Contact us
PolskiEnglish
Contact us

Privacy Policy

§ 1 Introduction

This Privacy Policy sets out the rules governing the processing of personal data by SparkSome Venture sp. z o.o., with its registered office at ul. Szlak 77/222, 31-153 Kraków, Poland, entered in the National Court Register maintained by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division, under KRS number 0001085500, VAT ID 6793289948 and REGON 527616291 („we”, „us” and „our”), through the following websites: sparksome.pl, sparksomeventure.com and spark.com.pl.

Please read the rules described in this Privacy Policy.

§ 2 Data controller

  • The controller of your personal data is SparkSome Venture sp. z o.o., with its registered office in Kraków.
  • If you have any questions about the processing of personal data, please contact us at [email protected].

§ 3 What data do we collect

When you use our website, we may collect the following data:

  1. users’ IP addresses, which may be stored in server logs;
  2. data collected through Google Analytics for the purpose of analysing website traffic;
  3. verification data collected through Cloudflare Turnstile to protect the website against spam and bots;
  4. data collected through Google Tag Manager to manage tags and monitor activity on the website;
  5. information collected through user behaviour analytics tools, including heatmaps, which helps us optimise the website. The tool used for this purpose is Microsoft Clarity;|
  6. the email address voluntarily provided when subscribing to the newsletter.

§ 4 Contact forms

  • Our website provides contact forms that allow users to submit their personal data so that we can contact them and handle different types of enquiries.
  • Users may provide their first name, surname, email address, telephone number and the content of their enquiry. We process this data solely to respond to questions, contact the user and handle the types of enquiry submitted through the forms.
  • Data submitted through the forms is protected in accordance with applicable law, including the GDPR, and is used solely for the purposes for which it was provided.

§ 5 Newsletter

  • As part of the newsletter service, we process the user’s first name and email address provided when subscribing.
  • The legal basis for the processing is the user’s freely given consent under Article 6(1)(a) of the GDPR.
  • Consent to receive the newsletter is voluntary and may be withdrawn at any time in either of the following ways: 1) by clicking the unsubscribe link in the footer of any newsletter email; or 2) by contacting us at [email protected].
  • Once consent has been withdrawn, we will stop sending newsletter emails without undue delay. Withdrawal of consent does not affect the lawfulness of processing carried out before the consent was withdrawn.

§ 6 Purposes of processing

We process users’ personal data for the following purposes:

  1. analysing website traffic and optimising the operation of the website through Google Analytics, based on the user’s consent given through the cookie management banner under Article 6(1)(a) of the GDPR;
  2. protecting the website against unauthorised access and spam attacks through Cloudflare Turnstile, based on the controller’s legitimate interest in ensuring the security of the website under Article 6(1)(f) of the GDPR;
  3. managing tags and tracking activity on the website to improve its performance through Google Tag Manager, based on the user’s consent given through the cookie management banner under Article 6(1)(a) of the GDPR;
  4. analysing user behaviour and optimising the website through heatmap tools, based on the user’s consent given through the cookie management banner under Article 6(1)(a) of the GDPR;
  5. managing server security and protecting against attacks by storing IP logs, based on the controller’s legitimate interest in ensuring infrastructure security under Article 6(1)(f) of the GDPR;
  6. responding to enquiries submitted by users through contact forms, based on the controller’s legitimate interest under Article 6(1)(f) of the GDPR;
  7. establishing business relationships and conducting B2B communications, based on the controller’s legitimate interest under Article 6(1)(f) of the GDPR;
  8. providing the newsletter service, based on the user’s freely given consent under Article 6(1)(a) of the GDPR.

§ 7 B2B marketing and commercial communications

In the course of our business activities, we process the contact details of company representatives and employees for purposes related to B2B marketing, prospecting, establishing business relationships and conducting business communications.

The data processed is limited to:

  • first name and surname;
  • business email address;
  • job title;
  • the company’s name and identification details;
  • publicly available information about the company.

The legal basis for processing is the controller’s legitimate interest under Article 6(1)(f) of the GDPR. This interest consists in contacting persons responsible for IT, security, technology or management within companies and in developing and promoting the services offered by SparkSome Venture sp. z o.o.

