Privacy Notice

We at Spark Sustainability value not only our planet, but also Your privacy. The purpose of this Privacy Notice is to describe exactly how we use your data, and how you can change that if you wish to. Spark collects personal data regarding the Carbon Donut application (“application”). More specifically, we collect data regarding registrations, service usage, and advertising as well as possible contact requests. We also use analytics in our app in order to get more specific information of its usage and hence to improve our service — this app was built for you, we want to make it as lovable as possible! This Privacy Notice complements our general Privacy Notice, regarding data collection via our website, which you may find here: https://sparksustainability.com/privacy/.

In this Privacy Notice, we explain what data we collect on you and how we use this data. The purpose of this Privacy Notice is also to provide the information required by applicable data protection laws. This Privacy Notice was last updated on March 15, 2022.

1. Controller

Spark Sustainability Ab (“Spark”, “we”, “us”, “our”)

Address: Lapinlahdenkatu 16, 00180 Helsinki

E-mail: info@sparksustainability.com

2. Contact person in the matter

Amanda Rejström, CEO

Address: Lapinlahdenkatu 16, 00180 Helsinki

E-mail: amanda@sparksustainability.com

If you have any questions concerning the processing of your personal data, please shoot Amanda an e-mail!

3. What are the purposes and the legal basis for processing personal data?

We only process personal data if such data is necessary in order to carry out the following purposes:

Providing our services
When you register for the application, calculate your lifestyle carbon emissions and use different features of the application, such as logging climate actions, we collect and process your personal data to provide this service. In this case, the processing is based on the performance of a contract — i.e., the service contract between you as a user and Spark, which comes into force upon registration. We also use the data you enter into the app when calculating your emissions to obtain more accurate estimates for average lifestyle carbon emissions. This data processing is based on our legitimate interest to improve our service.

Providing information related to our services
Spark uses your email address for the purpose of sending you important information about the app or your account, such as administrative messages and security information, to request user feedback, or to contact you concerning competitions or challenges you’ve taken part in through the app, for example if you’ve won a prize. This data processing is based on our legitimate interest in providing you with important information, improving the app, and sending you prizes you’ve won through competitions in the app.

Developing and analysing our application
We collect and process data to develop the functionality, usability, and overall awesomeness of our application by analysing its usage and occuring problems. This data processing is based on our legitimate interest to get adequate information to improve the quality of our application, and hence spark more climate action. You have the right to object to processing based on legitimate interest and you can deny your operating system and/or application store provider sending us the data.

Marketing
Spark uses your email address for the purpose of sending you news about Carbon Donut, our partners and products that can help you reduce emissions, and other information we think will be of interest to you. This data processing is based on our legitimate interest in providing you with information on the app and related topics.
We use the Facebook SDK to measure, optimise and build audiences for our advertisement campaigns on Facebook as well as to target our Facebook ads to users most likely interested in them. The Facebook SDK shows us how the users move between devices when they use our app and Facebook. You can find more information about the Facebook SDK here. This data processing is based on your consent that you can give us by allowing the use of SDKs by changing your preferences.
We use the Google Analytics for Firebase SDK to measure, optimise and build audiences for our advertisement campaigns on the Google Ads network as well as to target our Google ads to users most likely interested in them. Google Analytics for Firebase lets us analyse user behaviour and shows us how the users move between devices when they use our app and the Google Ads network. You can find more information about Google Analytics for Firebase here. This data processing is based on your consent that you can give us by allowing the use of cookies by changing your cookie preferences.
Spark uses the Firebase Dynamic Links SDK to measure performance of other marketing activities. This data processing is based on your consent that you can give us by allowing the use of cookies by changing your cookie preferences.

Managing contacts
We process your data to manage potential contact requests from you. In this case, the data processing is based on our legitimate interest to maintain good relationships with our community. You have the right to object to processing based on legitimate interest.

4. Which are our regular sources of information?

Personal data are mainly collected either directly from you or during the course of your service use. We collect and process data that:

you give us when you fill out and submit the registration form,
you give us when you take the Carbon Donut test,
you provide us while using the application (for example by completing tasks),
you give us when you contact us (for example by e-mail),
is provided to us by Google or Apple if you use their single sign-on (SSO) to log in to the application (for example e-mail address, name and possibly photo), and
is collected through software development kits (SDKs) and similar technologies when you use our app, click on our advertisements on Facebook or in the Google Ads network, or click on links in other marketing channels, such as our website.

Some development data (for example crash data) and any feedback you might give us are collected from your operating system and application store providers. Generally, they ask if you would like to allow them to send us this data, but the policy depends on your service provider.

