Privacy and Cookie Policy

01Who is responsible for your personal data?

Sparks Consultancy AS is the data controller for the personal data covered by this policy.

Sparks Consultancy AS is established in Norway. We process personal data in accordance with the Norwegian Personal Data Act, which incorporates the General Data Protection Regulation into Norwegian law, the Norwegian Electronic Communications Act and other applicable legislation.

We have not appointed a Data Protection Officer. Questions and requests about personal data should be sent to the privacy contact above.

02When this policy applies

This policy applies when Sparks Consultancy AS decides why and how personal data is used. This includes information about website visitors, prospects, clients, client team members, suppliers, professional contacts and people who engage with our content.

Sometimes we process personal data on behalf of a client, for example when reviewing CRM records, analysing sales calls, building automations or creating AI supported workflows within a client's systems. In those situations, the client normally remains the data controller and Sparks Consultancy AS acts as a data processor. The client's privacy information applies to that processing. We process the data under the client's instructions and the terms of a data processing agreement.

03Personal data we collect

The information we collect depends on how you interact with us.

Information you give us

This may include:

• your name, email address, telephone number and location
• your company name, job title, team information and professional profile
• information you provide in an enquiry, booking form, assessment, survey or application
• information about your sales process, CRM, clients, team, performance, systems and business priorities
• correspondence, meeting notes and records of our communications
• documents, recordings, transcripts or other materials you choose to share
• contract, billing, transaction and payment related information
• your marketing preferences, cookie choices and feedback
• testimonials, case study information, photographs or recordings where you have agreed that we may use them

Information collected when you use the website

Depending on your cookie choices and the services used on the website, we may collect:

• your IP address and approximate location
• browser, device and operating system information
• pages viewed, links selected, referring pages and time spent on the website
• form activity, booking activity and error or security logs
• cookie identifiers and consent records
• information about whether an email was delivered, opened or selected

Information from other sources

We may receive business contact information from:

• a colleague, client, referral partner or mutual contact
• the organisation you work for
• professional networking services such as LinkedIn
• publicly available company websites, directories and business registers
• event organisers, technology platforms or partners where you have asked them to share your details or they are legally permitted to do so

Where we obtain personal data from another source, we will provide privacy information when required by law.

04Why we use personal data and our lawful bases

We only use personal data where we have a lawful basis to do so. The relevant basis depends on the purpose and your relationship with us.

To respond to enquiries and arrange calls

We use contact details, booking information and the content of your enquiry to respond, assess whether our services are suitable and take steps you request before a possible contract.

Lawful bases: taking steps before entering into a contract, and our legitimate interests in responding to business enquiries and developing appropriate client relationships.

To provide services and manage client relationships

We use client contact details, project information, communications and relevant business records to deliver our services, manage projects, provide support, organise meetings, report on progress and maintain the client relationship.

Lawful bases: performance of a contract, and our legitimate interests in managing relationships with corporate clients and their team members.

To manage bookings, contracts, payments and accounts

We use contact, contract, billing and transaction information to issue proposals and invoices, collect payments, maintain financial records and meet tax, accounting and company law requirements.

Lawful bases: performance of a contract, compliance with legal obligations, and our legitimate interests in operating and protecting the business.

To send resources, newsletters and marketing

If you request a resource, join our mailing list or otherwise ask to hear from us, we use your contact details and preferences to send the requested material and relevant business updates.

We rely on consent where consent is required. In limited business to business situations, we may rely on our legitimate interests where electronic marketing law permits this and where your rights do not override those interests. Every marketing email will provide a simple way to unsubscribe. You may object to direct marketing at any time.

Withdrawing consent or unsubscribing does not affect the lawfulness of earlier processing. We may retain a minimal suppression record so that we can respect your choice.

To improve the website, services and communications

We use website data, feedback, email engagement and aggregated business information to understand what is useful, diagnose problems, improve the website, refine our services and measure the effectiveness of our communications.

Lawful bases: consent, for nonessential cookies and similar tracking technologies. For service improvement that does not rely on consent based tracking, our legitimate interests in improving and developing the business.

