Network Privacy Policy

1. Introduction

Spark Rack respects the privacy of its customers, prospective customers, authorized users, website visitors, support contacts, business representatives, and other individuals whose Personal Information is processed in connection with Spark Rack’s products, services, websites, customer portal, infrastructure, and network.

This Privacy Policy explains how Spark Rack collects, receives, accesses, uses, stores, protects, discloses, retains, and deletes Personal Information.

This Privacy Policy also explains the privacy rights and choices that may be available to individuals under Applicable Law.

Spark Rack is a service operated by Grand Bay Collective. References in this Privacy Policy to “Spark Rack,” “we,” “us,” or “our” include Grand Bay Collective, Spark Rack, the Spark Rack Network, and their respective personnel, contractors, service providers, successors, and permitted assigns, as applicable to the processing activity being described.

By creating an Account, submitting an Order, accessing the Customer Portal, visiting a Spark Rack website, communicating with Spark Rack, or using the Services, you acknowledge the practices described in this Privacy Policy.

2. Scope of This Privacy Policy

This Privacy Policy applies to Personal Information processed through or in connection with:

1. Spark Rack websites;
2. The Spark Rack Customer Portal;
3. Account registration and administration;
4. Orders, invoices, payments, credits, and refunds;
5. Hosting services;
6. Server and infrastructure services;
7. The Spark Rack Network;
8. Domain registration and domain-management services;
9. DNS services;
10. Email and messaging services;
11. Backup and storage services;
12. Security, monitoring, and managed services;
13. Customer support;
14. Legal, abuse, copyright, and security reports;
15. Service-status and incident communications;
16. Sales, quotations, and proposals;
17. Business communications;
18. Surveys or feedback submitted directly to Spark Rack;
19. Applications for employment or contractor relationships submitted directly to Spark Rack;
20. Physical or remote service administration;
21. Service logs and operational records;
22. Fraud prevention and identity verification;
23. Compliance with legal obligations; and
24. Any other interaction that expressly references this Privacy Policy.

This Privacy Policy does not govern independent websites, applications, platforms, products, or services operated by third parties, even when they are linked from or integrated with the Services.

This Privacy Policy does not replace a separate written data-processing agreement, business-associate agreement, employment privacy notice, contractor agreement, or other specialized privacy notice where one applies.

3. Definitions

3.1 “Account”

The customer account, client profile, billing account, administrative login, support profile, or other record through which a person or entity purchases, receives, accesses, or manages the Services.

3.2 “Applicable Law”

Any applicable federal, state, local, provincial, national, or foreign privacy, data-protection, consumer-protection, communications, cybersecurity, breach-notification, records-retention, or similar law, regulation, rule, binding order, or legally enforceable requirement.

3.3 “Customer”

The individual or legal entity that creates an Account, submits an Order, receives an invoice, enters into an agreement with Spark Rack, or otherwise obtains or controls the Services.

3.4 “Customer Content”

All files, databases, websites, applications, software, messages, emails, media, backups, credentials, records, configurations, logs, communications, and other data submitted to, stored on, transmitted through, or processed by the Services at Customer’s direction.

3.5 “Customer Data”

Customer Content and other information submitted to or generated through Customer’s use of the Services, excluding Spark Rack’s own billing, security, legal, administrative, and operational records.

3.6 “Customer Portal”

The electronic client account, billing, support, service-management, or administrative interface made available by Spark Rack.

3.7 “End User”

Any person or entity that accesses, receives, interacts with, or uses the Services through Customer, including Customer’s employees, representatives, contractors, customers, subscribers, tenants, website visitors, application users, mailbox users, and reseller clients.

3.8 “Personal Information”

Information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual or household.

Depending on Applicable Law, Personal Information may also be referred to as personal data, personally identifiable information, or a similar term.

Personal Information does not include information that Applicable Law excludes from the definition, such as certain publicly available, aggregated, or de-identified information.

3.9 “Processing”

Any action performed on Personal Information, including collecting, receiving, accessing, organizing, storing, using, transmitting, disclosing, securing, retaining, deleting, or otherwise handling the information.

3.10 “Sensitive Personal Information”

Personal Information considered sensitive under Applicable Law, which may include government identifiers, financial-account credentials, precise geolocation, health information, biometric information, racial or ethnic origin, religious beliefs, sexual orientation, citizenship or immigration information, contents of certain communications, and information concerning children.

3.11 “Service Provider”

A contractor, processor, subprocessor, vendor, professional adviser, or other third party that processes Personal Information for a defined business purpose on behalf of Spark Rack and subject to appropriate restrictions.

3.12 “Services”

All hosting, server, network, domain, DNS, email, storage, backup, security, monitoring, management, support, consulting, infrastructure, software, and related services supplied by Spark Rack.

3.13 “Spark Rack Network”

The infrastructure operated, administered, controlled, leased, licensed, or arranged by Spark Rack, including servers, routers, switches, firewalls, storage systems, Internet connections, address space, transit, peering, DNS systems, monitoring systems, security systems, data-center connectivity, and upstream or downstream provider relationships.

4. Spark Rack’s Role in Processing Information

4.1 Spark Rack as a Business or Controller

Spark Rack generally acts as a business, controller, or similar responsible entity when it determines why and how Personal Information is processed for its own legitimate business purposes.

This includes Personal Information processed for:

1. Account administration;
2. Billing and payment management;
3. Customer support;
4. Service delivery;
5. Service security;
6. Fraud prevention;
7. Legal compliance;
8. Business communications;
9. Contract management;
10. Service improvement that does not involve artificial intelligence or model training;
11. Internal administration; and
12. Protection of Spark Rack, Customers, End Users, and third parties.

4.2 Spark Rack as a Service Provider or Processor

Spark Rack may act as a service provider, contractor, processor, or subprocessor when it processes Customer Data solely to provide Services according to Customer’s documented instructions.

Examples may include:

1. Hosting Customer websites;
2. Storing Customer databases;
3. Transmitting Customer email;
4. Maintaining Customer backups;
5. Providing managed infrastructure;
6. Processing Customer application traffic;
7. Providing DNS services;
8. Providing storage services;
9. Providing server administration; and
10. Performing Customer-requested restoration or migration work.

When Spark Rack acts as a processor or service provider, Customer is generally responsible for determining the lawful basis, notices, permissions, and instructions governing the processing of Personal Information contained in Customer Data.

4.3 Customer Responsibilities

Customers are responsible for:

1. Providing legally required privacy notices to End Users;
2. Obtaining legally required consent;
3. Responding to End User privacy requests;
4. Ensuring Customer Data is collected and processed lawfully;
5. Configuring the Services appropriately;
6. Limiting access to Customer Data;
7. Protecting Customer credentials;
8. Using appropriate encryption and security controls;
9. Determining appropriate retention periods;
10. Maintaining independent backups where appropriate;
11. Entering into required data-processing agreements; and
12. Complying with privacy, data-protection, communications, and consumer-protection laws applicable to Customer’s activities.

5. Privacy Principles

Spark Rack’s privacy practices are guided by the following principles:

1. Collect Personal Information only for defined and legitimate purposes;
2. Limit collection to information reasonably necessary for those purposes;
3. Use Personal Information consistently with the reason it was collected;
4. Do not sell or rent Personal Information;
5. Do not share Personal Information for cross-context behavioral advertising;
6. Do not use Personal Information or Customer Data for artificial-intelligence or machine-learning training;
7. Do not authorize Service Providers, partners, or other third parties to use Personal Information or Customer Data for artificial-intelligence or model training;
8. Restrict access according to business need;
9. Retain Personal Information only for as long as reasonably necessary or legally required;
10. Use reasonable administrative, technical, and physical safeguards;
11. Provide transparency concerning material processing practices;
12. Respect privacy rights required by Applicable Law; and
13. Review privacy and security practices as the Services evolve.