5. What personal data do we collect?

We collect and process the following data:

Registration information (name, e-mail and encrypted password)
Lifestyle emission input data (information that enables us to estimate and show you your lifestyle carbon emissions, such as information on how you live, travel and consume)
Other service usage (such as the number of climate actions you have completed)
Information of your device on which you use our application (for example your IP address and operating system)
Single sign-on (SSO) information (such as e-mail address; the detailed data depends on what you accept to share with us)
Analytical data (such as app installs and how users behave in the app)
Mobile advertising identifiers (such as the Android Advertising ID and Advertising Identifier for iOS)
Development data and feedback
Possible contact information

Only registration information and device information are necessary if you would like to use our application. You are not obliged to provide us with any other personal data. However, if you decide not to provide data while using the application, you cannot properly use the respective features, such as completing tasks or calculating your lifestyle carbon emissions. Also, if you do not provide us with your contact information when contacting us, we cannot reply to you.

6. Is the data disclosed to third parties and who are the recipients?

We store and process data at Amazon Web Services (AWS). To find out more about how they protect the data, click here.

We also use Google Analytics, which is an analytics tool provided by Google. Read more about how Google protects the collected information here. Google states that they anonymize IP addresses as soon as technically feasible at the earliest possible stage of the collection network. Hence, Spark only receives anonymized data from Analytics. We use this data for general application usage analysis purposes.

We use SendGrid, a tool provided by Twilio, to manage e-mails we send out. We store and process the e-mails of Carbon Donut users in SendGrid in case we need to contact them. You can find Twilio’s privacy policy here.

We also use the Facebook SDK, which is an advertisement tool provided by Facebook. You can find out more about how they protect your information here.

We use Google Analytics for Firebase, which is an advertisement tool provided by Google. You can find out more about how they protect your information here.

We also use Firebase Dynamic links, which is another advertisement tool provided by Google. You can find out more about how they protect your information here.

As a main rule, we do not disclose personal data to other third parties. Despite this, we may be required to disclose data on you to third parties, such as authorities, in individual situations like when the disclosure is mandatory under applicable laws.

7. Is the data transferred outside the European Union or European Economic Area?

Data collected via Facebook SDKs is stored on Facebook’s servers, which are located all over the world. Data collected via Firebase SDKs is stored on Google’s servers, which are also located all over the world. All other data is stored and otherwise processed within the European Union or European Economic Area.

8. For how long will we store the personal data?

We only keep personal data for as long as is necessary for the purposes for which the personal data are processed.

As a general rule, data based on a contract are stored while the contract is in force (meaning while you have a registered account in the application). If you would like to delete your account and all your personal data, you can initiate the process via the Privacy & security settings in the app. Your account and all associated personal data will be deleted within 30 days.

Also, as a general rule, contact persons’ personal data are stored for the time needed to manage the contact or the duration of the client relationship. However, you may always request for data erasure or rectification before these general times.

The data collected with the Firebase for Google Analytics SDK that is related to cookies, user identifiers or advertising identifiers is deleted after 2 months.

9. How do we keep the data safe?

Manual data

We do not process any data manually and we do not have a manual register.

Data in electronic form

Spark takes appropriate technical and organisational measures to protect personal data against unauthorised access and accidental or unlawful destruction, alteration, disclosure, transfer or all other unlawful forms of processing.

We process all personal data confidentially. The right of access to personal data is limited so that access rights are provided only to persons who require access in order to be able to perform their duties. All the passwords are appropriately encrypted so even these persons with access rights cannot see them.

10. What are your rights as a data subject?

If you have any questions concerning the processing of your personal data or you would like to make a request concerning your rights, do not hesitate to contact the person mentioned in section 2 of this Privacy Policy. As a data subject, you have the following rights:

‍

10.1. Right to request access and rectification of personal data

You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, when that is the case, access to the personal data. You also have the right to obtain the rectification of inaccurate personal data concerning you without undue delay.

‍

10.2 Right to request erasure of personal data

In general, you also have the right to obtain the erasure of personal data concerning you. However, we may not be able to erase your data in individual cases such as when the data is necessary for a purpose defined in this Privacy Notice or storing it is required by law.

‍

10.3. Right to restrict or object to data processing

Even when the data processing is based on legitimate interest, you have the right to object to processing. You can also ask us to restrict processing of your personal data.

‍

10.4. Right to data portability

When the data processing is based on consent or a contract, you have the right to receive the personal data that you have provided us in a structured, commonly used and machine-readable format and, if desired, transmit that data to another controller.

‍

10.5. Right to lodge a complaint with a supervisory authority

If you think that we don’t process your personal data appropriately, you can contact the person mentioned in section 2. If you think that our processing of personal data relating to you infringes applying data protection regulations, you can also complain to a data protection authority. In Finland, this authority is The Office of the Data Protection Ombudsman and you can find the contact details here: https://tietosuoja.fi/en.

‍

11. Changes to this Privacy Notice

We may update this Privacy Notice due to the development of our application. In such cases, an updated Privacy Notice is available in the application (direct link: https://sparksustainability.com/the-donut-privacy-policy/).