ARShades Solutions </br> Last updated: 16 July 2026
Pursuant to Regulation (EU) 2016/679 (“GDPR”), the UK GDPR, the California Consumer Privacy Act (“CCPA”) and its amendments, including the California Privacy Rights Act (“CPRA”), other U.S. state privacy laws, including the Virginia Consumer Data Protection Act (“VCDPA”), the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Utah Consumer Privacy Act (“UCPA”), the Montana Consumer Data Privacy Act (“MCDPA”), the Oregon Consumer Privacy Act (“OCPA”), as well as further applicable U.S. state privacy laws, the Illinois Biometric Information Privacy Act (“BIPA”), the Texas Capture or Use of Biometric Identifier Act (“CUBI”), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), the Australian Privacy Act, Brazil’s Lei Geral de Proteção de Dados (“LGPD”), Switzerland’s Federal Act on Data Protection (“FADP”), Japan’s Act on the Protection of Personal Information (“APPI”), China’s Personal Information Protection Law (“PIPL”), South Africa’s Protection of Personal Information Act (“POPIA”), India’s Digital Personal Data Protection Act (“DPDP”), the United Arab Emirates’ DIFC Data Protection Law, the Saudi Personal Data Protection Law (“PDPL”), the New Zealand Privacy Act 2020, the Singapore Personal Data Protection Act (“PDPA”), the Philippines Data Privacy Act (“DPA”), the Malaysia Personal Data Protection Act (“PDPA”) and other applicable international data-protection laws, collectively referred to as the “International Privacy Laws”.
Spaarkly s.r.l. (“Spaarkly”, “we”, “us” or “our”), a company registered in Italy with registered office at Via della Tecnica n. 18, 85100 Potenza (Italy), email: privacy@spaarkly.com, acting as data controller, provides this Privacy Policy (“PP”) concerning the processing of the personal data of users (“you” or “User”) who access or interact with the ARSHADES Technology available globally, including:
This Privacy Policy is based on the GDPR as its principal legal framework, supplemented by the specific requirements of the laws of the countries in which we offer our services. Where regulatory differences arise, they are set out in the Regulatory Addenda appended to this document.
We encourage Users to read carefully both the main body of this Policy and the Addendum applicable to their geographical area, in order to fully understand their rights and the local specifics relating to the processing of their data.
Spaarkly s.r.l. (“Spaarkly”, “we”, “us” or “our”), a company registered in Italy, is the owner of the ARSHADES Technology, the ARSHADES trademark and other Augmented Reality (AR) solutions for eyewear applications used in this web or mobile application under the name ARShades.
We act as data controller under applicable data-protection laws, including the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the California Consumer Privacy Act (“CCPA”), Canada’s Personal Information Protection and Electronic Documents Act (“PIPEDA”), the Australian Privacy Act, the UK GDPR and other international laws. This Privacy Policy provides information on how we collect, use and process the personal data of users (“you” or “User”) who access or interact with our ARSHADES technology (“VTO”, “Web VTO”, “Web or Mobile Application”, “App”, “Applications and Services”), available globally.
For the purposes of this Privacy Policy, the following definitions apply:
ARShades offers Augmented Reality (AR) solutions for the virtual try-on of eyewear, usable on personal devices such as computers, smartphones and tablets.
We process the User’s personal data in order to provide a virtual try-on experience, enabling users to try different eyewear shapes and sizes on websites and mobile applications. The ultimate objective is to offer frame recommendations based on the User’s facial features, allowing the User to see how particular models might fit their face.
The legal basis for such processing is:
Such consent may be given by the data subject by ticking the relevant box at the end of this Privacy Policy.
Failure to give consent, where required, may prevent access to certain features of the Services.
Some ARShades solutions, including the VTO Mirror, are installed on devices such as digital kiosks and virtual mirrors located in points of sale, event venues or other places accessible to the public, in order to enable the virtual try-on of eyewear.
Some versions of ARShades Mirror, including showroom-oriented configurations such as Mirror Showroom, may include the VTO Explorer module. In such cases, the same principles described for VTO Explorer apply: the images captured for personalisation and augmented-catalogue generation are processed locally on the device used for the experience and are not automatically uploaded to Spaarkly’s servers.
Here too, the ultimate objective is to offer frame recommendations based on the User’s facial features, allowing the User to see how particular models would appear on their face.
The legal basis for the processing is:
ARShades technology uses computer vision to detect faces and estimate measurements without creating or storing facial templates.
ARShades uses facial-measurement software for the Virtual Try-On and AR PD Meter services. A 3D facial mesh is generated through the camera. For the Virtual Try-On, eyewear placement and rendering take place locally on the device. For AR PD Meter, the derived technical data required to calculate the pupillary distance may be temporarily transmitted to the ARShades backend located in the European Union, solely to return the measurement result. In ARShades Mirror experiences, such processing takes place on the device’s local backend, without transmission to cloud servers, and the data is deleted after processing.
