This addendum forms part of the Terms of Service and governs our processing of personal data on your behalf. It applies whenever you use sparx to handle the personal data of your own customers or contacts.
For personal data contained in Customer Data, you are the controller and WizeWorks is the processor (or, where applicable, a service provider under U.S. state privacy laws). We process such personal data only on your documented instructions, which include the configuration choices you make in the Service and these Terms.
We process personal data to provide the Service, for example storing customer records in the CRM, processing orders and payments in commerce, delivering the email and text messages you send, taking bookings, running your live chat, publishing to the social accounts you connect, and rendering the content and stores you publish. The subject matter is the operation of your tenant; the duration is the term of your subscription plus any wind-down period.
Whose data: your end customers, contacts, leads, the recipients of your communications, people who book appointments with you, people who fill in your forms or chat with your site, and members of the public who comment on or review your business on a social platform you have connected.
What data:
We do not require special-category data. If you choose to process it, you are responsible for the lawful basis and for any additional safeguards it requires.
When you connect a social account, sparx receives data from that platform on your behalf: the posts you publish through it, how they performed, and the comments, mentions, reviews, and messages they attract. Some of that is personal data about members of the public who have no relationship with sparx and did not choose it.
We handle it narrowly. It is used only to show you your own engagement and to send the replies you write, never for any purpose of our own; it is stored under the same tenant isolation as the rest of your data; and it is subject to the platform’s own terms as well as this addendum, which means we honor a platform’s instruction to delete it. The access tokens for a connected account are encrypted at rest with a key reserved for that purpose, and disconnecting an account removes them.
You authorize us to engage subprocessors to deliver the Service. Each is named, with what it does and what data it handles, on our published subprocessor list. We impose data-protection terms on each subprocessor no less protective than those in this addendum and remain responsible for their performance. We keep that list current and will give notice of material changes so you can object on reasonable grounds.
Services you connect with your own credentials (shipping, tax, payment gateways other than our own, AI providers, and social platforms) are not our subprocessors. We transmit to them at your instruction, on your relationship with them. The subprocessor list explains the distinction.
We do not use your data to train AI models, and we do not send it to an AI provider on our own account. sparx holds no AI credential of its own. Where you enable an AI feature, it runs on a provider key you supply or through an AI tool you connect yourself, and that provider’s terms (not ours) govern what it does with what it receives. If you do not configure one, no personal data in your tenant is sent to any AI provider at all.
We maintain encryption in transit and at rest, database-level tenant isolation, and access controls: described in our security overview. If we become aware of a personal-data breach affecting your data, we will notify you without undue delay (and within 72 hours of confirming a reportable breach), with the information you reasonably need to meet your own notification duties.
If a court, regulator, or law-enforcement agency demands personal data we hold for you, we follow a written policy before anything is disclosed:
Because you are the controller of this data and we are only the processor, contesting a request is your decision to make wherever the law leaves room for one.
The Service runs in Google Cloud’s central United States region, so personal data you process through sparx is stored in the United States. Where that is a cross-border transfer requiring safeguards, we rely on appropriate ones (including the European Commission’s standard contractual clauses) to the extent required by applicable law.
On termination you may export Customer Data for a reasonable period. After that period we delete or anonymize personal data, except where we are required to retain it (for example, order records needed for tax and accounting), in which case it remains subject to these protections.
This addendum is incorporated into the Terms of Service. A countersigned copy is available for organizations that require one: email [email protected]. A signed DPA is required for tenants processing the personal data of individuals in the EU/EEA and UK.