Privacy Policy

1. Who We Are and Our Role

Scale Spark Revenue (Pty) Ltd is the responsible party (under POPIA) and data controller (under GDPR/UK GDPR) in respect of personal information collected through this Site and our services.

We are a Go-to-Market (GTM) services company operating across North America, the UK and South Africa, providing Revenue Operations, Lead Generation, Sales, and Marketing services to companies scaling up their go-to-market efforts.

Registration number: 2026/254573/07
Registered address: 24 Lourier Street, Southfield, Cape Town, South Africa, 7880

Contact details for data-related matters:

2. Information We Collect

We may collect the following categories of personal information:

2A. Information About Business Prospects

As part of our own business development, and when running outbound campaigns on behalf of clients, we process business contact data about professionals: name, job title, employer, business email address, business phone, LinkedIn profile URL and company information.

• Sources: publicly available professional profiles, company websites, and reputable B2B data and enrichment providers.
• Lawful basis: legitimate interests (GDPR/UK GDPR Art. 6(1)(f)) for relevant B2B communications. We only contact corporate business addresses, never personal addresses. Under PECR we do not send unsolicited marketing to individual subscribers (including sole traders and some partnerships) without consent. Under POPIA section 69 we only send electronic direct marketing where the law permits it.
• Opting out: every message includes a simple opt-out. Opt-outs are added to a permanent suppression list honoured across all our sending domains and client campaigns.
• Retention: prospect data that doesn't result in a business relationship is deleted or anonymised within 12 months of last contact. Suppression entries are kept indefinitely, only so that we never contact that person again.
• Your requests: prospects can request the source of their data, access, correction or deletion at info@scalesparkrevenue.co.za.

2B. Our Role When Working for Clients

When we run campaigns, CRM or email infrastructure for a client, the client is usually the controller (GDPR/UK GDPR) or responsible party (POPIA), and we act as their processor or operator under a written data processing agreement. For our own marketing, we are the controller.

2C. AI Chat Assistant

Messages typed into the Spark chat widget are sent to a third-party AI model provider to generate replies and are not used for marketing. Please do not enter sensitive information. Chat logs are retained for no more than 90 days.

3. Lawful Basis for Processing (GDPR / UK GDPR)

Under the GDPR and UK GDPR, we are required to have a lawful basis for processing your personal data. We rely on the following bases:

• Consent: Where you have freely given, specific, informed, and unambiguous consent — for example, when signing up for marketing communications or accepting non-essential cookies
• Legitimate interests: Where processing is necessary for our legitimate business interests, including improving our website, measuring our advertising, and responding to business enquiries, provided these interests are not overridden by your rights and freedoms
• Contract: Where processing is necessary to fulfil a contract with you or take pre-contractual steps at your request
• Legal obligation: Where we are required to process data to comply with a legal or regulatory obligation

You have the right to withdraw consent at any time where consent is the lawful basis, without affecting the lawfulness of processing before withdrawal.

4. Grounds for Processing Under POPIA (South Africa)

Under POPIA, we process personal information only when a lawful ground exists. We rely on the following conditions for lawful processing:

• Consent of the data subject: Where you have provided voluntary, specific, and informed consent
• Legitimate interest: Where processing is necessary to pursue our legitimate interests or those of a third party, provided such interests are not overridden by your right to privacy
• Contractual necessity: Where processing is necessary to fulfil a contract with you or to take steps at your request prior to entering into a contract
• Legal obligation: Where processing is required to comply with a legal obligation applicable to us

We are committed to the eight conditions for lawful processing under POPIA:

• (i) Accountability — we take responsibility for all personal information we process
• (ii) Processing limitation — we collect only what is adequate, relevant, and not excessive
• (iii) Purpose specification — we collect personal information for specific, explicitly defined, and lawful purposes
• (iv) Further processing limitation — we do not process personal information in a manner incompatible with the purpose of collection
• (v) Information quality — we take reasonable steps to ensure personal information is accurate, complete, and up to date
• (vi) Openness — we maintain this Privacy Policy and notify data subjects appropriately
• (vii) Security safeguards — we implement reasonable technical and organisational measures to protect personal information
• (viii) Data subject participation — we honour your rights to access, correct, and delete your personal information

5. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your enquiries and provide our GTM services
• To send relevant communications, updates, and marketing materials (where you have opted in)
• To improve and optimise our website, content, and user experience
• To measure the performance of our LinkedIn advertising (only with your Marketing cookie consent)
• To comply with legal and regulatory obligations under POPIA, GDPR, UK GDPR, CCPA, and any other applicable law
• To detect, prevent, and address fraud or security incidents

We do not sell, rent, or trade your personal information to third parties.

Job applicants

If you apply for a role with us, we use your CV and application details only to assess your application. We delete them after 12 months unless you agree to us keeping them for longer.

6. Cookies and Tracking Technologies

By default we use only strictly necessary storage and basic, privacy-friendly visitor statistics from our hosting provider. Non-essential cookies (Google Analytics and the LinkedIn Insight Tag) load only after you give consent through our cookie banner; until then they are not loaded at all. You can accept or reject each category, and change or withdraw your consent at any time via "Cookie settings" in the footer of every page. Your choice is stored for 12 months, after which we ask again.

7. LinkedIn Insight Tag

With your Marketing consent, our Site uses the LinkedIn Insight Tag for campaign reporting on LinkedIn. It collects data including URL, referrer URL, IP address (truncated), device and browser properties, and timestamp. LinkedIn provides us with aggregated reports only.