Where an ARShades experience includes the VTO Explorer module, the system may ask the User to capture a limited number of images during the session. Such images are used as a stable visual reference to generate realistic previews of multiple eyewear products in the catalogue. The system may apply facial-landmark detection, adaptive facial masks, segmentation of facial areas such as skin, hair and ears, as well as local rendering techniques, in order to position the eyewear correctly and produce realistic previews.
Such processing is carried out locally on the User’s device or on the device used for the experience. The images captured for personalisation and catalogue generation are not automatically uploaded to Spaarkly’s servers, are not used for facial recognition and are not used to create a biometric identifier or a persistent facial template.
We do not carry out any unique identification of the User based on the facial mesh; the data is used solely to virtually position the eyewear and to provide recommendations based on facial features.
Unlike biometric technologies that create unique identifiers linked to individuals, our system:
To use these features, the User must grant the necessary permissions for access to the camera (“Cam”) and to other hardware components—for example, the TrueDepth camera or the Depth API—and must have a compatible version of the operating system installed on their device to support the Augmented Reality experiences.
The User may refuse such permissions, but doing so will make it impossible to use the service.
Such data is collected locally on the User’s device, save as indicated for the AR PD Meter calculation, and is used solely in anonymous or aggregated form for development purposes and to gather statistical information on the use of ARShades.
The browser or the mobile operating system independently requests access to the camera through a pop-up. Users must grant permission before the ARShades experience can operate.
Users may withdraw consent at any time by disabling camera access in their browser or device settings.
The system calculates the following facial dimensions in real time:
Such measurements are processed instantly and locally for the Virtual Try-On. In the case of AR PD Meter, the derived technical data required to calculate the pupillary distance may be temporarily transmitted to the ARShades backend located in the European Union, solely to calculate and return the measurement result. It is not stored as a unique identifier, is not used for facial recognition and is discarded after processing. Any technical or session data retained for security, analytics, abuse prevention or service improvement is retained for a maximum of 14 months and thereafter aggregated or anonymised.
We may collect, in anonymised and non-traceable form, information such as approximate gender and age range, solely for the purpose of providing eyewear recommendations, verifying minimum-age requirements, generating anonymous statistics and improving the user experience. In any event, we will expressly inform the User of this possibility and will proceed only after obtaining their specific authorisation.
Some ARShades experiences, such as ARShades Mirror, may include a local artificial-intelligence module—using open-source AI technology run directly on the device—for anonymous statistical and analytical purposes relating to the use, performance and improvement of the ARShades services.
Such module may automatically estimate certain general characteristics of the person interacting with the experience, such as estimated gender, estimated age range, the presence or absence of eyewear and general demographic classes.
Such data is processed solely in anonymous and aggregated form for statistical purposes, service analysis, product-performance assessment, usage analytics and improvement of the ARShades services. It is not used to identify the User, is not linked to a name, contact details, facial template, account or persistent identifier, and is not used for facial recognition, individual profiling, automated decision-making producing legal or similarly significant effects, marketing or behavioural tracking.
The AI analysis is carried out locally on the device. Spaarkly may collect only anonymous statistical outputs derived from such analysis, where technically enabled, and not facial images, facial templates, biometric identifiers or data that directly identifies the User. The above remains applicable: any activation of such module is brought to the User’s attention and, where required by applicable law, is subject to the User’s specific authorisation.
We collect standard usage information such as:
Such data is collected to improve the Services, ensure security and analyse the use of our solutions.
When the User visits the public page of an ARShades Campaign Catalogue, Spaarkly measures the use of the page in aggregated form, in order to provide its clients with campaign statistics: number of visits, an estimate of unique visitors within a single day, page scroll depth, interactions with products, openings of the immersive experiences, the channel from which the visit originated and the device type.
Such measurement is carried out without writing cookies, local storage or other identifiers to the User’s device. For the sole purpose of distinguishing visits within a single day, Spaarkly’s systems compute, server-side, a technical code by applying a non-reversible cryptographic hash function to the IP address and to technical browser information, together with a rotating secret element renewed every 24 hours; the IP address is discarded immediately after the computation and is not retained. The resulting code does not allow the User to be recognised across different days and constitutes derived technical data not used to identify the User and not capable, on its own, of identifying the User. It is not used for recognition, individual profiling, marketing or behavioural tracking across different websites or services.
