Privacy Policy

Last Updated: Aug 13, 2026

This Privacy Policy explains how Lightspark Group, Inc. and its affiliates, including Lightspark Payments, LLC (collectively, “Lightspark,” “we,” “our,” or “us”) collects, uses, discloses, and otherwise processes Personal Data in connection with the Services. By using or accessing the Services, you acknowledge that you have read and understood this Privacy Policy. We may also choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions, or states. Please refer to the Region-Specific Disclosures section below for additional disclosures that may be applicable to you.

For individuals who use the Grid Transaction Services, this Privacy Policy also serves as the privacy notice required under the Gramm-Leach-Bliley Act (“GLBA”) and its implementing Regulation P, describing how Lightspark Payments, LLC, as a financial institution under GLBA, collects, uses, and discloses nonpublic personal information, and the choices available to you with respect to that information.

Remember that your use of the Services is at all times subject to our Website Terms of Use (which governs your use of lightspark.com), our Terms of Service (which governs your use of our other products and services) and our End User Terms of Service (which governs your use of the Grid Transaction Services), each of which incorporate this Privacy Policy by reference. Any capitalized terms we use in this Privacy Policy without defining them have the definitions given to them in our Website Terms of Use, Terms of Service or End User Terms of Service, as applicable to your use of the Services, except where this Privacy Policy defines them.

This Privacy Policy applies to all of the Services, whichever of those agreements governs your particular use of them. This Privacy Policy also covers personal data that a customer or a Platform provides to us about an individual who is not our customer (for example, an individual designated to receive a payout). The section below headed Our Role in Processing Personal Data explains our role with respect to that personal data.

In this Privacy Policy, “Personal Data” means any information that identifies or relates to a particular individual, and includes any information referred to as “personal data,” “nonpublic personal information,” “personally identifiable information” or “personal information” under applicable data protection or financial privacy laws. “Services” means our Website and all of the products and services we provide, including the Grid Transaction Services; this is broader than, and for purposes of this Privacy Policy supersedes, the definition of that term in our Terms of Service. “Platform” means a third party that has entered into an agreement with us and through which the Grid Transaction Services are made available to you, as that term is used in our End User Terms of Service. “Website” has the meaning given to it in our Website Terms of Use, and “Lightning Network” has the meaning given to it in our Terms of Service. Other capitalized terms defined in our End User Terms of Service — including “Grid Transaction Services,” “Grid Switch Partner,” “ Internal Account” and “External Account” — have the same meaning when used in this Privacy Policy.

This Privacy Policy does not address our privacy practices relating to Lightspark job applicants, employees and other employment-related individuals, nor data that is not subject to applicable data protection laws (such as deidentified or publicly available information in certain jurisdictions). This Privacy Policy is also not a contract and does not create any legal rights or obligations not otherwise provided by law.

Data protection laws sometimes differentiate between “controllers” and “processors” of personal data. A “controller” determines the purposes and means (the why and how) of processing personal data. A “processor,” which is sometimes referred to as a “service provider,” processes personal data on behalf of a controller subject to the controller’s instructions.

This Privacy Policy describes our privacy practices where we are acting as the controller of personal data. However, this Privacy Policy does not cover or address how our customers or Platform partners may process personal data when they use our services, or how we may process personal data on their behalf in accordance with their instructions where we are acting as their processor. Where we perform know-your-customer, know-your-business, anti-money laundering, sanctions screening or Travel Rule compliance in connection with a Grid Transaction, or where you have accepted our End User Terms of Service directly with us, we act as a controller of that personal data and this Privacy Policy applies to it, whether or not you were introduced to us through a Platform. As a result, we recommend referring to the privacy policy of the Platform or customer with which you have a relationship for information on how they engage processors, like us, to process personal data on their behalf. In addition, we are generally not permitted to respond to individual requests relating to personal data we process on behalf of our customers, so we recommend directing any requests to the relevant customer or Platform. Where a customer or a Platform provides us with personal data about you so that we can deliver a payout to you (for example, your name and account details as a designated recipient) we act as a processor for that customer in executing the payout, and as an independent controller of that same personal data when we process it for the compliance purposes described above. Requests relating to the payout itself should be directed to that customer, and we will pass on to them any request we receive that belongs with them. We do not use personal data we receive about individuals who are not our customers for marketing purposes, and we do not sell it.

The categories of personal data we collect depend on how you interact with us and our Services. For example, you may provide us your personal data directly when you create an account, initiate a Grid Transaction, or otherwise contact us or interact with us.

We also collect personal data automatically when you interact with our Website and other Services and may also collect personal data from other sources and third parties.

a. Personal Data Provided by Individuals

• Contact Information, including first and last name, phone number, email address, mailing address, country of residence, and communication preferences. We use this information primarily to create and manage your account, fulfill your requests or transactions, communicate with you directly, and send you marketing communications in accordance with your preferences.
• Account Information, including first and last name, email address, phone number, date of birth, account credentials, unique identifiers such as usernames and hashed passwords, organization names, and the products or services you are interested in, purchased, or have otherwise used. We use this information primarily to administer your account, provide you with the Grid Transaction Services, communicate with you regarding your account and your use of our Services, and for customer support purposes.
• Identity Verification Data, including government-issued identification documents (such as passport, driver’s license, or national identity card), photographs or selfies submitted for identity verification, and proof of address documents. We use this information primarily to verify your identity as required by applicable know-your-customer (“KYC”) and know-your-business (“ KYB”) regulations, to comply with anti-money laundering and sanctions laws, and to prevent fraud and other financial crimes.
• Tax and Financial Compliance Data, including tax identification numbers (such as Social Security Number, Individual Taxpayer Identification Number, Employer Identification Number, or foreign equivalents), IRS Forms W-9 or W-8 and related tax documentation, beneficial ownership information, and proof of business registration. We use this information primarily to comply with applicable tax reporting obligations, anti-money laundering regulations, and other financial regulatory requirements.
• Credit and Background Data, including information obtained from credit reporting agencies, banking partners, and information bureaus in connection with identity verification, risk assessment, and compliance screening. We use this information primarily to verify your identity, assess risk, and comply with applicable financial services regulations.
• Payment Information, including payment card type, last four digits of payment card number, billing email address, and other financial information (such as routing and account numbers). Please note that we use third-party payment providers to process payments made to us. The payment provider’s use of your personal data is governed by their privacy policy.
• Transaction Data, including information about the transactions conducted using the Services (including payments sent or received through instant payment systems such as the FedNow® Service operated by the Federal Reserve Banks), such as the destination, amount, timestamp, exchange rate, fees, and settlement status of a transaction. We use this information primarily to execute and settle Grid Transactions, provide you with transaction receipts and confirmations, and comply with applicable regulatory and recordkeeping requirements.
• Lightning Network Data, including identifying information about yourself, such as an IP address or node name, that you make publicly available on the Lightning Network, as well as information contained in the “memo” field of invoices. We use this information primarily to provide the Services, perform analytics, and provide publicly available Lightning Network data to compliance partners for analytics and compliance purposes.
• Feedback and Support Information, including the contents of custom messages sent through email, chat platforms, letters, texts, or other communication channels. We use this information primarily to investigate and respond to your inquiries, communicate with you, and improve our Services.

If you do not provide the personal data necessary to provide you with the Services, you will not be able to benefit from them. However, to help us support the principle of data minimization, we ask that you do not provide any personal data in the “memo” field of your transactions using the Services.

b. Personal Data Automatically Collected

• Information About Your Device and Network, including the device type, operating system, IP address, browser type, device ID, and unique identifiers associated with your device. We use this information primarily to provide and monitor the Services, ensure security, and diagnose technology problems.
• Information About the Way Individuals Use Our Services and Interact With Us, including web page interactions, the referring webpage or source through which you accessed the Services, statistics associated with the interaction between your device or browser and the Services, and other browsing behavior. We use this information primarily to monitor and improve the Services, analyze trends, and enhance your user experience.
• Information About Your Location, including general geographic location derived from your IP address. We use this information primarily to provide the Services, comply with applicable regulatory requirements, and for analytics purposes.

All of the information collected automatically through these tools allows us to improve your customer experience. For example, we may use this information to enhance and personalize your user experience, to monitor and improve our products and services, to offer communications features and to improve the effectiveness of our products, services, offers, advertising, communications and customer service. We may also use this information to: (a) remember information so that you will not have to re-enter it during your visit or the next time you visit the site; (b) provide custom, personalized content and information, including targeted content and advertising; (c) identify you across multiple devices; (d) provide and monitor the effectiveness of our services; (e) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our website; (f) diagnose or fix technology problems; and (g) otherwise to plan for and enhance our products and services.

For information about the choices you may have in relation to our use of automatic data collection technologies, please refer to the Your Privacy Choices section below.

Cookies and Similar Technologies

The Website and the Services use cookies and similar technologies such as pixel tags, web beacons, clear GIFs and JavaScript (collectively, “Cookies”) to enable our servers to recognize your web browser, tell us how and when you visit and access or use the Website and the Services, analyze trends, learn about our user base and operate and improve the Website and the Services. Cookies are small pieces of data — usually text files — placed on your computer, tablet, phone or similar device when you use that device to access or use the Website or the Services. We may also supplement the information we collect from you with information received from third parties, including third parties that have placed their own Cookies on your device(s).

