Privacy Notice

We at Spark Sustainability value not only our planet, but also Your privacy. The purpose of this Privacy Notice is to describe exactly how we use your data, and how you can change that if you wish to. Spark collects personal data regarding The Donut application (“application”). More specifically, we collect data regarding registrations, service usage, and advertising as well as possible contact requests. We also use analytics in our app in order to get more specific information of its usage and hence to improve our service — this app was built for you, we want to make it as lovable as possible! This Privacy Notice complements our general Privacy Notice, regarding data collection via our website, which you may find here:

In this Privacy Notice, we explain what data we collect on you and how we use this data. The purpose of this Privacy Notice is also to provide the information required by applicable data protection laws. This Privacy Notice was last updated on January 7, 2021.

1. Controller

Spark Sustainability Ab  (“Spark”, “we”, “us”, “our”)

Address: Lapinlahdenkatu 16, 00180 Helsinki


2. Contact person in the matter

Amanda Rejström, CEO

Address: Lapinlahdenkatu 16, 00180 Helsinki


If you have any questions concerning the processing of your personal data, please shoot Amanda an e-mail!

3. What are the purposes and the legal basis for processing personal data?

We only process personal data if such data is necessary in order to carry out the following purposes:

  • Providing our services
    When you register for the application, take the Carbon Donut test and use different features of the application, such as logging climate actions, we collect and process your personal data to provide this service. In this case, the processing is based on the performance of a contract — i.e., the service contract between you as a user and Spark, which comes into force upon registration. We also use the data you enter into the Carbon Donut test to obtain more accurate estimates for average lifestyle carbon emissions. This data processing is based on our legitimate interest to improve our service.
  • Providing information related to our services
    Spark uses your email address for the purpose of sending you important information about the app or your account, such as administrative messages and security information, to request user feedback, or to contact you concerning competitions or challenges you’ve taken part in through the app, for example if you’ve won a prize. This data processing is based on our legitimate interest in providing you with important information, improving the app, and sending you prizes you’ve won through competitions in the app.
  • Developing and analysing our application
    We collect and process data to develop the functionality, usability, and overall awesomeness of our application by analysing its usage and occuring problems. This data processing is based on our legitimate interest to get adequate information to improve the quality of our application, and hence spark more climate action. You have the right to object to processing based on legitimate interest and you can deny your operating system and/or application store provider sending us the data. 
  • Marketing
    We use Facebook SDK to measure, optimise and build audiences for our advertisement campaigns on Facebook as well as to target our Facebook ads to users most likely interested in them. Facebook SDK shows us how the users move between devices when they use our app and Facebook. You can find more information about Facebook SDK here. This data processing is based on your consent that you can give us by allowing the use of SDKs by changing your preferences.
  • Managing contacts
    We process your data to manage potential contact requests from you. In this case, the data processing is based on our legitimate interest to maintain good relationships with our community. You have the right to object to processing based on legitimate interest.

4. Which are our regular sources of information?

Personal data are mainly collected either directly from you or during the course of your service use. We collect and process data that: 

  • you give us when you fill out and submit the registration form,
  • you give us when you take the Carbon Donut test, 
  • you provide us while using the application (for example by completing tasks),
  • you give us when you contact us (for example by e-mail), and
  • is collected through software development kits (SDKs) and similar technologies when you use our app or click on our advertisements on Facebook.

Some development data (for example crash data) and any feedback you might give us are collected from your operating system and application store providers. Generally, they ask if you would like to allow them to send us this data, but the policy depends on your service provider. 

5. What personal data do we collect?

We collect and process the following data:

  • Registration information (name, e-mail and encrypted password)
  • Carbon Donut test data (information that enables us to estimate and show you your lifestyle carbon emissions, such as information on how you live, travel and consume)
  • Other service usage (such as the number of climate actions you have completed)
  • Information of your device on which you use our application (for example your IP address and operating system)
  • Analytical data (such as app installs and how users behave in the app)
  • Development data and feedback
  • Possible contact information

Only registration information, Carbon Donut test input and device information are necessary if you would like to use our application. You are not obliged to provide us with any other personal data. However, if you decide not to provide data while using the application, you cannot properly use the respective features, such as completing tasks. Also, if you do not provide us with your contact information when contacting us, we cannot reply to you.