The usage events so collected are deleted after the daily statistical aggregation, as a rule within 48 hours of collection; thereafter, only aggregated statistics, free of any technical code, are retained. The legal basis for such processing is the legitimate interest of Spaarkly and its clients in measuring the effectiveness of campaigns and the use of the service (Article 6(1)(f) GDPR); the User may object as set out in Section 12 (Data Subject Rights).
The launch of an immersive experience from the catalogue (for example, VTO or VTO Explorer) remains subject to the consents, notices and rules described in the other sections of this Policy.
ARShades does not collect, store or process biometric identifiers or biometric information within the meaning of the GDPR or as defined by state laws such as BIPA, CUBI, CCPA or similar laws. The facial-measurement technology used by ARShades detects facial landmarks in order to overlay, position or render the eyewear and, for AR PD Meter, to calculate the pupillary distance, without generating or storing biometric identifiers. No facial templates, scans or unique identifiers are created, stored or transferred to our servers. Any derived technical data transmitted to the ARShades backend for AR PD Meter is used solely to return the measurement result and is discarded after processing.
Where an ARShades experience includes the VTO Explorer module, the User may be asked to capture a limited number of images during the session. Such images are processed locally on the User’s device or on the device used for the experience in order to generate personalised catalogue previews and are not automatically uploaded to Spaarkly’s servers.
Where VTO Explorer or other ARShades photographic-output features are used on the User’s device, the final photos generated during the experience may be saved or downloaded directly to that device. In such cases, Spaarkly has no need to upload, store or otherwise process such final photos on its servers in order to make them available to the User.
A separate temporary server-side processing may occur only where the experience is provided through a device installed in a point of sale, showroom, event venue or other public place, and the User chooses to obtain, download or share on their own device final photos depicting them wearing the selected eyewear. In that case, only the final photos selected by the User are temporarily uploaded to Spaarkly’s servers for the sole purpose of making them available to the User for download or sharing. Such photos are not used for identification, facial recognition, profiling, marketing, analytics or the training of artificial-intelligence systems.
Should a jurisdiction redefine biometric data in such a way as to potentially include ARShades technology, we confirm that facial analysis and personalisation remain strictly local on the User’s device or on the device used for the experience and are not stored or used for identification purposes. Any temporary upload of final photos is limited to the download or sharing requested by the User from devices installed in points of sale, showrooms, event venues or other public places, and is subject to the retention limits described in this Policy.
Where the User chooses to obtain, download or share final photos generated through ARShades VTO, VTO Explorer, ARShades Mirror, “Shoot & Share” or equivalent features, the manner of processing depends on the type of device used for the experience.
Where the experience takes place on the User’s personal device, the final photos may be saved or downloaded directly to that device and are not uploaded to Spaarkly’s servers for that purpose.
Where the experience takes place on a device installed in a point of sale, showroom, event venue or other public place, Spaarkly may temporarily process only the final photos selected by the User, solely to make them available to the User for download or sharing on their own device.
Such photos may depict the User wearing one or more selected eyewear products. They are not used for facial recognition, biometric identification, profiling, marketing, analytics or the training of artificial-intelligence systems.
The User may delete such photos immediately after download, where this option is available. If the User does not delete them manually, they are automatically deleted from Spaarkly’s servers within 24 hours.
Some standalone ARShades applications—that is, applications not embedded in clients’ websites—may collect geolocation data as follows:
The collection of geolocation data in standalone applications is:
On first use of our standalone applications, the browser will ask you to allow or block access to location. This is a session-based consent that does not necessarily persist between visits but, depending on the User’s choice and the browser settings, that decision may be:
You can change these permission settings at any time through your browser settings.
All technical data collected, including any geolocation data, is automatically anonymised within 14 months, as described in our retention policy.
Personal data is processed by means of IT systems and, where necessary, manually, in accordance with the principles of fairness, lawfulness, transparency and confidentiality. Authorised personnel, who are trained and instructed, access the data for the stated purposes.
We adopt technical and organisational measures designed to prevent unauthorised access and to protect the data.
The VTO Mirror shares the same core features as the other ARShades VTO solutions, processing facial measurements locally on the device. Where pupillary-distance estimation (AR PD Meter) is used in the Mirror—for example, in support of the VTO Explorer experience in Mirror Showroom, the sole AR PD Meter use case in the Mirror—the facial landmarks and other derived technical data are processed by the device’s local backend, are not transmitted to cloud servers and are deleted after processing. This section specifically governs the additional aspects relating to in-store deployment and the optional “Shoot & Share” feature, which allows users to save and share selfies wearing the selected eyewear. Personal data is processed as follows:
ARShades uses only strictly necessary cookies, which are essential for the functioning of our services. Such cookies:
As such cookies are essential, they do not require the User’s consent under the GDPR and the ePrivacy Directive. Users may manage their browser settings to block or delete cookies, but doing so may affect the functionality of the service.