6. Absolute Prohibition on Artificial Intelligence and Model Training

6.1 No Artificial Intelligence in Spark Rack Products or Services

Spark Rack does not use artificial intelligence, generative artificial intelligence, large language models, machine-learning models, neural networks, or similar model-based technologies as part of any Spark Rack product or Service.

Spark Rack does not use artificial intelligence to operate:

1. The Customer Portal;
2. Customer support;
3. Billing;
4. Account administration;
5. Hosting services;
6. The Spark Rack Network;
7. Security administration;
8. Domain services;
9. DNS services;
10. Email services;
11. Backup services;
12. Monitoring services;
13. Managed services;
14. Fraud review;
15. Content review;
16. Customer communications; or
17. Any other Spark Rack product or Service.

6.2 No Use of Information for AI or Model Training

Spark Rack does not use Personal Information, Customer Data, Customer Content, support communications, account information, service telemetry, network information, logs, metadata, billing information, website activity, or any other consumer or customer information to train, fine-tune, develop, test, evaluate, benchmark, validate, improve, operate, or supply an artificial-intelligence or machine-learning model.

This prohibition includes use for:

1. Model pretraining;
2. Model training;
3. Fine-tuning;
4. Reinforcement learning;
5. Retrieval-augmented generation;
6. Embedding generation for model-based retrieval;
7. Prompt processing;
8. Prompt storage for model development;
9. Model evaluation;
10. Model benchmarking;
11. Model testing;
12. Model validation;
13. Model safety training;
14. Human review for model improvement;
15. Data labeling for artificial intelligence;
16. Creation of synthetic training data;
17. Automated profiling;
18. Automated recommendation systems;
19. Predictive scoring;
20. Behavioral classification;
21. Emotion recognition;
22. Facial recognition;
23. Voice-model training;
24. Image-model training;
25. Generative-content systems; and
26. Any substantially similar use.

6.3 No Third-Party AI Training Authorization

Spark Rack does not authorize, permit, license, sell, disclose, transfer, or otherwise make Personal Information or Customer Data available to any Service Provider, contractor, partner, affiliate, data broker, advertising provider, technology provider, or other third party for artificial-intelligence or machine-learning training.

Third parties processing information on Spark Rack’s behalf are not authorized to:

1. Use the information to train an artificial-intelligence model;
2. Use the information to improve a third-party model;
3. Retain the information for model development;
4. Use the information as prompts or model input for unrelated purposes;
5. Generate embeddings for unrelated model systems;
6. Perform model evaluation using the information;
7. Use the information for data labeling;
8. Use the information to create synthetic training data;
9. Combine the information with another dataset for AI development;
10. Sell or license the information to an AI developer;
11. Use the information to create profiles or predictions; or
12. Use the information for any purpose outside the limited service being provided to Spark Rack.

Spark Rack requires Service Providers to process Personal Information only for authorized purposes and subject to applicable confidentiality, security, use-limitation, and deletion requirements.

6.4 No AI-Based Automated Decisions

Spark Rack does not use artificial intelligence or machine-learning models to make decisions concerning:

1. Account approval;
2. Account suspension;
3. Account termination;
4. Pricing;
5. Creditworthiness;
6. Payment eligibility;
7. Employment;
8. Access to Services;
9. Customer support priority;
10. Fraud determinations;
11. Legal compliance;
12. Consumer eligibility;
13. Service availability;
14. Content moderation; or
15. Any decision producing legal or similarly significant effects.

6.5 Rule-Based Automation Is Not Artificial Intelligence

Spark Rack may use traditional, deterministic, rule-based software automation to perform routine operations such as:

1. Generating invoices;
2. Processing scheduled renewals;
3. Sending service notices;
4. Applying defined firewall rules;
5. Identifying known malicious signatures;
6. Monitoring service availability;
7. Measuring resource usage;
8. Executing backups;
9. Applying configured rate limits;
10. Detecting repeated failed logins according to fixed rules;
11. Provisioning Services;
12. Processing domain-renewal schedules;
13. Routing support tickets according to selected categories; and
14. Performing other predefined operational tasks.

Such deterministic automation does not train, learn from, profile, infer characteristics from, or generate content from customer or consumer information.

6.6 Customer-Controlled AI Services

A Customer may independently choose to install, operate, connect, or host third-party artificial-intelligence software using Customer-controlled infrastructure.

Any such Customer-controlled use:

1. Is not a Spark Rack product or Service;
2. Is not endorsed by Spark Rack;
3. Is controlled by Customer;
4. Is subject to Customer’s own privacy obligations;
5. Must comply with the Spark Rack Acceptable Use Policy;
6. Must not expose Spark Rack information without authorization; and
7. Does not alter Spark Rack’s prohibition against using Personal Information or Customer Data for Spark Rack or third-party AI training.

7. Categories of Personal Information Collected

The categories of Personal Information Spark Rack may collect depend on the Services used and the nature of the interaction.

7.1 Account and Identity Information

Spark Rack may collect:

1. Full name;
2. Business or organization name;
3. Job title or role;
4. Username;
5. Customer identification number;
6. Account identifiers;
7. Date of birth when reasonably required for verification;
8. Government-issued identification when reasonably required for identity, fraud, or legal verification;
9. Authorized-user information;
10. Account ownership information;
11. Security questions and responses;
12. Multifactor-authentication settings;
13. Recovery information; and
14. Records of identity or authority verification.

7.2 Contact Information

Spark Rack may collect:

1. Email address;
2. Telephone number;
3. Mobile telephone number;
4. Billing address;
5. Mailing address;
6. Business address;
7. Country, state, province, city, and postal code;
8. Emergency contact information;
9. Technical contact information;
10. Administrative contact information;
11. Abuse contact information; and
12. Contact preferences.

7.3 Billing and Transaction Information

Spark Rack may collect:

1. Orders;
2. Invoices;
3. Payment status;
4. Payment method type;
5. Partial payment-card information;
6. Payment tokens;
7. Transaction identifiers;
8. Billing history;
9. Refund records;
10. Credit records;
11. Chargeback information;
12. Tax status;
13. Tax-exemption documentation;
14. Currency information;
15. Promotional-code usage;
16. Account balances;
17. Collections records;
18. Fraud indicators; and
19. Information needed to reconcile or dispute a payment.

Spark Rack does not intentionally store complete payment-card numbers or card-security codes in its ordinary systems when payment information is processed by an authorized payment processor.

7.4 Service and Subscription Information

Spark Rack may collect:

1. Services ordered;
2. Service identifiers;
3. Service status;
4. Provisioning information;
5. Renewal dates;
6. Cancellation requests;
7. Resource allocations;
8. Service configurations;
9. Assigned IP addresses;
10. Hostnames;
11. Server names;
12. Domain names;
13. DNS settings;
14. Email-service settings;
15. Licensing records;
16. Support-plan information;
17. Service-location information;
18. Migration information;
19. Backup configuration;
20. Monitoring configuration;
21. Administrative contacts; and
22. Other information needed to provide the selected Service.

7.5 Technical and Device Information

Spark Rack may collect:

1. IP address;
2. Device type;
3. Operating system;
4. Browser type and version;
5. Language settings;
6. Time-zone settings;
7. Screen or device characteristics;
8. Referring URL;
9. Requested URL;
10. Date and time of access;
11. Session identifiers;
12. Cookie identifiers;
13. Authentication events;
14. Login history;
15. Failed-login history;
16. Customer Portal activity;
17. API activity;
18. User-agent information;
19. Network connection information;
20. Error reports;
21. Diagnostic information;
22. Security-event information; and
23. Other technical data generated through use of the Services.

