Sparkforge Data Privacy and GDPR Compliance

By Sparkforge Support Team ·Last reviewed May 3, 2026

Sparkforge is a GDPR data processor and is certified under the EU Data Privacy Framework. You are the controller of any personal data you upload — you pick the legal basis, we process it under your instructions.

Sparkforge is certified under the EU Data Privacy Framework and operates as a data processor for every customer. This article explains what that means for the data you upload, who is responsible for what, and how we comply with GDPR and UK GDPR.

Documents you should review

Sparkforge's Privacy Guide for Customers
Sparkforge's Security and Compliance Overview
Privacy Policy
Data Processing Agreement
Sub-Processors list
Data Deletion Requests

Read these alongside our Privacy Policy. For specific compliance advice, talk to a qualified legal professional.

What GDPR is

The General Data Protection Regulation (Regulation (EU) 2016/679) is an EU regulation harmonizing data protection law. It applies whenever personal data of an EU data subject is processed, anywhere in the world. After Brexit, the UK adopted the same rules as UK GDPR — UK businesses still comply.

Controller vs processor

GDPR splits responsibility between two roles:

Controller: decides why and how personal data is processed. Picks the legal basis. Holds the obligations toward data subjects.
Processor: handles data on behalf of the controller, only under controller instructions, makes no independent decisions.

When you use Sparkforge, you are the controller. You decide what data to collect and why. Sparkforge is the processor — we store and process under your instructions, never for our own purposes.

Legal basis for processing

You can only collect and process personal data when you have a valid legal basis (consent, contract, legitimate interest, etc.). Sparkforge relies on you to pick the right basis, post the right notices, and keep retention proportional. Do not change the basis without strong reason — pick correctly up front.

Data subject access rights

GDPR gives data subjects rights over their data, including access, correction, and deletion. Sparkforge has a process for you to inform us of such requests and for us to inform you if we receive one directly. We comply with the request promptly under your instructions.

Transfers to the USA

Personal data transfers outside the EEA require specific safeguards. Sparkforge uses the Standard Contractual Clauses inside the Data Processing Agreement we sign with every customer.

Data security

Strong security safeguards on stored personal data.
Regular bug and vulnerability testing.
Backup, recovery, and integrity systems to prevent loss or corruption.

Steps Sparkforge takes for GDPR compliance

Standard Contractual Clauses in the DPA covering lawful US transfers.
Detection and notification process for personal data breaches.
Process for handling subject access and erasure requests.
Documented assessment of personal data processed on customers' behalf.
Security review and upgrade cadence sized to current breach risk.

Frequently Asked Questions

Is Sparkforge a controller or a processor under GDPR?

Sparkforge is a processor. You are the controller of any personal data you upload — you pick the legal basis, we process it under your instructions.

Does GDPR apply to me if I am based in the US?

If you process personal data of EU data subjects, yes. GDPR follows the data subject, not your business location. UK GDPR works the same way for UK data subjects.

How does Sparkforge handle EU-to-US data transfers?

Sparkforge uses the Standard Contractual Clauses, signed inside the Data Processing Agreement we execute with every customer. We are also certified under the EU Data Privacy Framework.

What do I do when a data subject asks for their data?

Use the in-platform process to log the request and respond. If a data subject contacts Sparkforge directly, we notify you and act under your instructions.

Where is Sparkforge's Data Processing Agreement?

It is published alongside the Privacy Policy and Sub-Processors list in our compliance documentation. Review it before you upload personal data of EU or UK data subjects.