The public Campaign Catalogue pages do not set cookies or local storage: the measurement of their use is carried out exclusively server-side, as described in the section “Public catalogue usage-measurement data (Campaign Catalogue)”. The cookies described in this section relate to the ARShades experiences (for example, VTO) launched by the User.
| Cookie name | Duration | Purpose |
|---|---|---|
| visited | 90 days | Identifies whether the User has already used the service. |
| consent | 120 minutes | Identifies whether the User has given consent to the Privacy Policy and the Terms and Conditions for the use of ARShades. |
| lang | 90 days | Stores and remembers the User’s preferred language across browser sessions. |
For technical reasons connected with cross-domain restrictions in some browsers, ARShades may store consent using cookies or local-storage mechanisms. Both methods serve the same functional purpose: to remember acceptance of the privacy policy in order to avoid repeated requests during subsequent VTO experiences.
Where cookies cannot be set due to browser restrictions, local storage is used as a fallback mechanism. Such local-storage data is subject to the same retention periods, security measures and user controls as cookies. You can delete both cookies and local-storage data through your browser settings.
The information stored using either method is limited to essential consent flags and is not used for tracking or profiling.
The provision of data for the purposes described above is voluntary and free of charge. With the exception of geolocation data in certain standalone ARShades products, if the User chooses not to provide the data or permissions required for a specific feature, we may be unable to provide that feature.
For example, refusal of camera access will prevent use of the VTO experience. Refusal to capture the images required by the VTO Explorer module may prevent the generation of augmented-catalogue previews.
Where the experience takes place on the User’s personal device, the choice not to save or download the final photos does not prevent the User from using the local virtual try-on or catalogue-exploration experience, where available. Where the experience takes place on a device installed in a point of sale, showroom, event venue or other public place, the choice not to request the download or sharing of the final photos means that no temporary upload of such photos to Spaarkly’s servers will be carried out for that purpose.
All data is stored on servers located within the European Union (EU).
We do not transfer your personal data outside the European Economic Area (EEA).
Should it become necessary in the future to transfer data outside the EEA, we will ensure that appropriate safeguards are put in place in accordance with the GDPR and other applicable laws, such as the Standard Contractual Clauses (SCCs) approved by the European Commission.
We adopt appropriate technical and organisational measures to protect data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
Such measures include:
We constantly monitor and update our security protocols to ensure compliance with the latest data-protection standards.
In the event of a security incident affecting session data, device data, IP addresses or geolocation data, ARShades will:
ARShades is designed for users of all ages. However, only users who have reached the minimum legal age required in their country may independently give consent to the processing of their personal data.
If a user is below that age, the consent of a parent or guardian is required for the processing of the data, and the parent or guardian must accept this Privacy Policy on the user’s behalf.
We are committed to protecting the privacy of minors and encourage parents and guardians to actively monitor minors’ online activity and digital experiences.
We do not intentionally collect or process the personal data of any User—and therefore of any minor—in the absence of a valid legal basis and, in the case of minors below the applicable legal age, of verified parental consent.
Given the way ARShades is designed, we do not create accounts, do not request names or contact details and do not generate persistent identifiers: facial processing takes place locally on the device, and any technical and session data that may be retained (for example, the IP address) is dissociated from all other data within the periods set out in Section 6 (Data Collection and Retention Period). Accordingly, we hold no data attributable to an identified or identifiable minor.
Should a parent or guardian believe that their child has used the service without their consent, they may contact us at privacy@spaarkly.com to request the erasure of the data, indicating the IP address used and, where available, the approximate date and time of the session. Where such details enable us to identify the relevant data, we will immediately take steps to erase it; failing that, we recall that technical data remains in any event subject to the retention limits and automatic deletion described in Section 6 (Data Collection and Retention Period).
Under the GDPR and equivalent laws, Users enjoy the following rights:
To facilitate the exercise of the right to withdraw consent, ARShades provides a dedicated cookie/consent-management icon within the Virtual Try-On interface. By clicking on that icon, the User can:
Where consent is withdrawn, we immediately delete the consent data from both cookies and local storage, terminate the current VTO session and require fresh consent for any subsequent use of our services. This mechanism ensures that the User retains full control over their data at all times.
As ARShades does not require user registration and does not collect direct personal identifiers such as names or email addresses, it may be necessary to provide additional information to verify identity, such as IP address, device information or session details, in order to verify and handle data-related requests. This is necessary to associate the request with the technical data retained.
If a user cannot provide their IP address or other identifying session details, we may be unable to fulfil certain requests, such as data erasure, as ARShades does not maintain personally identifiable profiles.