7.6 Network and Infrastructure Information

Spark Rack may collect or generate:

1. Source and destination IP addresses;
2. Source and destination ports;
3. Protocol information;
4. Connection timestamps;
5. Connection duration;
6. Traffic volume;
7. Network-flow records;
8. Routing information;
9. Firewall events;
10. Authentication logs;
11. Mail-delivery logs;
12. DNS query or response metadata where operationally available;
13. DDoS-mitigation events;
14. Rate-limit events;
15. Security alerts;
16. Resource-usage information;
17. Server-health information;
18. Storage-health information;
19. Backup-job status;
20. Service uptime and availability data;
21. Administrative actions;
22. Configuration-change history;
23. System-event records; and
24. Other information reasonably required to operate and secure the Spark Rack Network.

Spark Rack does not routinely inspect the content of network communications. Limited inspection or packet capture may occur when reasonably necessary to troubleshoot a problem, investigate Abuse, mitigate an attack, respond to a security incident, comply with law, or protect the Services.

7.7 Customer Support and Communication Information

Spark Rack may collect:

1. Support-ticket content;
2. Email communications;
3. Chat communications;
4. Telephone-call notes;
5. Voicemail messages;
6. Uploaded files;
7. Screenshots;
8. Diagnostic reports;
9. Log files;
10. Error messages;
11. Remote-support session information;
12. Service requests;
13. Customer feedback;
14. Complaint information;
15. Survey responses submitted directly to Spark Rack;
16. Communications concerning billing, security, legal, or abuse matters;
17. Internal notes concerning the support request; and
18. Records of actions taken in response.

7.8 Domain Registration Information

When Customer obtains domain-related Services, Spark Rack may collect:

1. Registrant name;
2. Registrant organization;
3. Registrant address;
4. Registrant email address;
5. Registrant telephone number;
6. Administrative contact information;
7. Technical contact information;
8. Billing contact information;
9. Domain name;
10. Registration and expiration dates;
11. Registrar and registry identifiers;
12. Authorization codes;
13. Transfer records;
14. Verification records;
15. Nameserver information;
16. DNSSEC information;
17. Domain-lock status;
18. Renewal preferences;
19. Privacy or proxy-service status; and
20. Other information required by the applicable registrar or registry.

7.9 Security, Fraud, and Abuse Information

Spark Rack may collect or generate:

1. Fraud indicators;
2. Risk-review notes;
3. Identity-verification records;
4. Security alerts;
5. Abuse complaints;
6. Malware indicators;
7. Phishing indicators;
8. Spam complaints;
9. Compromise indicators;
10. Threat-intelligence indicators;
11. Sanctions-screening results;
12. Payment-risk information;
13. IP reputation information;
14. Domain reputation information;
15. Login-risk indicators based on predefined rules;
16. Records of enforcement actions;
17. Records of Account restrictions;
18. Communications with affected providers or authorities;
19. Evidence submitted in connection with a complaint; and
20. Information reasonably necessary to protect people, systems, or property.

7.10 Legal and Compliance Information

Spark Rack may collect:

1. Legal notices;
2. Subpoenas;
3. Court orders;
4. Warrants;
5. Preservation requests;
6. Copyright notices;
7. Trademark complaints;
8. Privacy complaints;
9. Government inquiries;
10. Regulatory communications;
11. Dispute notices;
12. Arbitration records;
13. Insurance records;
14. Compliance certifications;
15. Records concerning legal holds;
16. Information submitted by a complainant;
17. Information concerning affected Customers or End Users; and
18. Records of Spark Rack’s response.

7.11 Business Contact Information

Spark Rack may collect information concerning representatives of vendors, contractors, data centers, carriers, professional advisers, registrars, registries, payment providers, and other business relationships, including:

1. Name;
2. Business contact information;
3. Job title;
4. Employer;
5. Professional communications;
6. Contract information;
7. Access information;
8. Billing information;
9. Security-verification information; and
10. Records relating to the business relationship.

7.12 Employment and Contractor Applicant Information

When an individual directly submits an employment or contractor application, Spark Rack may collect:

1. Name;
2. Contact information;
3. Employment history;
4. Education history;
5. Professional qualifications;
6. Licenses and certifications;
7. References;
8. Work authorization information;
9. Resume or curriculum vitae;
10. Portfolio information;
11. Interview notes;
12. Compensation expectations;
13. Availability;
14. Background-check information where lawful and authorized;
15. Information voluntarily provided by the applicant; and
16. Records concerning the selection process.

7.13 Sensitive Personal Information

Spark Rack does not seek to collect Sensitive Personal Information unless it is reasonably necessary for a specific purpose.

Sensitive Personal Information may be processed when:

1. Customer submits government identification for verification;
2. Financial credentials are processed by an authorized payment provider;
3. Customer provides legally relevant information in a support or legal request;
4. Precise location is required for a specific service request;
5. Customer voluntarily includes sensitive information in Customer Content;
6. Information is required to investigate fraud, Abuse, or security incidents;
7. Information is required by law; or
8. Processing is otherwise authorized by the individual or Customer.

Spark Rack does not use Sensitive Personal Information to infer characteristics about individuals for advertising, profiling, artificial intelligence, or model training.

8. Sources of Personal Information

Spark Rack may obtain Personal Information from:

1. The individual;
2. Customer;
3. Authorized users;
4. End Users;
5. Customer representatives;
6. Resellers;
7. Payment processors;
8. Fraud-prevention providers;
9. Identity-verification providers;
10. Domain registrars and registries;
11. Data centers;
12. Network providers;
13. Software licensors;
14. Security providers;
15. Support providers;
16. Professional advisers;
17. Public records;
18. Publicly accessible websites;
19. Government agencies;
20. Law-enforcement agencies;
21. Courts;
22. Complainants;
23. Copyright or trademark owners;
24. Security researchers;
25. Other service providers;
26. Devices used to access the Services;
27. Servers and systems interacting with the Spark Rack Network;
28. Cookies and similar first-party technologies;
29. System logs;
30. Customer applications and configurations;
31. Customer-authorized integrations; and
32. Other sources permitted by Applicable Law.

9. How Spark Rack Uses Personal Information

9.1 Providing the Services

Spark Rack may use Personal Information to:

1. Create and maintain Accounts;
2. Authenticate users;
3. Provision Services;
4. Manage hosting, network, domain, DNS, email, storage, backup, and security Services;
5. Configure Services;
6. Process changes and upgrades;
7. Process cancellations;
8. Manage renewals;
9. Provide licenses;
10. Perform migrations;
11. Perform backups and restorations;
12. Provide monitoring;
13. Perform Customer-requested administration;
14. Communicate service status;
15. Fulfill contractual obligations; and
16. Otherwise provide the Services requested by Customer.

9.2 Billing and Payment

Spark Rack may use Personal Information to:

1. Generate invoices;
2. Process payments;
3. Apply account credits;
4. Issue refunds;
5. Calculate taxes;
6. Validate tax exemptions;
7. Reconcile transactions;
8. Address failed payments;
9. Manage chargebacks;
10. Collect overdue balances;
11. Prevent payment fraud;
12. Maintain financial records; and
13. Comply with accounting and tax obligations.

9.3 Customer Support

Spark Rack may use Personal Information to:

1. Respond to questions;
2. Investigate technical issues;
3. Troubleshoot Services;
4. Verify Account ownership;
5. Restore access;
6. Perform remote support;
7. Review logs or screenshots provided by Customer;
8. Document solutions;
9. Communicate concerning incidents;
10. Provide service guidance;
11. Escalate support requests;
12. Train personnel using internal procedures that do not involve artificial-intelligence or model training;
13. Maintain support history; and
14. Improve support procedures through human review and traditional administrative analysis.

9.4 Security and Fraud Prevention

Spark Rack may use Personal Information to:

1. Authenticate users;
2. Enforce multifactor authentication;
3. Detect suspicious login activity using predefined rules;
4. Identify known malicious traffic;
5. Prevent unauthorized access;
6. Investigate compromised Accounts;
7. Investigate phishing, malware, Spam, or other Abuse;
8. Mitigate denial-of-service attacks;
9. Protect the Spark Rack Network;
10. Block known malicious sources;
11. Enforce security policies;
12. Verify identity or authority;
13. Prevent payment fraud;
14. Protect Customer Data;
15. Preserve evidence of security incidents;
16. Coordinate with affected providers;
17. Respond to emergencies;
18. Enforce the Terms of Service and Acceptable Use Policy; and
19. Protect the rights, safety, systems, and property of Spark Rack, Customers, End Users, and third parties.

9.5 Communications

Spark Rack may use Personal Information to send:

1. Account notices;
2. Authentication notices;
3. Billing notices;
4. Invoice notices;
5. Payment notices;
6. Renewal notices;
7. Expiration notices;
8. Service-status notices;
9. Maintenance notices;
10. Security notices;
11. Abuse notices;
12. Policy updates;
13. Legal notices;
14. Support responses;
15. Product or Service announcements;
16. Customer-requested information; and
17. Other communications reasonably related to the Account or Services.

9.6 Legal and Compliance Purposes

Spark Rack may use Personal Information to:

1. Comply with law;
2. Respond to valid legal process;
3. Respond to governmental requests;
4. Comply with tax and accounting obligations;
5. Enforce agreements;
6. Resolve disputes;
7. Establish, exercise, or defend legal claims;
8. Investigate suspected violations;
9. Respond to copyright or trademark complaints;
10. Respond to privacy requests;
11. Meet records-retention requirements;
12. Comply with sanctions and export restrictions;
13. Protect legal rights;
14. Respond to emergencies involving danger of death or serious physical injury; and
15. Cooperate with legally authorized authorities.

9.7 Business Administration

Spark Rack may use Personal Information to:

1. Maintain business records;
2. Manage vendor relationships;
3. Manage contracts;
4. Conduct financial planning;
5. Perform internal audits;
6. Maintain insurance;
7. Evaluate operational performance using non-AI methods;
8. Plan capacity;
9. Improve traditional workflows;
10. Document procedures;
11. Manage personnel;
12. Protect business continuity;
13. Evaluate a merger, acquisition, financing, restructuring, or sale; and
14. Operate Spark Rack’s business.

9.8 Service Improvement Without AI

Spark Rack may use limited operational information to improve reliability, usability, documentation, support procedures, security, and service performance through:

1. Human review;
2. Traditional statistical reporting;
3. Rule-based analysis;
4. Aggregate capacity measurement;
5. Error counting;
6. Performance testing;
7. Manual quality assurance;
8. Configuration review;
9. Incident postmortems;
10. Customer-request analysis;
11. Service-availability measurement; and
12. Other non-AI administrative methods.

Spark Rack does not use service-improvement information for artificial-intelligence training, model development, behavioral advertising, or consumer profiling.

10. Legal Bases for Processing

Where Applicable Law requires Spark Rack to identify a legal basis for Processing, Spark Rack may rely on one or more of the following:

10.1 Performance of a Contract

Processing may be necessary to enter into or perform a contract, including to:

1. Create an Account;
2. Process an Order;
3. Provide Services;
4. Process payment;
5. Provide support;
6. Manage renewals;
7. Process cancellation; and
8. Communicate concerning the contractual relationship.

10.2 Legitimate Interests

Processing may be necessary for legitimate interests, including:

1. Protecting the Services;
2. Preventing fraud;
3. Securing Accounts;
4. Managing the Spark Rack Network;
5. Responding to support requests;
6. Maintaining business records;
7. Improving non-AI operational processes;
8. Protecting legal rights;
9. Managing business relationships;
10. Preventing Abuse;
11. Planning capacity;
12. Ensuring service reliability; and
13. Operating Spark Rack’s business.

Where required, Spark Rack considers whether those interests are overridden by the rights and interests of the affected individual.

10.3 Legal Obligation

Processing may be necessary to comply with:

1. Tax obligations;
2. Accounting requirements;
3. Legal process;
4. Regulatory requirements;
5. Sanctions requirements;
6. Export controls;
7. Data-breach requirements;
8. Records-retention requirements;
9. Consumer-protection requirements; and
10. Other Applicable Law.

10.4 Consent

Spark Rack may rely on consent where legally required or appropriate. An individual may withdraw consent at any time, subject to legal and contractual limitations and without affecting Processing performed before withdrawal.

10.5 Protection of Vital Interests

Spark Rack may process Personal Information when reasonably necessary to protect a person’s life, physical safety, or other vital interests.

10.6 Establishment or Defense of Legal Claims

Spark Rack may process Personal Information when reasonably necessary to establish, exercise, investigate, or defend legal rights or claims.

11. Customer Content

11.1 Customer Control

Customer generally determines what Customer Content is submitted to or processed through the Services.

Spark Rack does not determine the contents of Customer websites, databases, mailboxes, applications, backups, or other Customer-controlled systems.

11.2 Limited Access

Spark Rack personnel may access Customer Content only when reasonably necessary to:

1. Provide Customer-requested support;
2. Perform managed services;
3. Perform migrations or restorations;
4. Investigate a security incident;
5. Address suspected Abuse;
6. Protect the Services;
7. Comply with law;
8. Respond to an emergency;
9. Enforce applicable agreements; or
10. Perform another authorized operational function.

11.3 No Ownership Claim

Spark Rack does not claim ownership of Customer Content.

Customer grants Spark Rack only the limited rights reasonably necessary to host, store, transmit, secure, back up, restore, migrate, and otherwise process Customer Content for the purpose of providing and protecting the Services.

11.4 No AI Use of Customer Content

Customer Content is never authorized for use in artificial-intelligence training, machine-learning training, model development, model evaluation, prompt processing, data labeling, synthetic-data creation, or any other AI-related purpose.

11.5 Customer Privacy Requests

When Spark Rack processes Personal Information solely on Customer’s behalf, an individual should ordinarily direct a privacy request to the applicable Customer.

When legally required and reasonably possible, Spark Rack will assist Customer in responding to verified privacy requests.

12. Cookies and Similar Technologies

12.1 Types of Cookies

Spark Rack may use first-party cookies and similar technologies that are reasonably necessary to:

1. Maintain secure sessions;
2. Authenticate users;
3. Prevent cross-site request forgery;
4. Remember language or interface preferences;
5. Maintain shopping-cart or checkout state;
6. Remember cookie preferences;
7. Protect against fraud;
8. Balance traffic;
9. Maintain service continuity;
10. Measure basic first-party service performance;
11. Diagnose errors; and
12. Provide requested website and Customer Portal functionality.

12.2 No Advertising Cookies

Spark Rack does not use third-party advertising cookies, behavioral-advertising pixels, data-broker tags, or cross-site tracking technologies to create advertising profiles.

12.3 No AI Processing of Cookie Information

Cookie, session, device, and website-usage information is not used or disclosed for artificial-intelligence or machine-learning training.

12.4 Browser Controls

Users may control cookies through browser or device settings. Blocking strictly necessary cookies may prevent parts of the website or Customer Portal from functioning correctly.

12.5 Do Not Track

Because Spark Rack does not use Personal Information for cross-context behavioral advertising, Spark Rack does not build advertising profiles in response to browser activity.

Browser “Do Not Track” settings may not operate consistently across browsers and websites. Spark Rack nevertheless limits tracking to the operational and functional purposes described in this Policy.

12.6 Global Privacy Control

Spark Rack does not sell Personal Information or share it for cross-context behavioral advertising.

Where Spark Rack receives a legally recognized Global Privacy Control or similar preference signal, Spark Rack treats the signal consistently with its existing practice of not selling or sharing Personal Information for targeted advertising.

13. Payment Information

Payments may be processed by an authorized payment processor.

When a payment processor is used:

1. Payment-card information may be submitted directly to the processor;
2. Spark Rack may receive a payment token rather than a complete card number;
3. Spark Rack may receive payment status, card type, expiration information, billing address, partial card information, and transaction identifiers;
4. The payment processor processes information under its own applicable privacy and security terms; and
5. Spark Rack uses the received information to administer billing, refunds, disputes, fraud prevention, and financial records.