6. Is the data disclosed to third parties and who are the recipients? 

We store and process data at Heroku, which is a third party service provider and part of Salesforce. To find out more about how they protect the data, click here.   

We also use Google Analytics, which is an analytics tool provided by Google. Read more about how Google protects the collected information here. Google states that they anonymize IP addresses as soon as technically feasible at the earliest possible stage of the collection network. Hence, Spark only receives anonymized data from Analytics. We use this data for general application usage analysis purposes.

We use Flodesk to manage e-mails we send out, so we store and process the e-mails of The Donut users there in case we need to contact them. You can find Flodesk’s privacy policy here.

We also use Facebook SDK, which is an advertisement tool provided by Facebook. You can find out more about how they protect your information here.

As a main rule, we do not disclose personal data to other third parties. Despite this, we may be required to disclose data on you to third parties, such as authorities, in individual situations like when the disclosure is mandatory under applicable laws.

7. Is the data transferred outside the European Union or European Economic Area?

Data collected via Facebook SDKs is stored on Facebook’s servers, which are located all over the world. All other data is stored and otherwise processed within the European Union or European Economic Area.

8. For how long will we store the personal data?

We only keep personal data for as long as is necessary for the purposes for which the personal data are processed. 

As a general rule, data based on a contract are stored while the contract is in force (meaning while you have a registered account in the application). If you would like to delete your account and all your personal data, please contact the person mentioned in section 2 of this Privacy Policy. 

Also, as a general rule, contact persons’ personal data are stored for the time needed to manage the contact or the duration of the client relationship. However, you may always request for data erasure or rectification before these general times. 

9. How do we keep the data safe?

Manual data

We do not process any data manually and we do not have a manual register. 

Data in electronic form

Spark takes appropriate technical and organisational measures to protect personal data against unauthorised access and accidental or unlawful destruction, alteration, disclosure, transfer or all other unlawful forms of processing. 

We process all personal data confidentially. The right of access to personal data is limited so that access rights are provided only to persons who require access in order to be able to perform their duties. All the passwords are appropriately encrypted so even these persons with access rights cannot see them.

10. What are your rights as a data subject?

If you have any questions concerning the processing of your personal data or you would like to make a request concerning your rights, do not hesitate to contact the person mentioned in section 2 of this Privacy Policy. As a data subject, you have the following rights:  

10.1. Right to request access and rectification of personal data

You have the right to obtain confirmation as to whether or not personal data concerning you are being processed, and, when that is the case, access to the personal data. You also have the right to obtain the rectification of inaccurate personal data concerning you without undue delay. 

10.2 Right to request erasure of personal data

In general, you also have the right to obtain the erasure of personal data concerning you. However, we may not be able to erase your data in individual cases such as when the data is necessary for a purpose defined in this Privacy Notice or storing it is required by law. 

10.3. Right to restrict or object to data processing

Even when the data processing is based on legitimate interest, you have the right to object to processing. You can also ask us to restrict processing of you personal data. 

10.4. Right to data portability

When the data processing is based on consent or a contract, you have the right to receive the personal data that you have provided us in a structured, commonly used and machine-readable format and, if desired, transmit that data to another controller.

10.5. Right to lodge a complaint with a supervisory authority

If you think that we don’t process your personal data appropriately, you can contact the person mentioned in section 2. If you think that our processing of personal data relating to you infringes applying data protection regulations, you can also complain to a data protection authority. In Finland, this authority is The Office of the Data Protection Ombudsman and you can find the contact details here:

11. Changes to this Privacy Notice

We may update this Privacy Notice due to the development of our application. In such cases, an updated Privacy Notice is available in the application (direct link:

Spark Sustainability in InstagramSpark Sustainability in InstagramSpark Sustainability in InstagramSpark Sustainability in InstagramSpark Sustainability in InstagramSpark Sustainability in InstagramSpark Sustainability in InstagramSpark Sustainability in Instagram