Requests must be sent by email to the data controller at: privacy@spaarkly.com
If you believe that your data has been processed unlawfully, you have the right to lodge a complaint with:
We may periodically update this Privacy Policy to reflect:
When updates are made, we will change the “Last updated” date at the beginning of this document.
We encourage Users to review this Privacy Policy periodically to stay informed about how we protect their data.
The data controller is: Spaarkly s.r.l. Address: Via della Tecnica n. 18, 85100 Potenza, Italy Email: privacy@spaarkly.com
For further information or requests concerning your personal data, please contact us at the email address indicated.
This Privacy Policy establishes the general framework for the protection of personal data, based primarily on the GDPR. However, in some jurisdictions additional or different requirements may apply.
The following Regulatory Addenda supplement or modify the main body of the Policy. Each Addendum specifies, for the relevant geographical area or country:
The general provisions of this Privacy Policy apply to the extent that they do not conflict with the terms of the Addenda. In the event of a conflict, the provisions of the applicable Addendum prevail.
We encourage Users to read carefully the Addendum applicable to their country or region of residence.
Users resident in the United Kingdom and in the EU/EEA benefit from the rights provided under the UK GDPR and the EU GDPR, as described in the main body of this Privacy Policy. For transfers of data outside the United Kingdom or the EU/EEA, Spaarkly ensures compliance with applicable laws, including the use of the Standard Contractual Clauses (SCCs) approved by the European Commission for EU/EEA transfers and the ICO-approved SCCs for transfers from the United Kingdom.
Additional or differentiated rights
There are no substantial differences between the rights provided under the UK GDPR and those provided under the EU GDPR. Users in both jurisdictions retain the same fundamental rights of access, rectification, erasure, restriction, objection and data portability described in the main Policy.
Exercising rights
Users in the United Kingdom and the EU/EEA may exercise their rights by contacting privacy@spaarkly.com. They may also apply to the competent supervisory authority:
Data-breach notification obligations
In the event of a personal-data breach, Spaarkly will notify the competent supervisory authority within 72 hours of becoming aware of it, in accordance with Article 33 GDPR and the ICO reporting requirements in the United Kingdom.
International data transfers
For transfers outside the EU/EEA and the United Kingdom, Spaarkly ensures that appropriate safeguards are put in place, including:
Spaarkly does not transfer personal data to jurisdictions lacking an adequate level of protection, unless SCCs or other legally recognised mechanisms are in place.
Users resident in Switzerland benefit from data-protection rights that are substantially equivalent to those provided under the GDPR, as Swiss law is closely aligned with European standards.
Additional or differentiated rights under the FADP
Swiss users have the right to:
Swiss users may submit requests by email to privacy@spaarkly.com. For any complaints, they may also contact the Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch.
We apply the general data-retention principles described in this Privacy Policy. Personal data is retained only for as long as necessary to achieve the intended purpose and is anonymised within 14 months. Where Swiss law provides for specific retention periods, Spaarkly complies with them.
In the event of a data breach entailing a high risk to individuals’ rights, Spaarkly will inform:
The personal data of Swiss users is not transferred outside Switzerland, unless:
The United States does not have a general federal data-protection law applicable to all States. Spaarkly therefore complies with the privacy laws applicable at state level. This Addendum applies to residents of the United States and supplements the ARShades Privacy Policy. It governs compliance with federal and state privacy laws, including, by way of example:
The provisions of this Addendum apply in addition to those of the main Policy. In the event of a conflict, this Addendum prevails for U.S. residents.
California residents have the right to:
Residents of these States enjoy rights similar to those provided under the CCPA, including:
U.S. residents may contact us at privacy@spaarkly.com, specifying their State of residence.
We may request additional identity-verification information, for example device data or IP address, in order to handle the request.
Although our technology does not collect or store biometric information as defined by law, we provide this additional notice and request explicit consent to the use of our virtual try-on and measurement technology.
Before the experience begins, the User gives express consent—by ticking the relevant box accepting this Policy—to the use of the facial-detection technology as described in this Privacy Policy.
You may withdraw such consent at any time by ceasing to use the virtual try-on feature or by disabling camera access in your device settings.
As stated in the main Policy:
As Spaarkly does not collect users’ contact information, it is not possible to notify individuals directly in the event of a data breach. In accordance with state data-breach laws, Spaarkly will notify the competent state authorities where required.
Where required by law, Spaarkly will publish a public notice on its website or through other appropriate channels.
The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union (EU), where it receives the protections afforded by the GDPR.
This means that some data generated by use of the Services in the United States is processed in the EU. U.S. law does not restrict such transfers; the transferred data does not directly identify the User, is protected by appropriate technical and organisational measures and is discarded or anonymised in accordance with the terms of this Policy.