Spark Rack does not authorize payment processors to use Personal Information for artificial-intelligence or machine-learning training.

14. Domain Registration and Public Registration Data

Domain registration is subject to requirements imposed by registrars, registries, dispute-resolution providers, and applicable Internet-governance authorities.

Information required to register or manage a domain may be transmitted to:

1. The applicable registrar;
2. The applicable registry;
3. Registry operators;
4. Domain privacy or proxy providers;
5. Escrow providers;
6. Domain-dispute providers;
7. Internet-governance authorities;
8. Lawful requestors; and
9. Other parties required to complete or maintain the registration.

Some domain-registration information may be made publicly available where required by applicable registration rules or where privacy or proxy services are not available or selected.

Customer is responsible for supplying accurate registration information and determining whether domain privacy or proxy services are appropriate.

Spark Rack does not authorize registrars, registries, or domain partners to use domain-registration information for artificial-intelligence or model training.

15. Email and Messaging Information

Spark Rack may process email and messaging metadata necessary to provide and secure messaging Services, including:

1. Sender and recipient addresses;
2. Message identifiers;
3. Delivery timestamps;
4. Delivery status;
5. Bounce information;
6. Spam-filter results;
7. Malware-filter results;
8. Authentication results;
9. Sending IP address;
10. Receiving IP address;
11. Mailbox usage;
12. Message size;
13. Queue status;
14. Complaint information; and
15. Other information required for message delivery and security.

Message content may be processed or temporarily stored as required to transmit, filter, deliver, quarantine, back up, restore, or troubleshoot messages.

Spark Rack does not use message content or metadata for advertising, profiling, artificial-intelligence training, or machine-learning model development.

16. Support and Remote Access

When Customer requests support, Customer may provide Spark Rack with temporary credentials, screenshots, logs, files, or remote access.

Spark Rack will use such access only for authorized support, security, administration, migration, restoration, or troubleshooting purposes.

Customer should:

1. Avoid including unnecessary Personal Information in support tickets;
2. Avoid sending passwords through ordinary email;
3. Use secure credential-sharing methods where available;
4. Revoke temporary credentials after support is complete;
5. Rotate credentials when appropriate;
6. Remove unrelated sensitive information from logs or screenshots;
7. Notify affected users before remote access where appropriate; and
8. Maintain backups before material administrative work.

Support communications and materials are not used for artificial-intelligence or model training.

17. Monitoring and Network Security

Spark Rack may monitor systems and network activity to:

1. Maintain availability;
2. Measure resource usage;
3. Detect known threats;
4. Enforce rate limits;
5. Prevent unauthorized access;
6. Mitigate denial-of-service attacks;
7. Troubleshoot technical issues;
8. Investigate Abuse;
9. Protect Customer Data;
10. Maintain routing and network integrity;
11. Respond to security incidents;
12. Comply with legal obligations;
13. Manage capacity; and
14. Provide managed or monitored Services.

Security monitoring may include traditional signature-based detection, predefined rules, firewall controls, rate limits, authentication monitoring, resource thresholds, and human review.

Spark Rack does not use artificial intelligence or machine-learning models to monitor, classify, profile, or make decisions concerning customer or consumer activity.

18. How Spark Rack Discloses Personal Information

Spark Rack discloses Personal Information only as reasonably necessary for the purposes described in this Privacy Policy, as directed by Customer, or as required or permitted by Applicable Law.

18.1 Service Providers

Spark Rack may disclose Personal Information to Service Providers that assist with:

1. Payment processing;
2. Data-center operations;
3. Network connectivity;
4. Domain registration;
5. DNS infrastructure;
6. Email delivery;
7. Software licensing;
8. Storage;
9. Backup infrastructure;
10. Security services;
11. Identity verification;
12. Fraud prevention;
13. Accounting;
14. Tax administration;
15. Legal services;
16. Insurance;
17. Auditing;
18. Customer support infrastructure;
19. Business communications;
20. Shipping or delivery where applicable; and
21. Other functions reasonably necessary to operate Spark Rack.

Service Providers are authorized to process Personal Information only for the defined service being provided and are not authorized to use Spark Rack information for their own artificial-intelligence or model-training purposes.

18.2 Customer and Authorized Users

Spark Rack may disclose Account or Service information to:

1. The Account owner;
2. Authorized users;
3. Authorized Customer contacts;
4. Customer administrators;
5. Resellers responsible for the applicable Account;
6. A successor Account owner following reasonable verification; and
7. Other persons Customer directs Spark Rack to communicate with.

18.3 Registrars, Registries, and Internet Infrastructure Providers

Spark Rack may disclose information as reasonably necessary to provide domain, DNS, network, address-space, routing, certificate, or Internet-infrastructure services.

18.4 Legal and Governmental Disclosures

Spark Rack may disclose Personal Information when it reasonably believes disclosure is necessary to:

1. Comply with valid legal process;
2. Respond to a lawful governmental request;
3. Comply with a court order;
4. Comply with a subpoena or warrant;
5. Comply with tax or regulatory obligations;
6. Respond to an emergency involving danger of death or serious physical injury;
7. Investigate or prevent fraud;
8. Investigate or prevent Abuse;
9. Protect rights, safety, property, systems, or data;
10. Enforce Spark Rack’s agreements;
11. Establish or defend legal claims;
12. Comply with sanctions or export controls;
13. Respond to child-safety concerns;
14. Respond to intellectual-property complaints; or
15. Otherwise comply with Applicable Law.

18.5 Business Transfers

Personal Information may be disclosed in connection with an actual or proposed:

1. Merger;
2. Acquisition;
3. Financing;
4. Reorganization;
5. Restructuring;
6. Sale of assets;
7. Sale of a business unit;
8. Transfer of Services;
9. Bankruptcy;
10. Receivership; or
11. Similar business transaction.

A recipient of Personal Information in such a transaction will be expected to process the information consistently with applicable law and contractual obligations.

18.6 Professional Advisers

Spark Rack may disclose Personal Information to attorneys, accountants, auditors, insurers, financial advisers, consultants, and other professional advisers subject to appropriate duties of confidentiality.

18.7 With Consent or Direction

Spark Rack may disclose Personal Information when the individual or Customer requests, directs, or consents to the disclosure.

19. No Sale, Rental, or Behavioral Advertising

Spark Rack does not sell Personal Information.

Spark Rack does not rent Personal Information.

Spark Rack does not share Personal Information for cross-context behavioral advertising.

Spark Rack does not disclose Personal Information to data brokers.

Spark Rack does not exchange Personal Information for advertising, marketing profiles, or artificial-intelligence development.

Spark Rack does not use Personal Information for targeted advertising based on activity across unrelated websites, applications, or services.

20. Categories of Third Parties Receiving Information

Depending on the Services and circumstances, categories of recipients may include:

1. Payment processors;
2. Banks and financial institutions;
3. Fraud-prevention providers;
4. Identity-verification providers;
5. Data-center providers;
6. Network carriers;
7. Transit providers;
8. Peering partners;
9. Domain registrars;
10. Domain registries;
11. DNS providers;
12. Certificate authorities;
13. Software licensors;
14. Storage and backup providers;
15. Email-delivery providers;
16. Security providers;
17. Monitoring providers;
18. Customer-support infrastructure providers;
19. Accounting providers;
20. Tax advisers;
21. Auditors;
22. Insurers;
23. Attorneys;
24. Consultants;
25. Government agencies;
26. Courts;
27. Law-enforcement agencies;
28. Intellectual-property claimants;
29. Emergency-response organizations;
30. Successors in a business transaction;
31. Customer-authorized recipients; and
32. Other recipients permitted or required by Applicable Law.

No recipient is authorized by Spark Rack to use Personal Information or Customer Data for artificial-intelligence or model training.

