Privacy Policy.
Last updated September 15th, 2026
1. Who we are
Spark Layer Ltd ("SparkLayer", "we", "us", "our") provides B2B ordering software to merchants, delivered as an app on ecommerce platforms including Shopify, Wix, BigCommerce, WooCommerce and Magento.
Registered office: Trimbridge House, First Floor, Trim Street, Bath, BA1 1HB, United Kingdom.
Company registration number: 12881913.
ICO registration: ZB074246.
This policy explains what personal data we handle, why, the legal bases we rely on, who we share it with, and the rights available to you. It covers this website (www.sparklayer.io), our dashboard and apps, and our sales and support activity.
We are not required by the UK GDPR to appoint a data protection officer and have not appointed one. Any question about this policy or your data can be sent to contact@sparklayer.io or by post to the address above.
2. Do we process personal data when providing our services?
Yes. Providing B2B ordering requires us to process personal data belonging to your customers. In that processing you are the data controller and SparkLayer is your data processor: we act only on your documented instructions, and only to deliver the service. Section 7 sets out exactly what we process and why, and section 21 sets out the terms on which we do it.
3. The two roles we act in
- Controller - for the personal data of people who visit our website, hold or administer a SparkLayer account, and deal with our sales and support teams. This policy governs that data.
- Processor - for the personal data of your customers, handled on your behalf to provide B2B ordering. You are the controller; your own privacy notice governs that data.
4. Personal data we handle as a controller
| Category | Examples | Source |
|---|---|---|
| Identity & contact | Name, company name, company website, email address, phone number | You, at sign up or when you complete a form on our website |
| Account | Login credentials (hashed), settings, time zone, user role | You / generated by the service |
| Billing | Billing contact, plan, transaction records. Card details are handled by Shopify or Stripe and are not stored by us | You / the platform / Stripe |
| Usage & technical | IP address, device and browser, pages viewed, feature usage, log data | Automatically |
| Support & sales | Messages, chat transcripts, call notes, support tickets | You / our tools |
| Marketing | Preferences and engagement with our emails | You |
| Website demo | The store address you enter into our interactive demo and, if you provide it, your email address | You |
SparkLayer does not require or intentionally collect special category personal data, or data relating to criminal convictions and offences, in order to provide the service. Customers and users should not provide this information unless it is necessary and lawful to do so.
5. How we collect it
- Directly from you - when you sign up, complete a form on our website (for example to book a demo, download a guide or subscribe to updates), try our interactive demo, or contact support or sales.
- Automatically - through cookies, logs and analytics (section 14).
- From third parties - including the ecommerce platform your store runs on when you install our app, and our billing and CRM providers.
6. Why we process it, and our legal bases
| Purpose | Legal basis |
|---|---|
| Provide, operate and secure the service | Performance of a contract |
| Authenticate users and prevent abuse | Legitimate interests (security) |
| Bill and take payment | Contract / legal obligation |
| Provide support | Contract / legitimate interests |
| Respond to an enquiry or demo request made through our website | Legitimate interests / steps taken at your request before a contract |
| Improve and develop the product and our website | Legitimate interests |
| Send service and transactional messages | Performance of a contract |
| Send marketing where permitted | Consent, or soft opt-in for existing customers |
| Meet legal obligations (tax, accounting) | Legal obligation |
Where we rely on legitimate interests, we have assessed that our interests are not overridden by your rights and freedoms. You can ask us for details of that assessment.
We will only use your personal data for the purposes we collected it for, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If we need to use it for an unrelated purpose, we will tell you and explain the legal basis that allows us to do so.
7. Data we process on behalf of merchants
To provide the service we process personal data belonging to your customers, accessed through the ecommerce platform your store runs on. The fields we process are:
| Field | What it covers |
|---|---|
| Name | First and last name |
| Email address | |
| Phone | Default and billing phone numbers |
| Address | Shipping and billing addresses |
Depending on the ecommerce platform and the features a merchant enables, we may also process customer, company and order information made available through that platform's APIs where it is necessary to provide the configured SparkLayer functionality. On Shopify, the fields above are approved under Shopify's protected customer data requirements.
We process this information only on the merchant's instructions and for the purposes of providing the service - including linking a customer to their customer-specific pricing, creating and managing their orders, enabling your sales agents to search for and view customers on your behalf, and providing customer service. We do not sell Customer Personal Data or use it to build advertising or marketing profiles for our own purposes.
Our Data Processing Agreement sets out our contractual obligations as your processor (see section 21).
8. Service providers and sub-processors
We use third-party service providers to operate SparkLayer and our business. The role a provider performs depends on the data involved.
Sub-processors of Customer Personal Data. Where a third party processes Customer Personal Data on our behalf in order to provide the SparkLayer service, it is a sub-processor and is subject to the terms of our Data Processing Agreement. We carry out due diligence on each, bind them by contract to appropriate data protection terms, keep the list current and notify account holders of material changes.
Other service providers. We also use providers to operate our own website, sales, marketing, billing and business systems - our CRM, analytics, cookie-management and billing tools. In those cases SparkLayer generally acts as controller for the relevant personal data; the cookies and analytics among them are described in section 14.