Should it become necessary in the future to transfer personal data from the EU/EEA to the United States, this would take place solely with the safeguards provided under the GDPR, such as the Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework (DPF).
FOR USERS LOCATED IN THE UNITED STATES: TO THE MAXIMUM EXTENT PERMITTED BY LAW, YOU AND SPAARKLY AGREE TO WAIVE THE RIGHT TO A JURY TRIAL OR TO PARTICIPATE AS A PLAINTIFF OR CLASS MEMBER IN ANY PURPORTED CLASS ACTION, REPRESENTATIVE PROCEEDING OR PRIVATE ATTORNEY GENERAL ACTION.
Unless otherwise agreed between you and Spaarkly, any dispute-resolution proceeding will be conducted solely on an individual basis. If, for any reason, a dispute proceeds before a court rather than in arbitration, you and Spaarkly each waive any right to a jury trial.
This waiver may not be enforceable in all States. Where it is not enforceable under state law, disputes will be resolved in accordance with the requirements of the applicable State.
Users in Canada are protected by the Personal Information Protection and Electronic Documents Act (PIPEDA) and by provincial privacy laws, including Quebec’s Law 25 (formerly Bill 64), British Columbia’s Personal Information Protection Act (PIPA) and Alberta’s Personal Information Protection Act (PIPA).
Spaarkly operates in Canada and adheres to the PIPEDA principles. Its current data-processing model is as follows:
As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain PIPEDA obligations, such as obtaining consent for secondary uses of data or maintaining detailed records of processing activities, do not strictly apply.
Users in Canada enjoy rights analogous to those provided under the GDPR, including:
Canadian users may exercise their rights by contacting privacy@spaarkly.com.
To verify identity, additional information such as the IP address or device identifiers may be requested before requests are handled.
If users are not satisfied with our response, they may apply to:
PIPEDA requires that personal data be retained only for as long as necessary for the intended purpose.
The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside Canada to the EU, a jurisdiction that ensures a high level of protection of personal data. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures, in accordance with PIPEDA’s Accountability principle.
Should a Canadian authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:
As Spaarkly remains committed to full compliance with PIPEDA and provincial privacy laws, it will monitor regulatory developments and adapt its processing practices should the authorities require further safeguards.
Users in Australia and New Zealand are protected by the respective general privacy laws:
Spaarkly operates in Australia and New Zealand and adheres to the principles set out in the privacy laws of those jurisdictions. Its current data-processing model is as follows:
As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain obligations under the Australian Privacy Act and the New Zealand Privacy Act, such as the preparation of a comprehensive privacy management plan or the maintenance of detailed records of processing activities, do not strictly apply.
Users in Australia and New Zealand have privacy rights that include:
Users in Australia and New Zealand may exercise their rights by contacting privacy@spaarkly.com.
Identity verification may be requested, for example through the IP address or device identifiers, before requests are handled.
If users are not satisfied with Spaarkly’s response, they may apply to:
Both the Australian Privacy Act and the New Zealand Privacy Act require that personal data not be retained longer than necessary for the intended purpose.
The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside Australia or New Zealand to the EU, a jurisdiction that ensures a high level of protection of personal data. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures, in line with APP 8 in Australia and IPP 12 in New Zealand.
Should an authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:
As Spaarkly remains committed to full compliance with Australian and New Zealand privacy laws, it will monitor regulatory developments and adapt its processing practices should the authorities require further safeguards.
Users in the Asia-Pacific region are protected by various national general data-protection laws, including:
Spaarkly operates in the Asia-Pacific region and adheres to the principles established by the privacy laws of those jurisdictions. Its current data-processing model is as follows:
As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain obligations under Asia-Pacific privacy laws, such as data-protection impact assessments, registration with authorities or detailed records of processing activities, do not strictly apply in most cases.
Users in Asia-Pacific countries with general data-protection laws generally enjoy rights similar to those provided under the GDPR, including:
Users in Asia-Pacific countries may exercise their rights by contacting privacy@spaarkly.com.
Identity verification may be requested, for example through the IP address or device identifiers, before requests are handled.
If users are not satisfied with Spaarkly’s response, they may apply to their competent national data-protection authority:
Data-protection laws in the Asia-Pacific region generally require that personal data be retained only for as long as necessary for the intended purpose and thereafter securely deleted.
The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside the User’s country to the EU, a jurisdiction that ensures a high level of protection of personal data. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures, so as to ensure a level of protection comparable to that required by the applicable local laws.
Should an authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:
As Spaarkly remains committed to full compliance with Asia-Pacific privacy laws, it will monitor regulatory developments in each jurisdiction and adapt its processing practices should the authorities require further safeguards.
Users in Brazil and Latin America are protected by various national general data-protection laws, including:
Spaarkly operates in Latin America and adheres to the principles established by the privacy laws of those jurisdictions. Its current data-processing model is as follows:
As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain obligations under Latin American data-protection laws, such as detailed records of processing activities, the appointment of a data protection officer or impact assessments, do not strictly apply in most cases.
Users in Brazil and Latin America with general data-protection laws generally enjoy rights similar to those provided under the GDPR, including:
Users in Brazil and Latin America may exercise their rights by contacting privacy@spaarkly.com.
Identity verification may be requested, for example through the IP address or device identifiers, before requests are handled.
If users are not satisfied with Spaarkly’s response, they may apply to their competent national authority:
Data-protection laws in Latin America generally require that personal data be retained only for as long as necessary for the intended purpose and thereafter securely deleted.
The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside the User’s country to the EU, a jurisdiction that ensures a high level of protection of personal data. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures, so as to ensure a level of protection comparable to that required by the applicable local laws.
Should an authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:
As Spaarkly remains committed to full compliance with Latin American privacy laws, it will monitor regulatory developments in each jurisdiction and adapt its processing practices should the authorities require further safeguards.
Users in Japan are protected by the Act on the Protection of Personal Information (APPI), as substantially amended in 2020 and effective from April 2022, which establishes a comprehensive data-protection framework enforced by the Personal Information Protection Commission (PPC).
Spaarkly operates in Japan and adheres to the principles established by the APPI. Its current data-processing model is as follows:
As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain APPI obligations, such as maintaining detailed records of processing activities, obtaining consent for disclosure to third parties or filing notifications with the PPC, do not strictly apply.
Spaarkly expressly confirms that it does not collect, process or transfer any information that would constitute “Sensitive Personal Information” (Yōhairyo Kojin Jōhō) within the meaning of Article 2(3) of the APPI, such as race, creed, social status, medical history or criminal record.
Users in Japan enjoy specific rights under the APPI, including:
Users in Japan may exercise their rights by contacting privacy@spaarkly.com.
Identity verification may be requested, for example through the IP address or device identifiers, before requests are handled. Spaarkly will respond to requests within the period provided under the APPI, generally within two weeks of receipt.
If users are not satisfied with Spaarkly’s response, they may apply to:
The APPI requires business operators to establish security-control measures (Article 23) and to ensure the accuracy of data (Article 22). It further provides that data must be deleted when no longer necessary in relation to the specified purpose.
The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside Japan to the EU. The EU is designated by the Personal Information Protection Commission (PPC) as a jurisdiction with equivalent standards of personal-data protection, by virtue of the 2019 EU-Japan mutual adequacy recognition: transfers to the EU are therefore permitted under Article 28 of the APPI.
Should the PPC require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:
As Spaarkly remains committed to full compliance with the APPI and its amendments, it will monitor regulatory developments and adapt its processing practices should the PPC or other Japanese authorities require further safeguards.
Users in China are protected by the Personal Information Protection Law (PIPL), which establishes principles similar to the GDPR, including strict rules on data processing, consent requirements and restrictions on cross-border transfers.
Spaarkly operates in China and adheres to the PIPL principles. Its current processing model is as follows:
Spaarkly constantly monitors the applicability of the PIPL requirements to its activities, including those relating to data localisation and security review, and adopts the required measures depending on the nature, volume and purposes of the data processed.
Users in China enjoy rights aligned with the GDPR, including:
In addition, the PIPL recognises rights that go beyond the GDPR, including:
Users in China may exercise their rights by contacting privacy@spaarkly.com. If not satisfied with Spaarkly’s response, they may apply to the Cyberspace Administration of China (CAC).
The PIPL requires companies to retain data only for the shortest period necessary to achieve the intended purpose.
In the event of a data breach that may cause significant harm, Spaarkly will notify:
As Spaarkly does not collect users’ contact information, individual notifications cannot be sent.
The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. For users in China, this may constitute a cross-border provision of personal information under the PIPL. Such data is limited to the minimum necessary, does not allow the User to be directly identified and is discarded or anonymised in accordance with the terms of this Policy.
To the extent that the PIPL requires specific measures for such flows, or should a Chinese authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures to ensure continued compliance with the PIPL, including:
As Spaarkly remains committed to full compliance with the PIPL, it will proactively monitor regulatory interpretations and adapt its processing practices should an authority require further safeguards.
Users in South Africa are protected by the Protection of Personal Information Act (POPIA), which governs the collection, use and security of personal data. POPIA is closely aligned with the GDPR but includes specific local requirements.