To protect the business, systems and people

We may use technical logs, communications and other relevant information to maintain security, prevent misuse and fraud, enforce agreements, manage disputes and establish, exercise or defend legal claims.

Lawful bases: our legitimate interests in protecting the business, our clients and our systems, and compliance with legal obligations.

To comply with law and respond to authorities

We may use or disclose personal data where this is necessary to comply with a legal or regulatory obligation, a court order or a lawful request from an authority.

Lawful bases: compliance with a legal obligation. In some circumstances, we may also rely on our legitimate interests in establishing, exercising or defending legal claims.

To publish testimonials and case studies

We only publish an identifiable testimonial, photograph, recording or case study with your approval. We will agree what may be published and where it may appear.

Lawful bases: normally consent. Where an organisation approves a business case study, we may also rely on our legitimate interests, but we will not publish personal comments or identifiable personal information without appropriate permission.

05AI, automation and call analysis

Sparks Consultancy AS uses automation and may use AI enabled business tools to support activities such as:

• preparing for meetings
• transcribing or summarising calls
• analysing sales conversations and identifying patterns
• drafting follow up actions or working documents
• organising CRM information
• improving internal administration and reporting
• building or testing client approved agents, skills and workflows

The lawful basis for AI assisted processing is the same as the underlying business purpose described in this policy. We aim to use only the information needed for the task, apply access controls and review outputs before relying on them.

We will tell participants if we intend to record or transcribe a call or meeting and will obtain permission where required. We do not use personal data to make decisions that produce legal or similarly significant effects based solely on automated processing. A person remains responsible for business decisions and material recommendations.

We do not deliberately use client or prospect information to train our own general purpose AI model. Where external AI or transcription providers process personal data for us, we assess the service, use appropriate contractual protections and apply business settings designed to limit the provider's use of that information.

06Cookies and similar technologies

Cookies are small files stored on your device. Similar technologies may include pixels, tags, local storage and scripts.

We may use the following categories:

• Strictly necessary cookies. These support security, network management, accessibility, forms, consent preferences and other functions required for the website to work. They do not require consent where the legal exemption applies.
• Preference and functionality cookies. These remember choices and provide enhanced website features.
• Analytics cookies. These help us understand how people use the website and where improvements are needed.
• Marketing and embedded content cookies. These may measure campaigns, support relevant advertising or allow content from services such as video or social media platforms to work.

You can change or withdraw your choices at any time through the Cookie settings link on the website. The cookie settings panel provides the current details of individual cookies, their provider, purpose and duration. You can also delete cookies through your browser, although this will not replace the need to use the website consent controls for future visits.

Some embedded content is provided by third parties. If you activate that content, the third party may receive information about your device and use its own cookies. Its privacy policy will apply to its independent processing.

07Who we share personal data with

We share personal data only where it is necessary for a defined purpose.

Depending on how you interact with us, recipients may include:

• website hosting, content management, security and technical support providers
• CRM, enquiry form, assessment, booking, workflow, email and communications providers
• cloud storage, document, email, video meeting and collaboration providers
• payment, banking, accounting and bookkeeping providers
• analytics, cookie consent and website performance providers
• AI, transcription, automation and reporting providers
• professional advisers, insurers, auditors and carefully selected subcontractors
• a client where the information relates to work we carry out for that client
• courts, regulators, tax authorities, law enforcement or other public authorities where disclosure is legally required
• a prospective buyer, investor or adviser if the business is reorganised, sold or transferred, subject to appropriate confidentiality safeguards
• another party where you have asked us to share the information or have clearly agreed to it

Service providers that process personal data for us are required to protect it, keep it confidential and use it only for the agreed service. Some providers act as independent controllers for their own legal or operational purposes, for example banks, payment providers and professional advisers. Their own privacy information applies to that processing.

We do not sell, rent or trade personal data.

08International transfers

Some technology and professional service providers may store or access personal data outside Norway or the European Economic Area, including in the United Kingdom or the United States.

