Privacy Policy
SparkSmiths Inc · 300 Delaware Ave, Ste 210, #254, Wilmington, DE 19801 · Director: Derek Hughes
Last updated: October 2026
1. Who we are and how to contact us
SparkSmiths Inc (“SparkSmiths”, “we”, “us”) builds and supports EventSpark, an event management app on the Salesforce AppExchange, and delivers related event services. This policy explains how we collect, use, share and protect personal information, and the rights you have over it.
| Role | Details |
|---|---|
| Responsible party (POPIA) / controller (GDPR) | SparkSmiths Inc, 300 Delaware Ave, Ste 210, #254, Wilmington, DE 19801, USA |
| Information Officer | Derek Hughes, Director, contactable at the address above or through www.sparksmiths.com |
For any privacy question or request, contact the Information Officer, Derek Hughes, at the address above or through www.sparksmiths.com.
2. Scope and our role
Our role depends on whose data it is. We are the responsible party (controller) for our own business data, and an operator (processor) for data our clients hold in EventSpark.
We are the responsible party for personal information about our website visitors, prospects, customer contacts, suppliers, partners and job applicants, and for attendees at events we run ourselves.
We are an operator when EventSpark is installed in a client’s Salesforce org, or when we deliver an event for a client. The client decides what attendee (delegate) information is collected and why. Their privacy notice applies, and we act only on their documented instructions under a data processing agreement.
If you registered for a client’s event and want to exercise your rights, contact that client first. We will help them respond.
This policy does not cover third-party websites we link to. Our technical and organizational controls are described in the SparkSmiths Security Policy.
3. Personal information we collect
We collect only what we need for the purposes in section 4. We do not store full payment card numbers; our payment partners process those.
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email, mobile number, job title, company | You, your employer, or the event organizer |
| Event registration | Events and sessions booked, tickets, RSVP and registration status, booking references | You, via EventSpark registration forms and the Booking Wizard |
| Attendance and participation | Check-in time, attendance status, virtual event join count and duration, survey responses | EventSpark, Zoom, onsite check-in |
| Payment | Amount, currency, payment status, transaction references (no card numbers) | Shuttle and its payment gateways (e.g. Stripe, PayPal) or PayGate |
| Recordings and images | Virtual event recordings, event photos, where taken | Zoom, event photographers |
| Special personal information | Dietary or accessibility needs (only if the event asks) | You, with your consent |
| Business relationship | Correspondence, contracts, invoices, meeting notes | You and our CRM |
| Website and device | IP address, browser, pages visited, cookie identifiers | Our websites and event microsites |
| Recruitment | CV, qualifications, references | Applicants and recruiters |
We do not knowingly collect information about children under 18 (see section 10).
4. Why we use it and our lawful basis
We use personal information only for a stated purpose with a lawful basis under POPIA section 11 and GDPR Article 6.
| Purpose | Lawful basis |
|---|---|
| Register you for events, issue tickets and confirmations, send event communications | Performance of a contract with you, or the organizer’s legitimate interest |
| Process payments and keep financial records | Contract; legal obligation (tax and accounting) |
| Run virtual events and record attendance | Contract; legitimate interest in delivering the event |
| Provide, support and secure EventSpark and our services | Contract with our clients; legitimate interest |
| Send marketing about our products and events | Consent, or legitimate interest for existing customers, with an opt-out in every message |
| Improve our websites and products | Legitimate interest; consent for non-essential cookies |
| Recruit staff | Steps before a contract; legitimate interest |
| Comply with law, resolve disputes, prevent fraud | Legal obligation; legitimate interest |
We process special personal information, such as dietary or accessibility needs, only with your explicit consent and only to deliver the event. We do not sell personal information, and we make no decisions about you based solely on automated processing.
6. Transfers outside South Africa and the EU
We operate in the USA and South Africa, and our service providers process data in other countries, so your information may leave the country where it was collected.
We transfer personal information across borders only when one of these applies:
- the recipient is subject to a law, binding corporate rules or a binding agreement giving protection substantially similar to POPIA (POPIA section 72);
- for EU/UK data, the destination has an adequacy decision, or we use the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum, or the recipient is certified under the EU-US Data Privacy Framework;
- you have consented, or the transfer is needed to perform a contract with you or in your interest.
You can ask the Information Officer for a copy of the safeguards that apply to your data.
7. How long we keep it
We keep personal information only as long as the purpose needs it or the law requires, then delete or de-identify it following NIST media sanitization guidelines.
| Information | Retention period |
|---|---|
| Client data in EventSpark (we act as operator) | Held in the client’s own Salesforce org; we keep no copy beyond what support requires, and delete it at contract end or on the client’s instruction |
| Event registration and attendance for our own events | 24 months after the event |
| Financial and payment records | 7 years, as tax and company law require |
| Customer and supplier contracts and correspondence | 5 years after the relationship ends |
| Marketing contacts | Until you opt out, or 24 months without engagement |
| Unsuccessful job applications | 6 months, unless you agree to longer |
| Access and security logs | At least 6 months, per the Security Policy |
8. How we protect it
We protect personal information with the controls set out in the SparkSmiths Security Policy, including:
- encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent);
- multi-factor authentication and role-based access for all staff;
- encrypted tokens instead of record IDs in EventSpark invitation links, plus a one-time PIN before any personal details are shown;
- logging and monitoring of access, and regular staff security training.
If a breach is likely to affect you, we will notify the Information Regulator and you as soon as reasonably possible, as POPIA section 22 requires. For EU/UK data we notify the relevant supervisory authority within 72 hours where GDPR Article 33 applies. Where we act as operator, we tell the client without undue delay so they can notify.
9. Your rights
You can ask us, free of charge, to:
- confirm whether we hold your personal information and give you a copy;
- correct information that is wrong or incomplete;
- delete information we no longer have a lawful reason to keep;
- restrict or object to our processing, including for direct marketing at any time;
- withdraw consent you gave, without affecting earlier processing;
- give you your information in a portable format (GDPR);
- not be subject to decisions based solely on automated processing.
Send requests to the Information Officer, Derek Hughes, at the address in section 1. We may ask you to verify your identity, and we reply within one month. Requests for records may also be made under our PAIA manual, available from the Information Officer.
If you are unhappy with our response, you can complain to South Africa’s Information Regulator (inforegulator.org.za), or, in the EU or UK, to your local data protection authority (in the UK, the ICO at ico.org.uk).