21. Service Provider Requirements

Where appropriate, Spark Rack requires Service Providers to:

1. Process Personal Information only for defined purposes;
2. Follow Spark Rack’s documented instructions;
3. Maintain confidentiality;
4. Use reasonable security measures;
5. Limit access to authorized personnel;
6. Notify Spark Rack of relevant security incidents;
7. Assist with privacy requests where required;
8. Delete or return information when no longer required;
9. Comply with Applicable Law;
10. Not sell Personal Information;
11. Not share Personal Information for targeted advertising;
12. Not combine information for unauthorized purposes;
13. Not retain information beyond the authorized purpose;
14. Not disclose information to unauthorized third parties;
15. Not use information for artificial-intelligence training;
16. Not use information for machine-learning development;
17. Not use information for model evaluation or improvement;
18. Not use information for profiling;
19. Not use information to create synthetic datasets; and
20. Apply equivalent restrictions to authorized subprocessors.

22. De-Identified and Aggregated Information

Spark Rack may create limited aggregate or de-identified operational information for purposes such as:

1. Capacity planning;
2. Availability reporting;
3. Resource measurement;
4. Security reporting;
5. Financial reporting;
6. Incident analysis;
7. Service planning;
8. Performance measurement; and
9. Internal business administration.

Spark Rack will not attempt to re-identify information represented as de-identified except when reasonably necessary to test whether de-identification controls are effective or as otherwise permitted by law.

Spark Rack does not use aggregated or de-identified Customer or consumer information for artificial-intelligence or machine-learning training.

23. Data Minimization

Spark Rack seeks to limit Personal Information to information reasonably necessary to:

1. Provide Services;
2. Maintain Accounts;
3. Process payments;
4. Protect security;
5. Prevent fraud and Abuse;
6. Comply with law;
7. Resolve disputes;
8. Maintain business records;
9. Communicate with Customers; and
10. Operate Spark Rack’s business.

Customers and users should avoid submitting unnecessary Personal Information, credentials, or Sensitive Personal Information through support tickets, email, or other communications.

24. Data Retention

Spark Rack retains Personal Information only for as long as reasonably necessary for the purposes described in this Privacy Policy, to satisfy legal or contractual requirements, to resolve disputes, to maintain security, and to enforce agreements.

Retention periods vary depending on:

1. The nature of the information;
2. The Service involved;
3. The length of the Customer relationship;
4. Contractual requirements;
5. Security needs;
6. Fraud-prevention needs;
7. Backup cycles;
8. Legal limitation periods;
9. Tax and accounting obligations;
10. Legal holds;
11. Pending disputes;
12. Applicable Law; and
13. Technical deletion schedules.

24.1 General Retention Framework

Category	General Retention Considerations
Account records	Retained while the Account is active and afterward as reasonably necessary for administration, disputes, fraud prevention, legal compliance, and enforcement.
Billing and transaction records	Retained for the period reasonably necessary to satisfy tax, accounting, payment, chargeback, audit, and legal obligations.
Support records	Retained as reasonably necessary to maintain service history, resolve recurring issues, document authorization, address disputes, and improve non-AI support procedures.
Security and authentication logs	Retained according to operational, security, incident-response, fraud-prevention, and legal requirements.
Network-flow and infrastructure logs	Retained for limited periods appropriate to troubleshooting, capacity management, security, Abuse prevention, and legal requirements.
Customer Content	Retained while required to provide the Service and deleted according to cancellation, termination, backup, and technical-deletion schedules.
Backup copies	Retained according to the applicable backup plan, rotation schedule, legal hold, and technical overwrite cycle.
Domain-registration records	Retained as required by registrars, registries, contractual obligations, domain-dispute requirements, and Applicable Law.
Legal and abuse records	Retained as reasonably necessary to document investigations, comply with law, protect rights, prevent repeat Abuse, and address legal claims.
Privacy-request records	Retained as reasonably necessary to document the request, identity verification, response, appeal, and legal compliance.
Applicant records	Retained for the applicable selection process and afterward as reasonably necessary for legal compliance, recordkeeping, or future consideration where permitted.

24.2 Account Closure

Closing an Account does not necessarily result in immediate deletion of every record.

Spark Rack may retain information after Account closure when reasonably necessary to:

1. Complete billing;
2. Process refunds;
3. Address chargebacks;
4. Comply with tax requirements;
5. Comply with legal obligations;
6. Resolve disputes;
7. Enforce agreements;
8. Prevent fraud;
9. Prevent repeat Abuse;
10. Maintain security;
11. Respond to legal process;
12. Preserve records subject to legal hold; or
13. Complete ordinary backup and deletion cycles.

24.3 Backup Retention

Deleted information may remain temporarily in backups, disaster-recovery systems, system snapshots, caches, logs, or residual storage until overwritten or removed through ordinary retention cycles.

Backup copies are not restored for ordinary operational use after deletion unless needed for disaster recovery, security, legal compliance, or another authorized purpose.

25. Deletion and Disposal

When Personal Information is no longer reasonably necessary, Spark Rack may delete, destroy, anonymize, aggregate, overwrite, or otherwise dispose of it using methods appropriate to the nature of the information and the systems involved.

Deletion may occur through:

1. Database deletion;
2. Account-record deletion;
3. Cryptographic erasure;
4. Secure overwrite;
5. Media destruction;
6. Backup expiration;
7. Log rotation;
8. Token revocation;
9. Credential invalidation;
10. De-identification; or
11. Another reasonable technical or physical method.

26. Data Security

Spark Rack uses reasonable administrative, technical, and physical safeguards appropriate to the nature of the information and the Services.

Safeguards may include:

1. Access controls;
2. Role-based permissions;
3. Unique administrative credentials;
4. Multifactor authentication;
5. Password-security requirements;
6. Encryption in transit where supported;
7. Encryption at rest where appropriate and supported;
8. Network segmentation;
9. Firewalls;
10. Rate limiting;
11. Malware filtering;
12. Spam filtering;
13. Security logging;
14. Authentication logging;
15. Patch management;
16. Vulnerability management;
17. Backup controls;
18. Physical data-center controls;
19. Vendor review;
20. Confidentiality obligations;
21. Incident-response procedures;
22. Business-continuity procedures;
23. Credential rotation;
24. Secure disposal practices;
25. Administrative review;
26. Traditional signature-based threat detection;
27. Rule-based monitoring;
28. Human security review; and
29. Other safeguards reasonably appropriate to the Services.

No method of transmission, storage, or security can guarantee absolute security. Spark Rack cannot guarantee that Personal Information will never be accessed, disclosed, altered, lost, or destroyed through malicious activity, human error, software failure, hardware failure, or events outside Spark Rack’s reasonable control.

27. Customer Security Responsibilities

Customers are responsible for:

1. Using strong and unique passwords;
2. Enabling multifactor authentication where available;
3. Protecting credentials;
4. Restricting administrative access;
5. Removing access when no longer required;
6. Securing Customer applications;
7. Installing security updates;
8. Maintaining appropriate firewalls;
9. Configuring access controls;
10. Encrypting sensitive Customer Data where appropriate;
11. Monitoring Customer systems;
12. Maintaining independent backups;
13. Testing restoration procedures;
14. Responding promptly to security notices;
15. Rotating compromised credentials;
16. Securing endpoints and devices;
17. Obtaining appropriate user consent;
18. Limiting Customer Data to what is necessary;
19. Reviewing Customer-authorized integrations;
20. Securing API keys and private keys;
21. Not transmitting passwords through insecure channels;
22. Not storing unnecessary Sensitive Personal Information;
23. Reporting suspected compromise promptly; and
24. Complying with the Terms of Service and Acceptable Use Policy.

28. Security Incidents and Data Breaches

Spark Rack maintains procedures for evaluating and responding to suspected security incidents.

