Data Processing Agreement

1. About This Agreement

This Data Processing Agreement ("DPA") is between BookSparker Ltd ("BookSparker," "we," "us") and you, the author using BookSparker ("you"). It forms part of our Terms of Service and applies whenever BookSparker processes personal data on your behalf. It sets out the terms required by Article 28 of the UK General Data Protection Regulation (UK GDPR) and the EU General Data Protection Regulation (EU GDPR).

Terms such as "controller," "processor," "personal data," "processing," "data subject" and "personal data breach" have the meanings given to them in those laws.

2. Who Is Responsible for What

• You are the controller of the personal data of your readers and buyers described in Section 3. BookSparker processes it as your processor.
• BookSparker is the controller of your own account data, and of the records it keeps for security, abuse prevention, billing and legal compliance, as described in our Privacy Policy. This DPA does not cover that processing.
• When you sell a book, Stripe, through its Link service, sells it to the buyer as merchant of record and is an independent controller of the data the buyer gives it at checkout.
• The mailing list provider you connect, and any analytics or advertising tags you add to your author website, are your own services. Their providers process data under your agreements with them.

3. The Processing

• Purpose: Providing the features you use to reach readers: sign-up forms on your landing pages and author website, delivering the books you give away, passing sign-ups to the mailing list provider you connect, and delivering the books you sell to their buyers.
• Data subjects: Readers who sign up on your pages or author website, readers who download books you give away, and buyers of books you sell through BookSparker.
• Personal data: Email address; first and last name, where your form asks for them; consent records (the time, the wording shown, where the reader signed up and their IP address); country, derived from network-level geolocation; browser details; confirmation status; and download and delivery activity (format, reading device and time). For buyers, also the name given at checkout, the order (the book, the amount and currency, the date and Stripe's references for the payment) and the language of the page they bought from.
• Special categories of data: None. The Service is not designed for them, and you must not use it to collect them.
• Nature of the processing: Collecting, storing, sending sign-ups to your mailing list provider (and holding them until it accepts them), sending confirmation, delivery and order emails, delivering files, producing statistics for your dashboard, and deleting.
• Duration: For as long as you use these features, and then as set out in Section 9.

4. Your Instructions

We process the personal data only on your documented instructions, including for transfers outside the UK and the European Economic Area, unless the law requires us to do otherwise. In that case, we will tell you before we process it, unless the law forbids that. Your instructions are these Terms, this DPA, and the settings you choose and actions you take in the Service. For example, connecting a mailing list provider instructs us to send your sign-ups to it.

We will tell you straight away if we believe an instruction infringes data protection law.

You are responsible for the lawfulness of your instructions, for having a legal basis for the processing, and for the notices and consent wording you show your readers.

5. Confidentiality and Security

Only people who need access to provide the Service can access the personal data, and they are bound by confidentiality. We take appropriate technical and organizational measures under Article 32 GDPR to protect it, including:

• Encryption of data in transit (TLS / HTTPS) and at rest.
• Row-level security policies on database tables and ownership checks on requests, so each author can see only their own readers and buyers.
• Signed or private links for delivering book files.
• Rate limiting and abuse-prevention mechanisms.
• Email addresses masked in our application logs.
• Regular security reviews of our infrastructure and code.

6. Sub-processors

You give us general authorization to use sub-processors. We currently use:

• Supabase (database): stores reader and buyer records.
• Cloudflare, including Cloudflare R2 (hosting, edge network and file storage): serves your pages and stores and delivers book files.
• Resend (email delivery): sends confirmation, delivery and order emails to your readers and buyers.
• Sentry (error monitoring): receives error reports, which may contain personal data.
• Upstash (rate limiting): keeps short-lived request counters by IP address.

Each sub-processor is bound by a written contract with data protection obligations that are no less protective than those in this DPA, and we remain responsible to you for their performance.

We will tell you, by email or an in-app notice, at least 14 days before a new sub-processor starts processing the personal data. You can object on reasonable data protection grounds by writing to us at privacy@booksparker.com. If we cannot resolve your objection, you can stop using the features concerned or close your account.

7. International Transfers

BookSparker is established in the United Kingdom, which the European Commission recognizes as providing an adequate level of data protection. Some of our sub-processors process personal data in other countries, in particular the United States. Those transfers rely on adequacy regulations or decisions, or on the European Commission's Standard Contractual Clauses together with the UK's addendum to them.

8. Helping You Meet Your Obligations

• Requests from readers and buyers: Taking into account the nature of the processing, we help you answer requests from your readers and buyers to exercise their rights. If one of them contacts us directly about data we process for you, we will pass the request on to you, unless it is about data we control ourselves.
• Security and assessments: Taking into account the information available to us, we help you meet your obligations on security, breach notification, data protection impact assessments and consultation with supervisory authorities.
• Personal data breaches: We notify you without undue delay after becoming aware of a personal data breach affecting data we process for you, with the information you reasonably need to meet your own obligations, and we take reasonable steps to contain it.

9. When the Processing Ends

When you delete a page, a book or your account, we delete the personal data we process for you in connection with it, and when you close your account, we do so within 30 days. You can download the sign-ups from your landing pages and author website as a CSV file from your dashboard at any time; for a copy of anything else, write to us before you close your account.

Buyers keep access to the books they bought, as set out in Sections 9.4 and 9.5 of the Terms. To keep delivering those books, we keep each buyer's order and email address after you end a sale, delete the book or close your account, and from then on we keep them as controller under our Privacy Policy.

We may also keep personal data where the law requires us to.

10. Information and Audits

We make available to you the information you need to show that the obligations in Article 28 GDPR are met. We also allow for and contribute to audits, including inspections, by you or an auditor you appoint, on reasonable notice, no more than once a year unless a personal data breach or a supervisory authority requires otherwise, and subject to confidentiality. We may first answer with documents and written answers, and each party bears its own costs.

11. General

• Precedence: If this DPA and the Terms conflict on the processing of personal data, this DPA prevails.
• Liability: To the extent the law allows, liability under this DPA is subject to the limitations in Section 10 of the Terms.
• Changes: We may update this DPA, for example for new features, sub-processors or legal requirements. Material changes will be communicated via email or an in-app notice at least 14 days before they take effect.
• Governing law: This DPA is governed by the laws of England and Wales, like the Terms, except where data protection law requires otherwise.

12. Contact Us

For questions about this DPA or the processing it covers, please contact us: