Data processing agreement
Version 1.0 · Last updated 27 October 2026
This data processing agreement ("DPA") forms part of the agreement between you, the business using the website assistant ("Controller", "you"), and Ali Mert Keskin, trading as MK Spark Interactive ("Processor", "we"), for the website assistant service (the "Service"). It applies whenever we process personal data on your behalf through the Service and is intended to meet Article 28 of the UK GDPR and the EU GDPR. It takes effect when you start using the Service. If you need a signed copy, email mertkeskin@mksparkinteractive.com and we will countersign it.
1. Roles
You are the controller of the personal data of visitors to your website who use the assistant. We act only as your processor. For our own business contacts with you (for example billing), we are a separate controller and our privacy policy applies.
2. Details of the processing
| Subject matter | Answering website visitors' questions from information you approve, and passing on enquiries. |
|---|---|
| Duration | For as long as the Service is active, plus the retention periods below. |
| Nature and purpose | Receiving visitor messages, generating replies with an AI model, detecting when a visitor leaves contact details, storing that enquiry and emailing it to the address you choose. |
| Data subjects | Visitors to your website who use the chat assistant. |
| Personal data | Chat messages; any name, phone number or email address the visitor chooses to give; a short summary of the enquiry; a random session identifier; browser language; a one-way hash of the visitor's IP address used for rate limiting and message counts in your reports; the text of questions the assistant could not answer, so you can add the answer. |
| Special category data | Not intended. The assistant is instructed not to ask for health or other special category data and not to give clinical advice. Visitors may still volunteer such information; it is handled under the same safeguards and deleted on the same schedule. Payment card numbers are detected and removed before storage. |
3. Our obligations
- We process personal data only on your documented instructions, which are this DPA, our terms and the settings you choose for your assistant, unless the law requires otherwise (in which case we will tell you first, unless the law forbids it).
- Anyone authorised by us to process the data is bound by confidentiality.
- We apply the security measures in section 6.
- We use sub-processors only as described in section 5.
- We help you, as far as reasonably possible, to respond to requests from individuals exercising their rights (access, deletion, etc.).
- We help you with security, breach notification, data protection impact assessments and consultations with regulators, taking into account the information available to us.
- We notify you without undue delay, and where possible within 48 hours, after becoming aware of a personal data breach affecting your data.
- At the end of the Service, we delete your assistant's stored enquiries and configuration within 30 days, unless the law requires us to keep them.
- We make available the information needed to show compliance with this DPA and allow for reasonable audits, normally by answering a written questionnaire.
4. Your obligations
You confirm that you have a lawful basis for the processing, that you tell your visitors about the assistant in your own privacy notice, and that the information you give the assistant is accurate and lawful.
5. Sub-processors
You authorise the following sub-processors. We will give you at least 30 days' notice by email before adding or replacing one, and you may object; if we cannot reasonably accommodate the objection, you may cancel the Service.
| Sub-processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database and server functions that run the assistant and store enquiries | Data hosted in South Korea (AWS ap-northeast-2) |
| Google LLC / Google Cloud | Gemini API to generate replies (paid API services, under which prompts and responses are not used to train Google's models); Google Workspace / Gmail to email enquiries to you | Global |
| Vercel Inc. | Hosting the widget script and website (no visitor chat content stored) | Global edge network |
6. Security measures
- All traffic is encrypted in transit (HTTPS/TLS).
- Database access is restricted with row-level security; only the server functions can read enquiries.
- Each assistant only works on the website addresses you authorise.
- Payment card numbers are detected and removed before messages are processed or stored.
- IP addresses are stored only as a one-way hash, for abuse protection.
- Enquiries are deleted automatically 30 days after they are created. Questions the assistant could not answer are deleted after 90 days, and hashed usage counters after 62 days. Full chat logs are not kept.
- Access to the systems is limited to the Processor and protected with strong authentication.
7. International transfers
The Processor is based in Türkiye and some sub-processors operate outside the UK and EEA. Where personal data is transferred to a country without an adequacy decision, the transfer is covered by the UK International Data Transfer Agreement or the International Data Transfer Addendum to the EU Standard Contractual Clauses (and, for EU data, the EU Standard Contractual Clauses, module 2 or 3 as applicable), which are incorporated into this DPA by reference. South Korea, where the database is hosted, benefits from a UK adequacy decision.
8. Liability and precedence
Liability under this DPA is subject to the limits in our terms of service, except where the law does not allow such limits. If this DPA conflicts with the terms of service on data protection, this DPA prevails.
Contact
Ali Mert Keskin, MK Spark Interactive · mertkeskin@mksparkinteractive.com