We use the following types of Cookies:

• Essential Cookies. Essential Cookies are required for providing you with features or services that you have requested. For example, certain Cookies enable you to log into secure areas of the Website and the Services. Disabling these Cookies may make certain features and services unavailable.
• Functional Cookies. Functional Cookies are used to record your choices and settings regarding the Website and the Services, maintain your preferences over time and recognize you when you return to the Website or the Services. These Cookies help us to personalize our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
• Performance/Analytical Cookies. Performance/Analytical Cookies allow us to understand how visitors access and use the Website and the Services. They do this by collecting information about the number of visitors to the Website and the Services, what pages visitors view and how long visitors are viewing pages. Performance/Analytical Cookies also help us measure the performance of our advertising campaigns in order to help us improve our campaigns and the Website’s and the Services’ content for those who engage with our advertising. For example, Google LLC (“Google”) uses Cookies in connection with its Google Analytics services. Google’s ability to use and share information collected by Google Analytics about your visits to the Website and the Services is subject to the Google Analytics Terms of Use and the Google Privacy Policy. You have the option to opt out of Google’s use of Cookies by visiting the Google advertising opt-out page at www.google.com/privacy_ads.html or the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout/.
• Retargeting/Advertising Cookies. Retargeting/Advertising Cookies collect data about your online activity and identify your interests so that we can provide advertising that we believe is relevant to you. For more information, please see the Targeted Advertising Preferences section below.

You can decide whether or not to accept Cookies through your internet browser’s settings. Most browsers have an option for turning off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the sophistication of your browser software) allow you to decide on acceptance of each new Cookie in a variety of ways. You can also delete all Cookies that are already on your device. If you do this, however, you may have to manually adjust some preferences every time you visit our Website and some of the Website or the Services and functionalities may not work.

To explore what Cookie settings are available to you or to modify your preferences with respect to Cookies, look in the “preferences” or “options” section of your browser’s menu. To find out more information about Cookies generally, including information about how to manage and delete Cookies, please visit http://www.allaboutcookies.org/ or https://ico.org.uk/for-the-public/online/cookies/ if you are located in the European Union or the United Kingdom.

c. Personal Data from Other Sources and Third Parties

• Our Affiliates: Lightspark Group, Inc. entities, including Lightspark Payments, LLC, may receive personal data from other Lightspark entities for purposes consistent with this Privacy Policy.
• Our Customers and Platforms: A customer or a Platform may provide us with personal data about a third party (for example, the name, address and account details of an individual designated to receive a payout) so that we can deliver a payout on their instruction. We rely on that customer or Platform to have a lawful basis for sharing that personal data with us and to inform the individual of that sharing.
• Single Sign-On: We may provide you the ability to log in to our Services through certain third-party accounts (e.g., Google, Microsoft). When you use these single sign-on protocols, we receive tokens to help identify you and confirm successful authentication, rather than your login credentials for the third-party service.
• Credit Reporting Agencies and Information Bureaus: We may receive personal data about you from credit reporting agencies, banking partners, and information bureaus in connection with identity verification, risk assessment, and compliance screening, as authorized by you during the onboarding process.
• Service Providers: Our service providers, including analytics providers, marketing providers, and compliance partners, may collect personal data and share some or all of this information with us.
• Advertising Partners: We receive information about you from some of our vendors who assist us with marketing or promotional services related to how you interact with our Website, applications, and communications.
• Other Sources: We may also collect personal data about you from other sources, including publicly available sources (including the Lightning Network), third-party data providers, or through transactions such as mergers and acquisitions.

d. Additional Uses of Personal Data

In addition to the purposes stated above, we may use the personal data we collect for the following purposes:

• Fulfill or meet the reason the information was provided, such as to fulfill our contractual obligations, process Grid Transactions, or deliver the Services requested;
• Create and manage your account and verify your identity and entitlement to the Services;
• Process orders, payments, or other transactions, including Grid Transactions;
• Communicate with you, including via email, text message, telephone calls, and through the Platform’s interface;
• Perform and support identity verification, anti-fraud protection, security, and debugging;
• Comply with applicable know-your-customer, anti-money laundering, sanctions, tax reporting, and other regulatory requirements;
• Provide publicly available Lightning Network data to compliance partners for analytics and compliance purposes;
• Market the Services to you, including through email, phone, text message, and online advertising;
• Develop, operate, improve, maintain, and provide the features and functionality of the Services;
• Conduct research and analytics on our user base and Services;
• Create aggregated or de-identified information that cannot reasonably be used to identify you, which information we may use for purposes outside the scope of this Privacy Policy;
• Help maintain the safety, security, and integrity of our property, Services, technology, assets, and business;
• Defend, protect, or enforce our rights or applicable contracts and agreements (including our Website Terms of Use, and End User Terms of Service);
• Detect, prevent, investigate, or provide notice of security incidents or other malicious, deceptive, fraudulent, or illegal activity against Lightspark and others;
• Facilitate business transactions and reorganizations impacting the structure of our business;
• Comply with contractual and legal obligations and requirements;
• Fulfill any other purpose for which you provide your personal data, or for which you have otherwise consented.