Incident-response activities may include:

1. Identifying affected systems;
2. Containing the incident;
3. Preserving relevant evidence;
4. Investigating the cause;
5. Assessing affected information;
6. Resetting credentials;
7. Revoking tokens or keys;
8. Removing malicious access;
9. Restoring systems;
10. Coordinating with Service Providers;
11. Notifying affected Customers;
12. Notifying individuals where required;
13. Notifying regulators or authorities where required;
14. Documenting the response;
15. Implementing corrective measures; and
16. Reviewing safeguards following the incident.

Notifications will be provided when and as required by Applicable Law or contractual obligations.

Customers must promptly notify Spark Rack of suspected unauthorized access involving an Account or the Services.

29. International Processing and Transfers

Spark Rack is based in the United States and primarily provides Services from the United States.

Personal Information may be processed in the United States or another location where an authorized Service Provider operates.

When Personal Information is transferred from a jurisdiction requiring specific transfer safeguards, Spark Rack may rely on:

1. Contractual transfer provisions;
2. Standard contractual clauses;
3. Data-processing agreements;
4. Adequacy decisions;
5. Consent where legally permitted;
6. Performance of a contract;
7. Legal necessity;
8. Other recognized transfer mechanisms; or
9. Another lawful basis permitted by Applicable Law.

Regardless of processing location, Spark Rack does not authorize Personal Information or Customer Data to be used for artificial-intelligence or model training.

30. Privacy Rights

Depending on residence, relationship with Spark Rack, and Applicable Law, an individual may have one or more of the following rights:

1. The right to know whether Personal Information is being processed;
2. The right to request access to Personal Information;
3. The right to request categories of Personal Information collected;
4. The right to request categories of sources;
5. The right to request purposes of Processing;
6. The right to request categories of recipients;
7. The right to request specific pieces of Personal Information;
8. The right to correct inaccurate Personal Information;
9. The right to delete Personal Information;
10. The right to obtain a portable copy of certain Personal Information;
11. The right to restrict certain Processing;
12. The right to object to certain Processing;
13. The right to withdraw consent;
14. The right to opt out of sale;
15. The right to opt out of sharing for cross-context behavioral advertising;
16. The right to opt out of targeted advertising;
17. The right to opt out of certain profiling or automated decisions;
18. The right to limit certain uses of Sensitive Personal Information;
19. The right to appeal a denial of a privacy request;
20. The right to use an authorized agent;
21. The right to receive information concerning a data breach where required;
22. The right to complain to an appropriate privacy or data-protection authority; and
23. The right not to receive unlawful discriminatory treatment for exercising a privacy right.

These rights are subject to exceptions, limitations, identity-verification requirements, and applicability thresholds under relevant law.

31. Rights Spark Rack Does Not Need to Offer as an Opt-Out

Because Spark Rack does not sell Personal Information, there is no sale from which a consumer must opt out.

Because Spark Rack does not share Personal Information for cross-context behavioral advertising, there is no such sharing from which a consumer must opt out.

Because Spark Rack does not use Personal Information for targeted advertising, there is no targeted-advertising activity from which a consumer must opt out.

Because Spark Rack does not use artificial intelligence for profiling or decisions producing legal or similarly significant effects, there is no AI-based decision-making activity from which a consumer must opt out.

Because Spark Rack does not use Personal Information or Customer Data for model training, no AI-training opt-out is required; the information is not used for that purpose in the first instance.

32. Submitting a Privacy Request

A privacy request may be submitted through the appropriate privacy, legal, account, or support channel in the Spark Rack Customer Portal.

A request may also be mailed to:

Spark Rack
Attn: Privacy Request
PO Box 2215
Valdosta, GA 31604
United States

A request should include:

1. The individual’s full name;
2. The email address associated with the Account or interaction;
3. The applicable Customer or Account information;
4. The state, province, or country of residence;
5. The specific right being exercised;
6. A clear description of the requested information or action;
7. Information reasonably necessary to locate relevant records;
8. The preferred response method; and
9. Authorized-agent documentation where applicable.

A person should not submit unnecessary government identifiers, passwords, private keys, complete payment-card information, or other sensitive credentials with a privacy request.

33. Verification of Privacy Requests

Spark Rack may take reasonable steps to verify:

1. The requester’s identity;
2. The requester’s relationship with Spark Rack;
3. Ownership or control of the relevant Account;
4. The requester’s authority to act for another person;
5. The authenticity of supporting documentation;
6. The scope of the request; and
7. Whether disclosure would adversely affect another person’s privacy or security.

Verification methods may include:

1. Confirmation through the Customer Portal;
2. Confirmation through an Account email address;
3. Confirmation using existing Account information;
4. Multifactor authentication;
5. Security questions;
6. Transaction or service information;
7. A signed declaration;
8. Proof of authority; or
9. Another reasonable method proportionate to the request.

Spark Rack may deny or limit a request when identity or authority cannot be reasonably verified.

34. Responding to Privacy Requests

Spark Rack will respond to verified privacy requests within the period required by Applicable Law.

Spark Rack may extend the response period where permitted and reasonably necessary due to complexity or volume.

Spark Rack may deny, limit, or charge a reasonable fee for a request where permitted by law, including when the request is:

1. Manifestly unfounded;
2. Excessive;
3. Repetitive;
4. Fraudulent;
5. Impossible to verify;
6. Likely to impair another person’s rights;
7. Likely to compromise security;
8. Subject to legal privilege;
9. Inconsistent with a legal obligation;
10. Inconsistent with a lawful retention requirement;
11. Directed to information Spark Rack processes solely for Customer; or
12. Otherwise exempt under Applicable Law.

When Spark Rack denies a request, Spark Rack will provide an explanation where required by law.

35. Authorized Agents

Where permitted by Applicable Law, an individual may authorize an agent to submit a privacy request.

Spark Rack may require:

1. Written and signed authorization;
2. Verification of the individual’s identity;
3. Verification of the agent’s identity;
4. Proof of the agent’s authority;
5. Direct confirmation from the individual; or
6. A valid power of attorney or equivalent legal authority.

Spark Rack may deny an agent request when authority cannot be reasonably verified.

36. Appeals

Where Applicable Law provides a right to appeal, an individual may appeal a denied privacy request through the same channel used to submit the original request.

The appeal should identify:

1. The original request;
2. The date of the response;
3. The reason the requester believes the decision was incorrect; and
4. Any additional supporting information.

Spark Rack will review and respond to the appeal within the period required by Applicable Law.

37. Non-Discrimination

Spark Rack will not unlawfully discriminate against an individual for exercising an applicable privacy right.

Subject to legal and contractual limitations, Spark Rack will not unlawfully:

1. Deny Services;
2. Charge a different price;
3. Provide a different quality of Service;
4. Retaliate against an individual;
5. Threaten an individual; or
6. Otherwise penalize an individual

because the individual exercised a privacy right.

Spark Rack may be unable to continue providing a Service when the requested deletion or restriction removes information reasonably necessary to provide that Service.

38. California Privacy Disclosures

38.1 Categories Collected

Depending on the relationship and Services used, Spark Rack may collect categories of Personal Information described under California law, including:

1. Identifiers;
2. Customer-record information;
3. Commercial information;
4. Internet or other electronic-network activity information;
5. Geolocation information at a general level based on IP address;
6. Professional or employment-related information;
7. Audio, electronic, visual, or similar information submitted through support or business communications;
8. Sensitive Personal Information when reasonably necessary for verification, payment, security, legal compliance, or Customer-directed Services; and
9. Other information linked or reasonably linkable to an individual or household.

38.2 Business Purposes

Spark Rack may collect, use, or disclose these categories for:

1. Providing Services;
2. Processing transactions;
3. Maintaining Accounts;
4. Providing support;
5. Maintaining security;
6. Preventing fraud and Abuse;
7. Debugging and troubleshooting;
8. Maintaining service quality;
9. Performing internal administration;
10. Complying with law;
11. Protecting legal rights;
12. Managing business relationships; and
13. Other purposes described in this Privacy Policy.

