1. Data controller
{{LEGAL_ENTITY}}, {{LEGAL_ADDRESS}}. Contact for privacy matters: {{PRIVACY_EMAIL}}. If we have appointed a data protection officer or an EU representative, their details are published at this address.
2. Scope
This policy covers the SparqX website, the SparqX mobile app, the SparqX web client, and the stations themselves. It does not cover third-party sites we link to, or the systems of venues that host our stations, which act as independent controllers for their own data.
3. Data we collect
Account data — email, phone number, name, password hash, and a payment token held by our payment processor. We never store full card numbers. Rental data — pickup station, return station, start and end time, duration, amount charged, deposit holds and releases. Balance and promotions — balance transactions, bonus balance, coupons applied, subscription status. Support data — messages, attachments and ticket metadata you send us. Device and app telemetry — app version, OS version, anonymised device identifier, crash reports. Location — precise coordinates only while you have granted the permission and the map is in use, to show nearby stations. We do not track location in the background. We do not collect special category data, and we ask you not to send it through support.
4. Why we collect it
To provide the rental service and to fulfil our contract with you; to bill you, hold and release deposits, and prevent fraud; to operate, secure and improve the network (legitimate interest); to answer support requests; and to comply with tax and accounting law. Marketing messages are sent only with your opt-in consent, which you can withdraw at any time in Settings → Notifications.
6. International transfers
Data is stored primarily in EU data centres. Where a transfer outside the EEA is unavoidable, we rely on Standard Contractual Clauses together with supplementary technical measures.
7. Retention
Account data: for the life of your account plus 12 months after closure. Rental and payment records: as required by tax law in the country of the rental (typically 6 years). Support tickets: 24 months. Telemetry and analytics: 24 months, anonymised earlier where possible. Location coordinates are not retained after the session that used them.
8. Your rights
You have the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent. Write to {{PRIVACY_EMAIL}} — we respond within 30 days. Account data can also be exported or deleted from the app. You may lodge a complaint with the supervisory authority in your country of residence. Note that we cannot erase rental and payment records we are required by law to keep, and we cannot close an account with an outstanding balance or an unreturned powerbank.
9. Security
Traffic is encrypted with TLS 1.3. Sensitive data at rest is encrypted with AES-256. Access to production data is role-based, logged and limited to named engineers. We follow ISO 27001-aligned practices and run periodic reviews of access and of our processors.
10. Children
The service is not directed at children under 16. If we learn that we hold data of a child below that age without valid parental consent, we delete it.
11. Mobile permissions
The app asks only for permissions it needs, and works without them in reduced form: Camera — to scan the station QR code. Frames are processed on the device and never uploaded. Location — to centre the map and find nearby stations. Refusing it shows the map at a default city centre. Notifications — for rental status, return reminders and, separately, promotions. You can revoke any of these in your device settings at any time.
13. Changes
We notify users of material changes by email and through in-app notice at least 30 days before they take effect. The current version and its effective date are always shown at the top of this page.