Our current sub-processors of Customer Personal Data are:
| Sub-processor | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| Google Cloud | Hosting and storage | UK - europe-west2 (London) | - |
| Amazon Web Services | Transactional email and DNS | EU / US | SCCs / UK IDTA |
| Stripe | Billing and payments | US / EU | SCCs / UK IDTA |
| HubSpot | CRM | US | SCCs / UK IDTA |
| Intercom | Customer support | US / EU | SCCs / UK IDTA |
The other providers we use, where SparkLayer is the controller of the data involved, are:
| Provider | Purpose | Location | Transfer mechanism |
|---|---|---|---|
| HubSpot | Sales CRM, website forms and marketing email | US | SCCs / UK IDTA |
| Intercom | Website chat | US / EU | SCCs / UK IDTA |
| Google Analytics | Website and product usage analytics | US | SCCs / UK IDTA |
| Microsoft Clarity | Website usage analytics | US / EU | SCCs / UK IDTA |
| Cookiebot | Cookie consent management | EU | - |
The ecommerce platform your store runs on (e.g. Shopify) is the source of the customer data we process on your behalf, under your own agreement with that platform.
9. International transfers
Where personal data is transferred outside the UK / EEA, we rely on UK International Data Transfer Agreements, the EU Standard Contractual Clauses, or an adequacy decision, with supplementary safeguards where required. You can request details of the safeguards in place.
10. How we keep data secure
Our production database runs on Google Cloud in the europe-west2 (London) region, in the United Kingdom. We protect personal data with technical and organisational measures including encryption in transit and at rest, least-privilege access, multi-factor authentication, logging and monitoring, and prompt access revocation when people leave. Full detail is in our security policy.
No transmission of data over the internet can be guaranteed to be completely secure. If you believe that your interaction with us is no longer secure, please contact us.
11. Your rights
Under the UK GDPR you have the right to be informed; to access your data; to have inaccurate data corrected; to erasure; to restrict processing; to data portability; to object (including to direct marketing); and not to be subject to solely automated decisions with significant effects. Where we rely on consent, you may withdraw it at any time.
To exercise any right, email contact@sparklayer.io. We will respond within the statutory period - normally one month, extendable by two further months for complex requests, which we will tell you about. We may need to verify your identity before acting on a request. You will not have to pay a fee to exercise your rights, though we may refuse a request that is clearly unfounded or excessive.
If you are in California, you may also ask us for a notice identifying the categories of personal information we share with third parties for their direct marketing purposes. We do not share personal information for that purpose.
12. Rights over data we process for merchants
If you are a customer of one of our merchants and wish to exercise rights over data we hold as a processor, please contact that merchant, who is the controller. If you contact us, we will forward your request to them and assist them in responding.
13. How long we keep it
We keep personal data only as long as we need it. For account data, that means for the life of your account and for a limited period afterwards. For personal data we process on a merchant's behalf, we retain it while the merchant uses the service, and delete or return it on their instruction and after they uninstall our app. Where the law requires us to keep records - for example billing and tax records - we keep them for the period the law specifies. We may keep data for longer where a complaint has been made or we reasonably believe there is a prospect of a legal claim. You can ask us what applies to your data at any time.
14. Cookies and analytics
We use strictly necessary cookies to run this website and the service and, with your consent, analytics cookies to understand how our website and product are used. We manage cookie consent through Cookiebot - you can review or change your choices at any time through the cookie banner, and through your browser settings.
On this website, with your consent, we use Google Analytics (through Google Tag Manager) and Microsoft Clarity for usage analytics, and HubSpot and Intercom set cookies that let us recognise you when you complete a form or start a chat with us.
15. Marketing
We send marketing only with your consent, or on a soft opt-in basis to existing customers for similar products. Every marketing email carries an unsubscribe link, and you can opt out at any time by emailing contact@sparklayer.io. Where you opt out of marketing, we will continue to hold other personal data provided to us through interactions not related to your marketing preferences.
16. Automated decision-making
We do not make decisions producing legal or similarly significant effects based solely on automated processing.
17. Children's data
The service and this website are aimed at businesses and are not directed at children. We do not knowingly collect the personal data of children.
18. Data breaches
If a breach affects personal data, we follow our incident management policy. Where we are the controller and the breach is likely to risk individuals' rights, we notify the ICO within 72 hours where required, and affected individuals without undue delay where the risk is high. Where we are a processor, we notify the affected merchant without undue delay, as set out in our Data Processing Agreement.
19. Sharing your data, and third-party links
We share personal data with the sub-processors in section 8, with professional advisers where necessary, and where required by law or to enforce our terms or this policy. If SparkLayer is involved in a merger, acquisition or sale of all or part of its business or assets, personal data may be transferred as part of that transaction; we will tell you before your data becomes subject to a different privacy policy.
Our website and apps may link to third-party websites, plug-ins and applications that we do not control. This policy does not cover them; please read their own privacy notices.
20. Changes to this policy
We version this policy and show the effective date above. We notify account holders of material changes. Continued use of the service after a change takes effect constitutes acceptance of the updated policy.
21. Data processing terms
Where we process personal data on your behalf as your processor (section 3), the terms on which we do so are set out in our Data Processing Agreement, which forms part of the agreement between us and is intended to satisfy Article 28(3) of the UK GDPR and the EU GDPR. It covers the subject matter and duration of the processing, our obligations as your processor, sub-processors, international transfers, personal data breaches, and your obligations as controller.
22. Contact and complaints
Spark Layer Ltd, Trimbridge House, First Floor, Trim Street, Bath, BA1 1HB, United Kingdom.
contact@sparklayer.io
ICO registration ZB074246.
You have the right to complain to the Information Commissioner's Office (ico.org.uk, 0303 123 1113), though we would appreciate the chance to resolve your concern first.
Please also see our Terms of Service, which set out the terms governing your use of SparkLayer.