Spaarkly operates in South Africa and complies with the POPIA principles. Its current processing model is as follows:
As Spaarkly does not process personal data in a manner that directly identifies users, it does not fall within certain POPIA obligations, such as obtaining consent for direct marketing or maintaining records of processing activities.
Users in South Africa enjoy rights similar to those provided under the GDPR, including:
Users may exercise their rights by contacting privacy@spaarkly.com. If not satisfied with Spaarkly’s response, they may apply to the Information Regulator of South Africa (https://inforegulator.org.za/).
POPIA requires that personal data be retained only for as long as necessary for the intended purpose.
In the event of a data breach that may cause significant harm, Spaarkly will notify:
As Spaarkly does not collect users’ contact information, individual notifications cannot be sent.
The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside South Africa to the EU, in accordance with Section 72 of POPIA, which permits transfers to recipients subject to rules that ensure a substantially similar level of protection: the GDPR satisfies that standard. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures.
Should a South African authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:
As Spaarkly remains committed to full compliance with POPIA, it will monitor regulatory developments and adapt its processing practices should the authorities require further safeguards.
Users in India are protected by the Digital Personal Data Protection Act (DPDP), which governs the processing of personal data and imposes compliance obligations similar to the GDPR.
Spaarkly operates in India and adheres to the DPDP principles. Its current data-processing model is as follows:
As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain DPDP obligations, such as those imposed on “Significant Data Fiduciaries” (appointment of a data protection officer in India, independent audits and periodic impact assessments), have limited application.
Users in India enjoy rights similar to those provided under the GDPR, including:
Users may exercise their rights by contacting privacy@spaarkly.com. If not satisfied with Spaarkly’s response, they may apply to the Data Protection Board of India.
The DPDP Act requires that personal data be retained only for as long as necessary for the intended purpose.
The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside India to the EU. The DPDP permits the transfer of personal data to countries not restricted by the Central Government; the European Union is not currently subject to any such restriction. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures.
Should an Indian authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:
As Spaarkly remains committed to full compliance with the DPDP, it will monitor regulatory developments and adapt its processing practices should the authorities require further safeguards.
Users in the Middle East are protected by various national data-protection laws, including:
Spaarkly operates in the Middle East and complies with the applicable data-protection laws. Its current data-processing model is as follows:
As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain obligations under Middle East privacy laws, such as consent for direct marketing or the maintenance of local processing records, do not apply.
Users in Middle East jurisdictions enjoy rights similar to those provided under the GDPR, including:
Users may exercise their rights by contacting privacy@spaarkly.com.
If not satisfied with Spaarkly’s response, they may apply to:
Middle East data-protection laws require that personal data be retained only for as long as necessary for the intended purpose.
The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside the User’s country to the EU, a jurisdiction that ensures a high level of protection of personal data and is recognised as adequate by several laws in the region (for example, under the DIFC Data Protection Law). Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures.
Should a Middle East authority require additional safeguards, Spaarkly will immediately adopt all necessary compliance measures, including:
As Spaarkly remains committed to full compliance with Middle East privacy laws, it will monitor regulatory developments and adapt its processing practices should the authorities require further safeguards.
Users in countries not expressly covered by the preceding sections are protected by their respective national data-protection laws, where applicable. Although privacy laws vary, Spaarkly adheres to internationally recognised data-protection principles, derived from the GDPR.
Spaarkly operates globally and complies with internationally recognised data-protection principles. Its current data-processing model is as follows:
As Spaarkly does not process data capable of directly identifying Users (such as names, contact details or persistent identifiers), certain national obligations, such as data localisation, registration with local authorities or additional consent requirements, do not apply.
Users in countries not specifically listed in this Privacy Policy may still enjoy rights under national privacy laws. In line with international standards, users generally have the right to:
Users may exercise their rights by contacting privacy@spaarkly.com. If they are not satisfied with Spaarkly’s response, they may lodge a complaint with the competent national data-protection authority, where applicable.
Privacy laws in most jurisdictions provide that personal data must be retained only for as long as necessary.
In the event of a data breach that may cause significant harm, Spaarkly will notify:
As Spaarkly does not collect users’ contact information, individual notifications cannot be sent.
The technical and session data described in this Policy, including the derived technical data temporarily processed for AR PD Meter, is processed on servers located in the European Union. This may involve a transfer of data outside the User’s country to the EU, a jurisdiction that ensures a high level of protection of personal data. Such data does not directly identify the User and is protected by contractual safeguards and appropriate technical and organisational measures.
Should a regulatory authority require additional safeguards, the company will immediately adopt all necessary compliance measures, including:
Spaarkly remains committed to ensuring full compliance with international privacy standards and will constantly monitor regulatory developments, adapting its data-processing practices accordingly should the authorities require further protective measures.