GDPR & Data Rights

1. Introduction

SparkRecall Limited ("SparkRecall", "we", "us", "our") is incorporated in Ireland and operates SparkRecall.com and related mobile applications (the "Platform").

We are committed to protecting your personal data in accordance with:

• Regulation (EU) 2016/679 (GDPR)
• Irish Data Protection Act 2018
• UK GDPR (as retained in UK law by the European Union (Withdrawal) Act 2018) and the UK Data Protection Act 2018 — applicable to users accessing the Platform from the United Kingdom
• Other applicable global data protection laws

SparkRecall Limited is the Data Controller for personal data collected through the Platform.

2. Data We Collect

2.1 Account Information

• Name
• Email address
• Username
• Password (stored in encrypted form only)

2.2 User-Generated Content

Information you voluntarily input into the Platform.

2.3 Technical Data

• IP address
• Device type
• Browser type and version
• Operating system
• Usage data and interaction logs

2.4 Cookies & Tracking Data

Please refer to our Cookie Policy for full details of cookies and tracking technologies used on the Platform.

3. Special Category & Sensitive Data — Strict Prohibition

4. Lawful Bases for Processing

We process personal data under the following lawful bases:

5. Purpose of Processing

We process personal data only for the following specific purposes:

• Providing and maintaining the Platform
• Authenticating and managing user accounts
• Improving Platform functionality and user experience
• Ensuring Platform security and preventing fraud
• Complying with legal and regulatory obligations

We do not sell personal data to third parties. We do not use personal data for automated decision-making or profiling that produces legal or similarly significant effects.

6. Limitation of Liability — User-Submitted Data

SparkRecall's Role as a Passive Data Host

SparkRecall Limited operates as a platform that stores user-submitted content. We do not actively review, monitor, or process user-submitted content beyond technical storage operations.

Where a user uploads data in breach of these policies, SparkRecall Limited acts as a processor in respect of that content only. Liability for any consequences arising from such a breach rests solely with the uploading user.

7. Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected, and in accordance with our legal obligations:

• Account data is retained for the duration of your active account
• Data required by legal obligation is retained for the period required by law
• Data subject to a deletion request will be deleted promptly, subject to legal hold requirements

We reserve the right to delete accounts and associated data that have been inactive for an extended period, subject to advance notice where reasonably practicable.

8. International Data Transfers

Data may be processed outside the European Economic Area (EEA). Where international transfers occur, we ensure that appropriate safeguards are in place, including:

• EU Standard Contractual Clauses (SCCs) as approved by the European Commission
• Adequacy decisions issued by the European Commission
• Other equivalent safeguards as recognised under GDPR

9. Your Rights Under GDPR

As a data subject, you have the following rights:

To exercise any of your rights, please contact us at: team@sparkrecall.com. We will respond within one calendar month as required by GDPR Article 12.

10. Security Measures

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, disclosure, alteration, or destruction. These measures include:

• Encrypted data storage
• Access controls and authentication mechanisms
• Regular security assessments
• Staff training on data protection obligations

No method of electronic transmission or storage is 100% secure. Users are advised not to upload sensitive or special category data which they would not wish to be exposed in the event of a security incident.

11. Data Breach Procedures

In the event of a personal data breach, SparkRecall Limited will:

• Promptly assess the nature, scope, and risk of the breach
• Notify the Irish Data Protection Commission (DPC) within 72 hours where the breach is likely to result in a risk to individuals' rights and freedoms, as required by GDPR Article 33
• Notify affected data subjects without undue delay where the breach is likely to result in a high risk to their rights and freedoms, as required by GDPR Article 34
• Maintain an internal record of all breaches in accordance with Article 33(5)

12. Children

The Platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that data from a minor has been collected, we will delete it promptly.

13. Changes to This Policy

We may update this Policy from time to time. Where changes are material, we will notify users via email or a prominent notice on the Platform prior to the changes taking effect. Continued use of the Platform following notification constitutes acceptance of the revised Policy.

14. Contact & Supervisory Authorities