B2B communications conducted by SparkSome Venture:

  • are personalised and relate solely to the recipient’s professional or business activities;
  • do not constitute a commercial communication within the meaning of the Electronic Communications Law at the initial contact stage;
  • are neutral at the initial contact stage and are intended solely to identify the appropriate contact person, their area of responsibility or whether further communication is appropriate;
  • include marketing, promotional or commercial content only after the recipient has replied, expressly initiated further contact or given unambiguous consent;
  • may be objected to by the data subject at any time, in which case further contact will cease without undue delay.

The data may come from the following sources:

  • publicly available registers, including the National Court Register (KRS) and the Central Register and Information on Business (CEIDG);
  • official company websites;
  • business portals;
  • company profiles on LinkedIn;
  • lawfully obtained B2B company databases containing business data only.

The data subject has the right to:

  • object to the processing of their data for B2B marketing purposes;
  • request the erasure of their data;
  • withdraw consent, where consent has been given.

To exercise these rights, please contact us at [email protected].

§ 8 Cookies

Our website uses cookies, which are small text files stored on the user’s device.

We use the following categories of cookies:

  1. strictly necessary cookies, which are required for the website to function correctly and do not require the user’s consent;
  2. analytics cookies, which allow us to analyse traffic and how the website is used, including through Google Analytics, Google Tag Manager and heatmap tools. These cookies are used only after the user has given consent;
  3. security cookies, which are used by Cloudflare Turnstile to protect the website against spam and bot attacks and are used on the basis of the controller’s legitimate interest.

Consent to the use of analytics cookies is given through the cookie management banner displayed when the user first visits the website. Consent may be withdrawn at any time by changing the settings in the cookie management panel available on the website or through the settings of the user’s web browser.

§ 9 Disclosure of data and international transfers

The data collected may be disclosed to the following recipients:

  1. Google LLC, in connection with the use of Google Analytics and Google Tag Manager;
  2. Cloudflare, Inc., in connection with the protection of the website through WAF mechanisms or Cloudflare Turnstile;
  3. Microsoft Clarity, an external tool used to analyse user behaviour on the website through heatmaps;
  4. Brevo, formerly Sendinblue, in connection with the operation of the newsletter. Brevo provides tools for automating email communications.

Data transferred to Google LLC and Cloudflare, Inc. may be processed on servers located outside the European Economic Area, including in the United States. Such transfers are carried out on the basis of standard contractual clauses approved by the European Commission under Article 46(2)(c) of the GDPR.

When Brevo, formerly Sendinblue, is used, data is processed within the European Union. If data is transferred outside the European Economic Area, Brevo provides appropriate safeguards in accordance with the GDPR.

§ 10 Data retention periods

We retain personal data for as long as necessary to fulfil the purposes for which it was collected:

  1. data submitted through contact forms is retained until the enquiry has been handled and then for 3 years to protect against potential claims;
  2. email addresses used for the newsletter are retained until the user withdraws consent;
  3. server logs containing IP addresses are normally retained for 90 days and are then deleted automatically;
  4. data processed through Google Analytics is retained in accordance with the retention settings configured in the tool, by default for up to 14 months;
  5. data processed for B2B marketing purposes is retained until an effective objection to the processing is made or the controller’s legitimate interest ceases to exist.

§ 11 Data security

We attach great importance to protecting our users’ personal data. We apply appropriate technical and organisational measures to keep data secure, including SSL encryption, regular monitoring and automated security audits.

§ 12 User rights

Under the GDPR, users have the right to:

  1. access their personal data;
  2. have their personal data rectified or erased or have the processing of their personal data restricted;
  3. object to the processing of their personal data;
  4. data portability;
  5. withdraw consent to processing at any time, without affecting the lawfulness of processing carried out before the consent was withdrawn. Consent to the newsletter may be withdrawn by clicking the unsubscribe link in the footer of any newsletter email or by contacting us at [email protected];
  6. lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland, email: [email protected], if they consider that the processing of their personal data infringes the GDPR.

To exercise the rights listed in items 1 to 4, please contact us at [email protected].

§ 13 Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes in our data processing practices or changes in the law. We will notify users of material changes by displaying a prominent notice on the website and, in the case of newsletter subscribers, by email. The current version of this Privacy Policy will always be available on our website.

Last updated: 16 June 2026.

§ 14 Contact

If you have any questions about this Privacy Policy, please contact us at [email protected].