We may disclose personal data, including personal data about our current and former customers, to the following categories of third parties:

• To Our Affiliates: Lightspark Group, Inc. entities disclose personal data to other Lightspark entities for purposes consistent with this Privacy Policy.
• To Grid Switch Partners and Financial Institutions: We share your personal data with banks, payment processors, digital asset custodians, and other financial institution counterparties (collectively, “Grid Switch Partners”) as reasonably necessary to: (a) execute and settle Grid Transactions; (b) comply with applicable law, including know-your-customer, anti-money laundering, and sanctions requirements; (c) onboard or maintain your account with such Grid Switch Partners in connection with the Grid Transaction Services; and (d) otherwise provide the Grid Transaction Services as described in our End User Terms of Service.
• To Payment Systems and Their Operators: When you send or receive a payment through an instant payment system such as the FedNow® Service operated by the Federal Reserve Banks, we disclose transaction records and related information (such as account and routing numbers, payment identifiers, timestamps, and amounts) to our partner banks and to the operator of the payment system. The operator may use and disclose this information as necessary to process the payment and to operate, maintain, and improve the payment system, including related directory, routing, screening, risk management, compliance, and fraud-prevention services. We may also share fraud-related information about payment activity with our partner banks, payment system operators, and other financial institutions involved in a transaction where reasonably necessary to detect, investigate, and prevent fraud, or to process, investigate, or resolve a payment.
• To Service Providers: We engage third parties to perform certain services on our behalf, including hosting, technology and communication providers, security and fraud prevention consultants, support and customer service vendors, and professional advisors such as lawyers, accountants, and auditors.
• To Ad Networks and Advertising Partners: We work with third-party ad networks and advertising partners to deliver advertising and personalized content on our Services, on other websites and services, and across other devices. These parties may collect information automatically through the use of cookies and related technologies.
• To Analytics Partners: We share personal data with analytics providers that help us analyze how you interact and engage with the Services, including web traffic and usage patterns.
• To Compliance Partners: We share personal data with parties that provide or develop analytics and related services relating to the Lightning Network for compliance purposes.
• To Other Businesses as Needed to Provide Services: We may share personal data with third parties you engage with through our Services or as needed to fulfill a request or transaction, including payment processing services.
• In Connection with a Business Transaction or Reorganization: We may disclose, transfer, or assign personal data to a third party during negotiation of, in connection with, or as an asset in a merger, acquisition, joint venture, financing, or sale of company assets.
• To Facilitate Legal Obligations and Rights: We may disclose personal data to third parties, such as legal advisors, law enforcement, and governmental authorities: in connection with the establishment, exercise, or defense of legal claims; to comply with laws or to respond to lawful requests and legal process; to protect our rights and property; to detect, suppress, or prevent fraud; to protect the health and safety of us, our customers, or any person; or as otherwise required by applicable law.
• With Your Consent or Direction: We may disclose your personal data to certain other third parties with your consent or direction, including single sign-on providers and any other parties with which you authorize us to share your personal data.

Communication Preferences

• Email Communication Preferences: You can stop receiving promotional email communications from us by clicking on the “unsubscribe” link provided in any of our email communications. Please note you cannot opt-out of service-related email communications (such as, account verification, transaction confirmation, or service update emails).
• Phone Communication Preferences: You can stop receiving promotional phone communications from us by informing the caller you no longer wish to receive promotional phone calls from us, following the instructions provided on the call for opting out of promotional phone calls (where available), replying STOP to any one of our promotional text messages or by contacting us at privacy@lightspark.com or support@lightsparkpayments.com. Please note we may need to continue to communicate with you via phone for certain service-related messages (such as, sending a verification code to your phone via call or text for purposes of verifying the authenticity of a log-in attempt).

Withdrawing Your Consent

If you have provided your consent to the collection, processing, and transfer of your personal data, you have the right to fully or partially withdraw your consent. To withdraw your consent, please contact us at privacy@lightspark.com. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose(s) to which you originally consented, unless there is another legal basis for the processing. Please note that withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal.

GLBA Right to Opt Out of Nonaffiliated Third-Party Disclosures

Where required under the Gramm-Leach-Bliley Act and Regulation P, you have the right to direct Lightspark Payments, LLC not to disclose your nonpublic personal information to nonaffiliated third parties outside the categories permitted under applicable exceptions (such as disclosures to service providers assisting us in providing the Grid Transaction Services, or disclosures necessary to effect, administer, or enforce a transaction you request). This right extends to our disclosure of nonpublic personal information to Ad Networks and Advertising Partners for purposes of targeted advertising, as such disclosures are not made solely to perform services on our behalf. To exercise this right, please contact us at privacy@lightspark.com.

Automatic Data Collection Preferences

Certain of our services may provide you the ability to adjust your preferences regarding our use of automatic data collection technologies. For example, there is a “Cookie Preferences” manager linked in the footer of our websites that allows you to adjust your preferences regarding certain automatic data collection technologies on the specific website you are visiting for the specific device and browser you are using at that time (which means you will need to change your preferences on each device and browser you use to interact with the specific website you are visiting).

You may be able to utilize third-party tools and features to restrict our use of automatic data collection technologies. For example, (i) most browsers allow you to change browser settings to limit automatic data collection technologies on websites, (ii) most email providers allow you to prevent the automatic downloading of images in emails that may contain automatic data collection technologies, and (iii) many devices allow you to change your device settings to limit automatic data collection technologies for device applications. Please note that blocking automatic data collection technologies through third-party tools and features may negatively impact your experience using our services, as some features and offerings may not work properly or at all. Depending on the third-party tool or feature you use, you may not be able to block all automatic data collection technologies or you may need to update your preferences on multiple devices or browsers. We do not have any control over these third-party tools and features and are not responsible if they do not function as intended.

Targeted Advertising Preferences

We engage third parties to help us facilitate targeted advertising designed to show you personalized ads based on predictions of your preferences and interests developed using personal data we maintain and personal data our third-party partners obtain from your activity over time and across nonaffiliated websites and other services. The data we and our third-party partners use for purposes of facilitating targeted advertising, as well as to provide advertising-related services such as reporting, attribution, analytics, and market research, are primarily collected through the use of a variety of automatic data collection technologies, including cookies, web beacons, pixels, embedded scripts, mobile SDKs, location-identifying technologies and logging technologies. We may share a common account identifier (such as a hashed email address or user ID) with our third-party advertising partners to help link the personal data we and our third-party partners collect to the same person, or otherwise target advertising to an individual on a third-party website or platform.

In addition to taking the steps set forth in the Automatic Data Collection Preferences section above, you may be able to further exercise control over the advertisements that you see by leveraging one or more targeted advertising opt-out programs. For example:

• Device-Specific Opt-Out Programs: Certain devices provide individuals the option to turn off targeted advertising for the entire device (such as Apple devices through their App Tracking Transparency framework or Android devices through their opt out of ads personalization feature). Please refer to your device manufacturer’s user guides for additional information about implementing any available device-specific targeted advertising opt-outs.
• Digital Advertising Alliance: The Digital Advertising Alliance allows individuals to opt out of receiving online interest-based targeted advertisements from companies that participate in their program. Please follow the instructions at https://optout.aboutads.info/?c=2&lang=EN for browser-based advertising and https://www.youradchoices.com/appchoices for app-based advertising to opt out of targeted advertising carried out by our third-party partners and other third parties that participate in the Digital Advertising Alliance’s self-regulatory program.
• Network Advertising Initiative: The Network Advertising Initiative also provides individuals instructions for further controlling how information is used for online advertising. Please follow the instructions at https://thenai.org/how-to-opt-out/ to exercise these controls.
• Platform-Specific Opt-Out Programs: Certain third-party platforms provide individuals the option to turn off targeted advertising for the entire platform (such as certain social media platforms). Please refer to your platform provider’s user guides for additional information about implementing any available platform-specific targeted advertising opt-outs.

Global Privacy Control

If you visit our Website with the Global Privacy Control (“GPC”) signal enabled on your browser, we will treat the GPC signal as a valid request to opt out of the sale or sharing of personal data associated with the browser from which the GPC signal is sent, in accordance with applicable law. Because of our use of automatic data collection technologies, our Website and the Services do not currently respond to “Do Not Track” signals sent from a browser.

Modifying or Deleting Your Personal Data

If you wish to modify or delete personal data we hold about you, please contact us at privacy@lightspark.com. We will consider your request in accordance with applicable laws. Please note that we may be required to retain certain information for record-keeping purposes, to complete transactions, or to comply with our legal obligations.

Our Services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 18. If an individual is under the age of 18, they should not use our services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 18 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of 18, we will promptly delete that personal data.

We seek to protect your personal data from unauthorized access, use, and disclosure using physical, technical, and organizational security measures based on the type of personal data and how we are processing that data. You should also help protect your personal data by appropriately selecting and protecting your password and/or other sign-on mechanism; limiting access to your computer or device and browser; and signing off after you have finished accessing your account. Although we work to protect the security of your account and other personal data, no method of transmitting data over the internet or storing data is completely secure.

We will usually retain the personal data we collect about you for no longer than reasonably necessary to fulfil the purposes for which it was collected, and in accordance with our legitimate business interests and applicable law. However, if necessary, we may retain personal data for longer periods of time as required under applicable law or as needed to resolve disputes or protect our legal rights. Records of payment transactions, including instant payment records and related fraud-prevention information, are retained in accordance with applicable financial recordkeeping requirements and payment system rules.

To determine the appropriate duration of the retention of personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of personal data and if we can attain our objectives by other means, as well as our legal, regulatory, tax, accounting, and other applicable obligations.

Once retention of the personal data is no longer reasonably necessary for the purposes outlined above, we will either delete or deidentify the personal data or, if that is not possible, we will securely store the personal data and isolate it from further active processing until deletion or deidentification is possible.

Biometric Data. We retain biometric data collected for identity verification only for as long as necessary to complete and evidence the verification for which it was collected, and we permanently destroy it when the initial purpose for collecting it has been satisfied or within three years of your last interaction with us, whichever occurs first. Where a longer period is required by applicable law, or where the data is subject to a legal hold, we retain it for the shortest period that satisfies that requirement and destroy it promptly afterwards. We do not sell, lease, trade or otherwise profit from biometric data.

Our Services may contain links to or integrations with other websites and services operated by third parties. The information that you share with or that is collected by these third parties is subject to the respective third party’s privacy policy and terms of service, not this Privacy Policy. We encourage you to review the privacy policies of any third-party websites or services you visit or use, including those with which you interact through our Services. We are not responsible for the content or practices of third-party websites or services.

In connection with the Services, we may use automated decision-making processes, including profiling, for purposes such as identity verification, fraud detection, risk assessment, and compliance screening. These automated processes may produce decisions that have legal or similarly significant effects on you, including the approval, denial, or conditioning of your access to the Services, or the suspension, limitation, or termination of your account. For more information about the rights you may have with respect to automated decision-making, please refer to the Region-Specific Disclosures below or contact us at privacy@lightspark.com.

Please refer to the following additional disclosures for more information about our privacy practices as they relate to residents of certain jurisdictions:

• European Economic Area, United Kingdom, or Switzerland: If you are located in the European Economic Area (Member States of the European Union together with Iceland, Norway, and Liechtenstein), the United Kingdom, or Switzerland, please see the Additional European Economic Area, United Kingdom, and Switzerland Privacy Disclosures section below.
• Other Jurisdictions: If you are located outside the European Economic Area, the United Kingdom, Switzerland or the United States, additional disclosures may apply to you. [Please see our Global Privacy Supplement, which contains jurisdiction-specific annexes that apply based on your location, for those disclosures. Where that Supplement conflicts with this Privacy Policy, the Supplement controls for the jurisdiction it covers.]

We may update this Privacy Policy from time to time. When we do, we will post the updated Privacy Policy on this page and update the “Last Updated” date at the top of this Privacy Policy. We encourage you to review this Privacy Policy periodically to stay informed about our privacy practices. If we make material changes to this Privacy Policy, we will notify you by posting a notice on the Website or by other means as required by applicable law. Your continued use of the Services after any changes to this Privacy Policy constitutes your acceptance of the updated Privacy Policy.

If you have any questions or requests in connection with this Privacy Policy or other privacy-related matters, please contact us at:

Lightspark Group, Inc.
8605 Santa Monica Blvd, PMB 64461
West Hollywood, CA 90069
Email: privacy@lightspark.com
Phone: 855-516-0103

For matters relating to the Grid Transaction Services, you may also contact: support@lightsparkpayments.com or 1-805-557-8917.

These disclosures supplement the information contained in our Privacy Policy by providing additional information about our personal data processing practices relating to individuals who access our services or otherwise interact with us from the European Economic Area (“EEA”), United Kingdom (“UK”), and Switzerland. For a detailed description of how we collect, use, disclose, and otherwise process personal data, please read our Privacy Policy.

Additional Questions or Complaints

If you have a concern about our processing of personal data, you have the right to lodge a complaint with the Data Protection Authority where you reside, where you work, or where an alleged violation of the law has occurred. Contact details for applicable Data Protection Authorities can be found using the links below:

• European Economic Area: https://edpb.europa.eu/about-edpb/board/members_en
• United Kingdom: https://ico.org.uk/global/contact-us/
• Switzerland: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html

We would, however, appreciate the chance to handle your concerns directly prior to a complaint being filed, so please contact us directly at privacy@lightspark.com if you have any concerns.

Purposes and Legal Bases of Processing

When we process your personal data, we will do so in reliance on the following lawful bases:

• Contract: Where the processing is necessary for the performance of a contract to which you are a party, or to take steps at your request prior to entering into a contract with you. This applies to any processing where you sign a contract with us, for example when you become our customer or deliver services to us as a vendor or contractor. This may also include processing necessary for the performance of our Terms of Use.
• Legitimate Interest: Where the processing is necessary for the purposes of a legitimate interest that are not overridden by your interests or fundamental rights and freedoms (e.g., to provide, maintain, and improve our products and services, conduct data analytics, and communicate with you regarding our services).
• Vital Interest: Where the processing is necessary to protect the vital interests of you or another person (e.g., to protect your physical safety).
• Public Interest: Where the processing is necessary to perform tasks carried out in the public interest or in the exercise of official authority vested in us (e.g., to cooperate in an ongoing law enforcement investigation).
• Legal Obligation: Where the processing is necessary to comply with our legal obligations (e.g., to maintain a record of your personal data to comply with laws and regulations related to bookkeeping, accounting, taxation, and employment).
• Consent: Where we have your consent for the processing (e.g., when you opt in to receive marketing communications from us). When consent is the legal basis for our processing of your personal data, you may withdraw your consent at any time.

When we process special categories of personal data (including biometric data, government identification numbers, etc.), we do so only where (i) the processing relates to personal data which are manifestly made public by you, (ii) the processing is necessary for the establishment, exercise, or defense of legal claims, (iii) the processing is necessary for reasons of substantial public interest, or (iv) you have given us explicit consent.

You are not required to provide personal data to us, but we do rely on your personal data to provide certain of our products and services. For example, we need your personal data to facilitate and deliver an order that you request. If you choose not to provide us with your personal data, we may not be able to provide you with a service or product you request. We will inform you at the point that we collect personal data from you if the provision of certain personal data is mandatory or optional for receipt of our products and services.

Automated Decision-Making and Profiling

We conduct automated processing of Personal Data, including profiling, in connection with identity verification, fraud detection, risk assessment, and compliance screening. These automated processes may produce decisions that have legal or similarly significant effects on you, including the approval, denial, or conditioning of your access to the Services, or the suspension, limitation, or termination of your account. The categories of Personal Data used in these processes include Identity Verification Data, Tax and Financial Compliance Data, Credit and Background Data, Transaction Data, and Device/IP Data. You have the right to: (a) obtain human intervention in the decision-making process; (b) express your point of view; and (c) contest any decision made solely on the basis of automated processing. To exercise these rights, please contact us at privacy@lightspark.com.

Retention of Personal Data

We will usually retain the personal data we collect about you for no longer than reasonably necessary to fulfil the purposes for which it was collected, and in accordance with our legitimate business interests and applicable law. However, if necessary, we may retain personal data for longer periods of time as required under applicable law or as needed to resolve disputes or protect our legal rights.

The criteria used to determine the period of time for which personal data about you will be retained varies depending on the legal basis under which we process your personal data:

• Contract: Where we are processing personal data based on contract, we generally will retain the information for the duration of the contract plus some additional limited period of time that is necessary to comply with law or that represents the statute of limitations for legal claims that could arise from the contractual relationship.
• Legitimate Interest: Where we are processing personal data based on legitimate interests, we generally will retain the information for a reasonable period of time based on the particular interest, taking into account the fundamental interests and the rights and freedoms of data subjects.
• Vital Interest: Where we are processing personal data based on vital interests, we generally will retain the information for the period of time necessary to protect the vital interests of the relevant person plus some additional limited period of time that represents any applicable statute of limitations for legal claims that could arise out of the related events.
• Public Interest: Where we are processing personal data to perform tasks carried out in the public interest or in the exercise of official authority vested in us, we generally will retain the information for a reasonable period of time based on the public interest / official authority, taking into account any obligations we may have to retain the information for a longer period of time.
• Legal Obligation: Where we are processing personal data based on a legal obligation, we generally will retain the information for the period of time necessary to fulfill the legal obligation plus some additional limited period of time that represents the statute of limitations for legal claims that could arise from the legal obligation.
• Consent: Where we are processing personal data based on your consent, we generally will retain the information for the period of time necessary to fulfill the purposes for which you have provided your consent.

In certain circumstances, we may need to apply a “legal hold” that retains information beyond our typical retention period where we face threat of legal claim. In that case, we will retain the information until the hold is removed, which typically means the claim or threat of claim has been resolved. In all cases, in addition to the purposes and legal bases identified above, we consider the amount, nature and sensitivity of personal data, as well as the potential risk of harm from unauthorized use or disclosure of personal data, in determining the relevant retention period.

Once retention of the personal data is no longer reasonably necessary for the purposes outlined above, we will either delete or deidentify the personal data or, if that is not possible (for example, because personal data has been stored in backup archives), we will securely store the personal data and isolate it from further active processing until deletion or deidentification is possible.

