the request except where required by law or authorized by the Customer.
10. Assistance with GDPR Obligations
Taking into account the nature of Processing and the information available to SparkIT, SparkIT shall provide reasonable assistance to the Customer in ensuring compliance with the Customer’s obligations under Articles 32 to 36 GDPR, including security of Processing, Personal Data Breach obligations, data protection impact assessments and prior consultation with a Supervisory Authority where applicable.
11. Subprocessors
The Customer provides SparkIT with general written authorization to engage Subprocessors as necessary to provide the Services.
SparkIT shall impose data protection obligations on each Subprocessor that are no less protective, in all material respects relevant to the Processing performed by that Subprocessor, than the obligations imposed on SparkIT under this DPA as required by Article 28 GDPR.
SparkIT remains responsible to the Customer for the performance of its Subprocessors’ data protection obligations to the extent required by applicable law.
SparkIT shall make information about its current Subprocessors available to the Customer. SparkIT shall inform the Customer of intended additions or replacements of Subprocessors, thereby giving the Customer an opportunity to object on reasonable grounds relating to data protection before the relevant change takes effect.
If the parties cannot resolve a reasonable objection, the Customer may discontinue the affected part of the Services or terminate the affected Services in accordance with the applicable agreement.
12. International Transfers
SparkIT shall not transfer Personal Data processed under this DPA to a country outside the European Economic Area (“EEA”) unless the transfer complies with Chapter V of the GDPR.
Where required, SparkIT shall use an applicable lawful transfer mechanism, which may include an adequacy decision, the European Commission’s Standard Contractual Clauses (“SCCs”), or another lawful mechanism under applicable data protection law.
Where SparkIT engages a Subprocessor that processes Personal Data outside the EEA, SparkIT shall ensure that an appropriate transfer mechanism and, where required, supplementary safeguards are in place.
13. Return and Deletion of Personal Data
Upon termination or expiry of the Services involving Processing under this DPA, the Customer may retrieve or download Customer Data using functionality made available by Adprove before deletion, subject to the applicable agreement.
Unless the Customer provides a different lawful documented instruction that SparkIT can reasonably implement, uploaded files associated with an expired free trial or ended paid subscription are retained for 90 days and are then permanently deleted in accordance with the Adprove Terms of Use.
Where the GDPR requires the Customer, as Controller, to determine whether Personal Data is returned or deleted at the end of the Processing, SparkIT shall comply with the Customer’s lawful documented choice, subject to reasonable technical procedures and any retention required by European Union or Member State law.
Personal Data contained in backups or technically isolated recovery systems may remain until overwritten or deleted in accordance with SparkIT’s normal backup lifecycle, provided that such data remains protected and is not used for any other purpose.
For clarity, retention of account information, billing records or other information for which SparkIT acts as an independent controller is governed by the Adprove Privacy Policy and applicable law rather than this Section.
14. Audits and Information
SparkIT shall make available to the Customer information reasonably necessary to demonstrate compliance with Article 28 GDPR and this DPA.
SparkIT shall allow for and contribute to audits, including inspections, conducted by the Customer or an auditor mandated by the Customer, subject to reasonable confidentiality, security and operational requirements.
Where appropriate, SparkIT may satisfy audit requests by providing relevant documentation, questionnaires, summaries, reports or other evidence before an on-site inspection is requested.
Audits shall, where practicable, be conducted during normal business hours, on reasonable advance notice, in a manner that minimizes disruption to SparkIT and does not compromise the confidentiality or security of other customers.
Nothing in this Section limits the rights of a competent Supervisory Authority under applicable law.
15. Customer Responsibilities
The Customer shall:
16. Records and Regulatory Cooperation
SparkIT shall maintain records of Processing activities where required by Article 30 GDPR and shall cooperate with competent Supervisory Authorities as required by applicable law.
Upon reasonable request, SparkIT shall provide the Customer with information within SparkIT’s possession that is necessary for the Customer to demonstrate compliance with its obligations relating to the Processing covered by this DPA.
17. Liability
The liability of each party arising out of or relating to this DPA is subject to the limitations and exclusions of liability set out in the applicable Adprove Terms of Use or other agreement between the parties, to the extent permitted by applicable law.
Nothing in this DPA excludes or limits liability where such exclusion or limitation is prohibited by the GDPR or other applicable law, nor does it affect the statutory rights of Data Subjects or the powers of a Supervisory Authority.
18. Order of Precedence
If there is a conflict between this DPA and the Adprove Terms of Use concerning the Processing of Personal Data on behalf of the Customer, this DPA shall prevail to the extent of that conflict.
If the parties enter into European Commission Standard Contractual Clauses or another mandatory data transfer instrument and there is a conflict with this DPA, the mandatory transfer instrument shall prevail to the extent of the conflict.
19. Term and Termination
This DPA becomes effective when SparkIT begins Processing Personal Data on behalf of the Customer and remains in effect for as long as SparkIT processes such Personal Data.
Provisions that by their nature are intended to survive termination, including confidentiality, deletion obligations, audit rights relating to the period of Processing, and applicable liability provisions, shall survive for as long as necessary to give them effect.
20. Governing Law
This DPA is governed by the same law and jurisdiction provisions as the applicable Adprove Terms of Use, unless mandatory data protection law requires otherwise.
Appendix 1 — Processing Instructions
The Customer instructs SparkIT to process Personal Data for the purpose of providing the Adprove Services as configured and used by the Customer and as described in this DPA and the applicable agreement.
The Processing may include collection, recording, organization, structuring, storage, retrieval, consultation, use, transmission or making available to authorized recipients, restriction, deletion and other operations necessary to provide the Services.
The Customer may issue additional documented instructions relating to the Processing. Additional instructions that require material changes to the Services, security architecture, or operational procedures may be subject to separate agreement between the parties.
Appendix 2 — Subprocessors
SparkIT uses third-party service providers where necessary to operate Adprove. A current list of Subprocessors that process Personal Data on behalf of Adprove customers will be made available by SparkIT and may be updated from time to time in accordance with Section 11 of this DPA.
The Subprocessor list should identify, as applicable, the Subprocessor’s name, purpose of Processing, and Processing location or relevant international transfer information.
Privacy enquiries regarding Subprocessors may be sent to privacy@sparkit.se.
Appendix 3 — Technical and Organizational Measures
SparkIT maintains technical and organizational measures appropriate to the risk of the Processing. Depending on the relevant system and Processing activity, such measures may include:
The specific measures implemented may evolve over time to reflect changes in technology, risk and the Services, provided that SparkIT does not materially reduce the overall level of protection for Personal Data processed on behalf of the Customer.
Contact
SparkIT AB
Company registration number: 559472-6407
VAT number: SE559472640701
C/o Apartment86
Rutger Fuchsgatan 11
116 67 Stockholm
Sweden
Privacy: privacy@sparkit.se
General support: support@sparkit.se