Where personal data is transferred outside the European Economic Area, we use a lawful transfer mechanism. This may include:

• a European Commission adequacy decision
• the EU Standard Contractual Clauses and, where needed, supplementary safeguards
• another transfer mechanism permitted by Chapter V of the GDPR

For transfers to participating organisations in the United States, a provider may rely on the EU US Data Privacy Framework where applicable. You may contact us for more information about the safeguards relevant to your personal data.

09How long we keep personal data

We keep personal data only for as long as it is needed for the purpose for which it was collected, including legal, accounting, security and dispute requirements.

Our usual retention periods are:

• Enquiries and prospective client records: up to 24 months after the last meaningful contact, unless discussions continue or there is a reason to keep the information longer
• Mailing list records: until you unsubscribe, withdraw consent or the service ends, with a minimal suppression record retained where needed to respect your choice
• Client relationship and project records: for the duration of the engagement and normally for up to 3 years afterwards
• Contracts, invoices and accounting records: for the period required by Norwegian accounting, tax and company law, which will commonly be at least 5 years after the end of the relevant financial year
• Call or meeting recordings and transcripts: normally for up to 90 days, unless a longer period is agreed, required for the service or needed for a legal reason
• Website security and technical logs: normally for up to 12 months, unless an incident requires longer retention
• Cookie data: for the period shown in the cookie settings panel
• Complaints, rights requests and legal matters: for as long as needed to resolve the matter and normally for up to 3 years afterwards

We may keep information for longer where the law requires it, where there is an ongoing dispute or claim, or where you have asked us to retain it for an agreed purpose. Data held in backups may remain for a limited period until the backup is securely overwritten or deleted.

When personal data is no longer required, we delete it, anonymise it or securely put it beyond use.

10How we protect personal data

We use appropriate technical and organisational measures based on the nature of the information and the risks involved. These may include access controls, multifactor authentication, encryption in transit, secure cloud services, device protection, backups, confidentiality obligations, supplier reviews and incident response procedures.

Access is limited to people and providers who need the information for an authorised purpose. No method of storage or transmission is completely risk free, but we review our safeguards and update them where appropriate.

11Your rights

Depending on the circumstances, you have the right to:

• be informed about how your personal data is used
• request access to your personal data and receive a copy
• ask us to correct inaccurate or incomplete information
• ask us to delete personal data where there is no lawful reason to keep it
• ask us to restrict how personal data is used
• receive certain personal data in a structured, commonly used and machine readable format and ask for it to be transferred where technically feasible
• object to processing based on legitimate interests
• object to direct marketing at any time
• withdraw consent at any time where processing is based on consent
• ask for human involvement where a decision with legal or similarly significant effects is based solely on automated processing
• complain to a data protection authority

These rights are not absolute. For example, we may need to keep information to comply with law or to establish, exercise or defend a legal claim.

To exercise a right, email sales@sparksconsultancy.com. Please describe your request and the information concerned. We may ask for information to confirm your identity. We normally respond within one month and do not charge a fee, although the law allows a reasonable fee or refusal where a request is manifestly unfounded or excessive.

12Complaints

Please contact us first if you have a concern. We will try to resolve it.

You also have the right to complain to the Norwegian Data Protection Authority:

If you live or work elsewhere in the European Economic Area, you may also contact the data protection authority in that country.

13Children

Our website and services are intended for business users and are not directed at children. We do not knowingly collect personal data from anyone under 18 through the website. If you believe a child has provided personal data to us, please contact us so that we can review and delete it where appropriate.

14Third party websites and social media

Our website may link to external websites or social media services. We do not control how those organisations use personal data. Please read their privacy information before providing information or activating embedded content.

When you interact with us on a social media platform, Sparks Consultancy AS and the platform may each process information for their own purposes. The platform's privacy terms also apply.

15Changes to this policy

We may update this policy when our services, technology, suppliers or legal obligations change. The latest version will be published on the website with a revised date.

If a change materially affects how we use personal data, we will take reasonable steps to draw attention to it and seek fresh consent where required.

16Contact

For questions, requests or concerns about this policy or the way we use personal data, contact: