Privacy Policy

1. Who We Are and Our Role

Scale Spark Revenue Pty Ltd is the responsible party (under POPIA) and data controller (under GDPR/UK GDPR) in respect of personal information collected through this Site and our services.

We are a Go-to-Market (GTM) services company operating across North America, the United Kingdom, and Africa, providing Revenue Operations, Lead Generation, Sales, and Marketing services to SaaS and AI companies.

Contact details for data-related matters:

2. Information We Collect

We may collect the following categories of personal information:

3. Lawful Basis for Processing (GDPR / UK GDPR)

Under the GDPR and UK GDPR, we are required to have a lawful basis for processing your personal data. We rely on the following bases:

• Consent: Where you have freely given, specific, informed, and unambiguous consent — for example, when signing up for marketing communications or accepting non-essential cookies
• Legitimate interests: Where processing is necessary for our legitimate business interests, including improving our website, running advertising campaigns, and responding to business enquiries, provided these interests are not overridden by your rights and freedoms
• Contract: Where processing is necessary to fulfil a contract with you or take pre-contractual steps at your request
• Legal obligation: Where we are required to process data to comply with a legal or regulatory obligation

You have the right to withdraw consent at any time where consent is the lawful basis, without affecting the lawfulness of processing before withdrawal.

4. Grounds for Processing Under POPIA (South Africa)

Under POPIA, we process personal information only when a lawful ground exists. We rely on the following conditions for lawful processing:

• Consent of the data subject: Where you have provided voluntary, specific, and informed consent
• Legitimate interest: Where processing is necessary to pursue our legitimate interests or those of a third party, provided such interests are not overridden by your right to privacy
• Contractual necessity: Where processing is necessary to fulfil a contract with you or to take steps at your request prior to entering into a contract
• Legal obligation: Where processing is required to comply with a legal obligation applicable to us

We are committed to the eight conditions for lawful processing under POPIA:

• (i) Accountability — we take responsibility for all personal information we process
• (ii) Processing limitation — we collect only what is adequate, relevant, and not excessive
• (iii) Purpose specification — we collect personal information for specific, explicitly defined, and lawful purposes
• (iv) Further processing limitation — we do not process personal information in a manner incompatible with the purpose of collection
• (v) Information quality — we take reasonable steps to ensure personal information is accurate, complete, and up to date
• (vi) Openness — we maintain this Privacy Policy and notify data subjects appropriately
• (vii) Security safeguards — we implement reasonable technical and organisational measures to protect personal information
• (viii) Data subject participation — we honour your rights to access, correct, and delete your personal information

5. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your enquiries and provide our GTM services
• To send relevant communications, updates, and marketing materials (where you have opted in)
• To improve and optimise our website, content, and user experience
• To run, target, and measure the performance of advertising campaigns on LinkedIn, Google, and Meta
• To build custom and lookalike audiences for advertising on third-party platforms
• To comply with legal and regulatory obligations under POPIA, GDPR, UK GDPR, CCPA, and any other applicable law
• To detect, prevent, and address fraud or security incidents

We do not sell, rent, or trade your personal information to third parties.

6. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience and support our advertising activities.

Types of cookies we use:

• Essential cookies: Necessary for the Site to function and cannot be disabled
• Analytics cookies: Used to understand how visitors interact with our Site (e.g. Google Analytics)
• Advertising cookies: Used to deliver relevant ads and measure campaign performance via Google Ads, Meta Pixel, and LinkedIn Insight Tag

Under GDPR and UK GDPR, we obtain your consent before placing non-essential cookies. Under POPIA, we inform you of cookies and provide you with choices. You may withdraw cookie consent at any time through your browser settings or our cookie preference tool.

Disabling certain cookies may affect the functionality of parts of the Site.

7. LinkedIn Insight Tag

Our Site uses the LinkedIn Insight Tag to enable campaign reporting and retargeting on LinkedIn. It collects data including URL, referrer URL, IP address (truncated), device and browser properties, and timestamp. This data is encrypted, anonymised within seven days, and de-identified within 90 days. LinkedIn does not share personal data with us; it provides only aggregated reports.

Opt out of LinkedIn tracking: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

8. Meta Pixel (Facebook / Instagram)

We use the Meta Pixel to measure advertising effectiveness, build audiences, and deliver relevant ads on Facebook and Instagram. The Meta Pixel may collect your IP address, browser information, and actions taken on our Site (such as page views and form submissions).

Manage Meta ad preferences: https://www.facebook.com/ads/preferences

9. Google Ads & Google Analytics

We use Google Analytics to analyse Site traffic and Google Ads for paid advertising. IP anonymisation is enabled on Google Analytics. Google may use cookies and tracking technologies to collect visit data.

• Opt out of Google Analytics: https://tools.google.com/dlpage/gaoptout
• Manage Google ad personalisation: https://adssettings.google.com

10. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your information only in the following circumstances:

• Service providers: Trusted third parties who assist in operating our website and delivering services (including CRM platforms, email marketing tools, and analytics providers), bound by written data processing agreements and confidentiality obligations consistent with GDPR, UK GDPR, and POPIA requirements
• Advertising platforms: Data shared with LinkedIn, Meta, and Google for advertising purposes is governed by their respective privacy policies and applicable data processing agreements
• Legal requirements: Where required by applicable law, court order, or governmental or regulatory authority — including obligations under POPIA, GDPR, UK GDPR, or equivalent legislation
• Business transfers: In connection with a merger, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality and data protection protections

Where we engage third-party processors, we ensure they process personal information only on our documented instructions and implement appropriate security measures.

11. International Data Transfers

Scale Spark Revenue operates across North America, the United Kingdom, and Africa. Your personal information may be transferred to and processed in countries outside your country of residence.

Under GDPR and UK GDPR: Where data is transferred outside the EEA or UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission or UK Information Commissioner's Office (ICO), or we transfer data only to countries deemed to provide adequate protection.

Under POPIA: We will not transfer personal information to a foreign country unless that country has adequate data protection laws in place, or the recipient is bound by binding corporate rules, contractual obligations, or consent has been obtained from the data subject.

12. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

• Contact and enquiry data: retained for up to 24 months
• Client and contract data: retained for the duration of the engagement plus 5 years, or as required by law
• Marketing consent records: retained for the duration of consent plus 3 years

Upon expiry of the applicable retention period, personal information is securely deleted or anonymised. You may request earlier deletion by contacting us (see Section 16).

13. Security Safeguards

We implement reasonable and appropriate technical and organisational security measures to protect your personal information against unauthorised access, disclosure, alteration, loss, or destruction. These include:

• Encrypted data transmission (SSL/TLS)
• Access controls and authentication measures
• Regular security assessments
• Confidentiality obligations on staff and third-party processors

In the event of a personal information breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected data subjects in accordance with our obligations under POPIA (Section 22), GDPR (Article 33/34), and UK GDPR.

14. Your Rights as a Data Subject

Depending on your location, you have the following rights regarding your personal information. We will respond to all verified requests within the timeframes required by applicable law (generally 30 days under GDPR; 30 days under POPIA).

Rights under GDPR and UK GDPR (EEA and UK residents):

• Right to be informed: To know how your data is collected and used
• Right of access: To obtain a copy of the personal data we hold about you (Article 15)
• Right to rectification: To request correction of inaccurate or incomplete data (Article 16)
• Right to erasure: To request deletion of your personal data where certain grounds apply ("right to be forgotten") (Article 17)
• Right to restrict processing: To request that we limit how we use your data (Article 18)
• Right to data portability: To receive your data in a structured, machine-readable format (Article 20)
• Right to object: To object to processing based on legitimate interests or for direct marketing purposes (Article 21)
• Rights related to automated decision-making: Not to be subject to decisions based solely on automated processing that significantly affect you (Article 22)

Rights under POPIA (South African residents):

• Right to be notified: To be informed when your personal information is being collected (Section 18)
• Right of access: To request access to your personal information held by us (Section 23)
• Right to correction or deletion: To request correction, destruction, or deletion of inaccurate, irrelevant, excessive, or outdated personal information (Section 24)
• Right to object: To object on reasonable grounds to the processing of your personal information (Section 11(3))
• Right to lodge a complaint: With the Information Regulator of South Africa at inforeg.org.za

Rights under CCPA (California residents):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information held by businesses
• Right to opt out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your privacy rights

To exercise any of the above rights, please contact us using the details in Section 16. We may need to verify your identity before processing your request.

15. Information Regulator and Supervisory Authority Contacts

South Africa — Information Regulator (POPIA):

• Website: https://www.inforeg.org.za
• Email: inforeg@justice.gov.za

European Union — Your local EU Data Protection Authority (GDPR):

Full list available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

United Kingdom — Information Commissioner's Office (UK GDPR):

• Website: https://ico.org.uk
• Helpline: 0303 123 1113

You have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction at any time.

16. Contact Us and Data Subject Requests

For any questions, requests, or concerns regarding this Privacy Policy, or to exercise your rights as a data subject, please contact us:

We aim to respond to all data subject requests within 30 days. In complex cases, this may be extended by a further two months, and we will notify you accordingly.

17. Children's Privacy

Our Site and services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it without delay.

18. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies independently before providing any personal information.

19. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, services, or applicable law. The "Last updated" date at the top of this page reflects the most recent revision. Where changes are material, we will take reasonable steps to notify you. Continued use of the Site after updated terms are posted constitutes acceptance of the revised policy.