Opt out of LinkedIn tracking: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out

8. Google Analytics

With your Analytics consent, we use Google Analytics to understand Site traffic. We use Google Consent Mode, so advertising signals stay denied unless you accept Marketing cookies.

Opt out of Google Analytics: https://tools.google.com/dlpage/gaoptout

9. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your information only in the following circumstances:

• Service providers, bound by written data processing agreements and confidentiality obligations:
  • Hosting and database: Supabase
  • CRM: Attio
  • Meeting scheduling: Calendly
  • Analytics: Google Analytics (with consent)
  • Advertising measurement: LinkedIn (with consent)
  • AI model provider (chat assistant)
  • Email sending and outbound platforms
  • Data enrichment providers
• Legal requirements: Where required by applicable law, court order, or governmental or regulatory authority — including obligations under POPIA, GDPR, UK GDPR, or equivalent legislation
• Business transfers: In connection with a merger, acquisition, restructuring, or sale of assets, subject to appropriate confidentiality and data protection protections

Where we engage third-party processors, we ensure they process personal information only on our documented instructions and implement appropriate security measures.

10. International Data Transfers

Scale Spark Revenue operates across North America, the UK and South Africa. Your personal information may be transferred to and processed in countries outside your country of residence.

Under GDPR and UK GDPR: Where data is transferred outside the EEA or UK, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) approved by the European Commission or UK Information Commissioner's Office (ICO), or we transfer data only to countries deemed to provide adequate protection.

Under POPIA: We will not transfer personal information to a foreign country unless that country has adequate data protection laws in place, or the recipient is bound by binding corporate rules, contractual obligations, or consent has been obtained from the data subject.

11. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law.

• Contact and enquiry data: retained for up to 24 months
• Client and contract data: retained for the duration of the engagement plus 5 years, or as required by law
• Marketing consent records: retained for the duration of consent plus 3 years

Upon expiry of the applicable retention period, personal information is securely deleted or anonymised. You may request earlier deletion by contacting us (see Section 15).

12. Security Safeguards

We implement reasonable and appropriate technical and organisational security measures to protect your personal information against unauthorised access, disclosure, alteration, loss, or destruction. These include:

• Encrypted data transmission (SSL/TLS)
• Access controls and authentication measures
• Regular security assessments
• Confidentiality obligations on staff and third-party processors

In the event of a personal information breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected data subjects in accordance with our obligations under POPIA (Section 22), GDPR (Article 33/34), and UK GDPR.

13. Your Rights as a Data Subject

Depending on your location, you have the following rights regarding your personal information. We will respond to all verified requests within the timeframes required by applicable law (generally 30 days under GDPR; 30 days under POPIA).

Rights under GDPR and UK GDPR (EEA and UK residents):

• Right to be informed: To know how your data is collected and used
• Right of access: To obtain a copy of the personal data we hold about you (Article 15)
• Right to rectification: To request correction of inaccurate or incomplete data (Article 16)
• Right to erasure: To request deletion of your personal data where certain grounds apply ("right to be forgotten") (Article 17)
• Right to restrict processing: To request that we limit how we use your data (Article 18)
• Right to data portability: To receive your data in a structured, machine-readable format (Article 20)
• Right to object: To object to processing based on legitimate interests or for direct marketing purposes (Article 21)
• Rights related to automated decision-making: Not to be subject to decisions based solely on automated processing that significantly affect you (Article 22)

Rights under POPIA (South African residents):

• Right to be notified: To be informed when your personal information is being collected (Section 18)
• Right of access: To request access to your personal information held by us (Section 23)
• Right to correction or deletion: To request correction, destruction, or deletion of inaccurate, irrelevant, excessive, or outdated personal information (Section 24)
• Right to object: To object on reasonable grounds to the processing of your personal information (Section 11(3))
• Right to lodge a complaint: With the Information Regulator of South Africa at inforegulator.org.za

Rights under CCPA (California residents):

• Right to know what personal information is collected, used, shared, or sold
• Right to delete personal information held by businesses
• Right to opt out of the sale of personal information (we do not sell personal information)
• Right to non-discrimination for exercising your privacy rights

To exercise any of the above rights, please contact us using the details in Section 15. We may need to verify your identity before processing your request.

14. Information Regulator and Supervisory Authority Contacts

South Africa — Information Regulator (POPIA):

• Website: https://inforegulator.org.za
• Email: enquiries@inforegulator.org.za
• Complaints: POPIAComplaints@inforegulator.org.za

European Union — Your local EU Data Protection Authority (GDPR):

Full list available at: https://edpb.europa.eu/about-edpb/about-edpb/members_en

United Kingdom — Information Commissioner's Office (UK GDPR):

• Website: https://ico.org.uk
• Helpline: 0303 123 1113

You have the right to lodge a complaint with the relevant supervisory authority in your jurisdiction at any time.

15. Contact Us and Data Subject Requests

For any questions, requests, or concerns regarding this Privacy Policy, or to exercise your rights as a data subject, please contact us:

We aim to respond to all data subject requests within 30 days. In complex cases, this may be extended by a further two months, and we will notify you accordingly.

16. Children's Privacy

Our Site and services are not directed at individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, please contact us immediately and we will delete it without delay.

17. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices of those websites and encourage you to review their privacy policies independently before providing any personal information.

18. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, services, or applicable law. The "Last updated" date at the top of this page reflects the most recent revision. Where changes are material, we will take reasonable steps to notify you.