International Transfers of Personal Data

We operate and engage third-party partners and providers in various jurisdictions. Therefore, we and our third-party providers may transfer personal data to, or store, access, or process personal data in, a country other than the one in which it was collected, including, but not limited to, the United States. The country to which personal data is transferred may not provide the same level of protection for personal data as the country from which it was transferred.

We may transfer personal data about you outside of the EEA, UK, and Switzerland, and when we do so we rely on appropriate or suitable safeguards recognized under applicable law, including adequacy decisions and standard contractual clauses. If you would like more information on the specific safeguards we use (and obtain a copy of such safeguards, where applicable), please contact us at privacy@lightspark.com.

Adequacy Decisions

We may transfer personal data about you to countries that the relevant regulatory authority have deemed to adequately safeguard personal data, either automatically or in connection with a specific safe harbor framework.

Standard Contractual Clauses

Certain regulatory authorities have adopted standard contractual clauses, which provide safeguards for personal data transferred outside of the originating jurisdiction. We may use these standard contractual clauses when transferring personal data to a third country that has not been deemed to adequately safeguard personal data.

EU-U.S. Data Privacy Framework

The EU-U.S. Data Privacy Framework was designed by the U.S. Department of Commerce and the European Commission to ensure adequate protection for personal data transferred to a company participating in the EU-U.S. Data Privacy Framework. If we transfer any personal data about you from the EEA to a third party outside the EEA who is participating in the EU-U.S. Data Privacy Framework, we may rely on their participation in the Framework to ensure adequate protection for personal data so transferred.

Your Additional EEA, UK, and Swiss Privacy Choices

Subject to certain limitations at law, you may be able to exercise the following rights:

• Right to Access: The right to obtain confirmation of whether we are processing personal data about you, access to and a copy of the personal data we are processing about you, and information relating to its processing, including:
  • The categories of personal data being processed;
  • The purposes of the processing;
  • The categories of the sources of the personal data;
  • The categories of recipients to whom the personal data have been or will be disclosed;
  • The envisaged period for which the personal data will be stored, or the criteria used to determine that period;
  • Any automated decision-making or profiling performed in connection with your personal data; and
  • The safeguards relied upon for the transfer of personal data to any third country.
• Right of Portability: The right to obtain a copy of the personal data we have collected about you in a structured, commonly used, and machine-readable format, and the right to transmit that personal data to another controller without hindrance.
• Right to Rectification: The right to correct or update any personal data about you that is inaccurate or incomplete.
• Right to Restriction of Processing: The right to require us to limit the purposes for which we process your personal data if the continued processing of the personal data in this way is not justified, such as where the accuracy of the personal data is contested by you.
• Right to Object to Processing: The right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal data, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.
• Right to Withdraw Consent: The right to withdraw your previously provided consent to our processing of your personal data. Please note withdrawing your consent will not affect the lawfulness of our use of your personal data before your consent was withdrawn, nor our processing of personal data pursuant to a different lawful basis for processing.
• Right to Erasure: The right to have us erase your personal data if the continued processing of that personal data is not otherwise justified.

Please note that if the exercise of these rights limits our ability to process personal data, we may not be able to provide our services to you or otherwise engage with you in the same manner.

Submitting Privacy Rights Requests

Please submit a request specifying the right you wish to exercise by contacting us at privacy@lightspark.com with enough detail for us to identify you in our records and assist with your request.

To exercise your right to object as it relates to the use of automatic data collection technologies (including cookies) that facilitate our online targeted advertising activities, please follow the steps set forth in the Automatic Data Collection Preferences section of our Privacy Policy to further exercise control over automatic data collection technologies.

Before processing your request to exercise certain rights (taking into account the confidential nature of any personal data we maintain), we will need to verify your identity and confirm you are accessing our services or otherwise interacting with us from the EEA, UK, or Switzerland. In order to verify your identity, we will generally either require the successful authentication of your account, or the matching of sufficient information you provide us to the information we maintain about you in our systems. As a result, we require requests submitted through our online form to include first and last name, email address, phone number, state of residency and/or the date of your last interaction with us.

In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity as needed to protect your personal data or locate your information in our systems, or where you are not accessing our services or otherwise interacting with us from the EEA, UK, or Switzerland.

Contact Information

If you have any questions or comments about this Privacy Policy, the ways in which we collect, use and otherwise process your Personal Data or your choices and rights regarding such collection, use and other processing, please do not hesitate to contact us at:

855-516-0103
https://www.lightspark.com
privacy@lightspark.com
8605 Santa Monica Blvd, PMB 64461, West Hollywood, CA, 90069

Prevailing Language. In the event of any discrepancy between the English language version of this Policy and any foreign language translation, the English version prevails. Any other language version of this Policy is provided for convenience only.