Effective Date: June 27, 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between Solder Spark Studios Inc. (“Solder Spark Studios,” “we,” “us”) and the customer (“Customer,” “you”) for the use of Spark Studio (the “Service”). It governs our processing of personal data contained in your workspace content (“Customer Personal Data”) on your behalf. Where this DPA conflicts with the Terms of Service for Spark Studio, this DPA controls for data protection matters.
1. Roles
For Customer Personal Data, you are the controller (or processor acting for your own customers) and Solder Spark Studios is the processor (or subprocessor). We process Customer Personal Data only on your documented instructions, including as set out in the Terms of Service and this DPA, unless required by law.
2. Scope of processing
- Subject matter: provision of the Spark Studio service.
- Duration: the term of your subscription, plus the retention and deletion periods described below.
- Nature and purpose: hosting, storage, processing, and display of workspace content, including AI-assisted features you invoke, to provide the Service.
- Types of data: the personal data you choose to include in your workspace, plus account and usage data of your members.
- Data subjects: your team members and any individuals referenced in your content.
3. Our obligations
- Process Customer Personal Data only on your instructions and for the purpose of providing the Service;
- Ensure personnel authorized to process the data are bound by confidentiality;
- Implement appropriate technical and organizational security measures, including encryption in transit, access controls, and tenant isolation;
- Not sell or share Customer Personal Data, and not use it for advertising or to train our own general-purpose AI models;
- Assist you, taking into account the nature of processing, with data subject requests and with your security, breach-notification, and impact-assessment obligations;
- Notify you without undue delay after becoming aware of a personal data breach affecting Customer Personal Data.
4. Subprocessors
You authorize us to engage subprocessors to provide the Service. We impose data protection obligations on each subprocessor no less protective than those in this DPA and remain responsible for their performance. Our subprocessors fall into the categories of cloud hosting and infrastructure, payment processing, email delivery, and AI and large language model processing. We will provide our current list of named subprocessors on request and will give you a reasonable opportunity to object to a new subprocessor.
5. International transfers
Where Customer Personal Data is transferred across borders, we use appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, which are incorporated into this DPA by reference where applicable.
6. Data subject requests
Taking into account the nature of the processing, we will assist you with appropriate technical and organizational measures, insofar as possible, in responding to requests from individuals to exercise their rights. You can access, export, correct, and delete workspace content directly within the Service.
7. Return and deletion
On termination or cancellation, you may export Customer Personal Data for 30 days. We then delete it from active systems within 30 days, except for limited records we must retain by law. Diagnostic logs are retained for up to 90 days and then deleted or de-identified.
8. Audits
On reasonable request and subject to confidentiality, we will make available information necessary to demonstrate compliance with this DPA and allow for audits in a manner that does not compromise the security or privacy of other customers.
9. Contact
For data protection matters, contact contact@solderspark.com. If you require a countersigned copy of this DPA, contact us with your entity details.