38.3 No Sale or Sharing

Spark Rack has not sold Personal Information and does not sell Personal Information.

Spark Rack has not shared Personal Information for cross-context behavioral advertising and does not share Personal Information for cross-context behavioral advertising.

Spark Rack does not have actual knowledge that it sells or shares the Personal Information of consumers under sixteen years of age.

38.4 Sensitive Personal Information

Spark Rack uses Sensitive Personal Information only for permitted operational, security, payment, verification, legal, and Customer-directed purposes.

Spark Rack does not use Sensitive Personal Information to infer characteristics about consumers.

Spark Rack does not use Sensitive Personal Information for advertising, profiling, or artificial-intelligence training.

38.5 California Rights

Subject to applicable exceptions, California consumers may have rights to:

1. Know categories of Personal Information collected;
2. Know categories of sources;
3. Know business or commercial purposes;
4. Know categories of recipients;
5. Access specific pieces of Personal Information;
6. Correct inaccurate Personal Information;
7. Delete Personal Information;
8. Opt out of sale or sharing;
9. Limit certain uses of Sensitive Personal Information; and
10. Receive equal service and pricing.

Spark Rack does not sell or share Personal Information and does not use Sensitive Personal Information to infer characteristics.

39. Other United States State Privacy Rights

Residents of certain United States states may have rights concerning:

1. Access;
2. Confirmation of Processing;
3. Correction;
4. Deletion;
5. Data portability;
6. Opt-out of sale;
7. Opt-out of targeted advertising;
8. Opt-out of certain profiling;
9. Consent for certain Sensitive Personal Information;
10. Appeal of a denied request; and
11. Non-discrimination.

Spark Rack applies these rights when the applicable law covers Spark Rack, the individual, and the relevant Processing.

Spark Rack does not sell Personal Information, use Personal Information for targeted advertising, or use artificial intelligence for profiling or significant decisions.

40. European Economic Area, United Kingdom, and Switzerland

Individuals located in the European Economic Area, United Kingdom, or Switzerland may have rights to:

1. Access Personal Information;
2. Correct inaccurate Personal Information;
3. Request deletion;
4. Restrict Processing;
5. Object to Processing;
6. Receive certain Personal Information in a portable format;
7. Withdraw consent;
8. Object to direct marketing;
9. Receive information concerning international transfers;
10. Not be subject to certain solely automated decisions; and
11. Submit a complaint to an applicable supervisory authority.

Spark Rack does not use artificial intelligence or solely automated model-based decision-making to produce legal or similarly significant effects.

When Spark Rack acts solely as Customer’s processor, the individual should ordinarily direct the request to Customer as the relevant controller.

41. Canadian Privacy Rights

Individuals in Canada may have rights, subject to Applicable Law, to:

1. Request access to Personal Information;
2. Request correction;
3. Withdraw consent subject to legal or contractual limitations;
4. Request information concerning Spark Rack’s privacy practices;
5. Challenge compliance with applicable privacy principles; and
6. Submit a complaint to an applicable privacy authority.

42. Children’s Privacy

The Services are not directed to children under thirteen years of age.

Individuals under eighteen years of age may not create an Account or purchase Services unless legally authorized and supervised by a parent, guardian, school, business, or other responsible organization permitted to enter into the applicable agreement.

Spark Rack does not knowingly collect Personal Information directly from a child under thirteen through a child-directed Service.

Spark Rack does not:

1. Sell children’s Personal Information;
2. Share children’s Personal Information for behavioral advertising;
3. Use children’s Personal Information for targeted advertising;
4. Use children’s Personal Information for artificial-intelligence training;
5. Use children’s Personal Information for machine-learning model development; or
6. Use artificial intelligence to profile children.

If Spark Rack learns that it collected Personal Information directly from a child in a manner prohibited by law, Spark Rack will take reasonable steps to delete the information or obtain legally sufficient authorization.

A parent or guardian who believes a child has provided Personal Information directly to Spark Rack may submit a privacy request using the contact information in this Policy.

Customer is responsible for determining whether Customer’s own websites, applications, or Services are directed to children and for complying with all applicable parental-consent, notice, deletion, security, and data-minimization requirements.

43. Communications and Marketing Preferences

Spark Rack may send transactional and service-related communications that are necessary to administer an Account or provide Services.

These communications may include:

1. Invoices;
2. Payment notices;
3. Renewal notices;
4. Expiration notices;
5. Security alerts;
6. Authentication notices;
7. Maintenance notices;
8. Service-status notices;
9. Legal notices;
10. Policy changes;
11. Support responses;
12. Abuse notices;
13. Domain notices;
14. Account notices; and
15. Other operational communications.

Because these communications are necessary for the relationship, an individual may not be able to opt out of them while maintaining an active Account or Service.

Where Spark Rack sends optional promotional communications, recipients may unsubscribe using the method included in the message or through available Account preferences.

Unsubscribing from optional promotional communications does not stop transactional or service-related communications.

Communication information is not used for artificial-intelligence or model training.

44. Telephone, SMS, and Call Information

When an individual communicates with Spark Rack by telephone or SMS, Spark Rack may process:

1. Telephone number;
2. Call or message date and time;
3. Call duration;
4. Message content;
5. Voicemail content;
6. Delivery status;
7. Support notes;
8. Consent records where applicable; and
9. Other information voluntarily provided.

Calls are not recorded unless notice or consent required by Applicable Law is provided.

Telephone, SMS, and call information is not used for voice-model training, speech-model training, artificial intelligence, or machine learning.

45. Social Media and Public Communications

Information posted publicly on social media, public forums, public reviews, or other public channels may be visible to Spark Rack and the public.

Spark Rack may process public communications to:

1. Respond to questions;
2. Address support matters;
3. Protect Spark Rack’s rights;
4. Investigate Abuse;
5. Respond to misinformation concerning a specific Account or incident;
6. Maintain business records; or
7. Engage with the public.

Public communications should not contain passwords, private keys, payment-card information, Account-recovery information, or other sensitive credentials.

Spark Rack does not collect public communications for artificial-intelligence or model training.

46. Third-Party Websites and Services

The Services may contain links to or integrations with third-party websites or services.

Spark Rack does not control the privacy, security, content, or practices of independent third parties.

Users should review the applicable privacy policies and terms before providing Personal Information to a third party.

A link or integration does not mean Spark Rack authorizes the third party to use Spark Rack Personal Information or Customer Data for artificial-intelligence or model training.

47. Information Submitted to Third Parties by Customer

Customer may independently configure the Services to transmit Customer Data to third parties.

Examples may include:

1. External email providers;
2. External backup destinations;
3. Analytics services;
4. Content-delivery networks;
5. Payment providers;
6. Customer relationship platforms;
7. Remote monitoring services;
8. Security services;
9. Software integrations;
10. Webhooks;
11. APIs;
12. External storage;
13. Customer-selected artificial-intelligence services; and
14. Other Customer-controlled destinations.

Customer is responsible for reviewing and authorizing such integrations and for determining how the third party processes Customer Data.

Spark Rack’s prohibition on artificial-intelligence training applies to Spark Rack and parties processing information on Spark Rack’s behalf. Spark Rack cannot control a third party independently selected, configured, or instructed by Customer.

48. Employee and Contractor Access

Spark Rack limits personnel access to Personal Information according to role, responsibility, and legitimate business need.

Personnel with access may be required to:

1. Maintain confidentiality;
2. Use unique credentials;
3. Use multifactor authentication;
4. Follow access-control requirements;
5. Use approved systems;
6. Protect devices;
7. Report security incidents;
8. Avoid unnecessary copying;
9. Avoid unauthorized disclosure;
10. Follow secure disposal procedures;
11. Use information only for authorized duties;
12. Not submit Personal Information or Customer Data to public or private AI systems;
13. Not use Personal Information or Customer Data for model training;
14. Not use AI tools to review support tickets or Customer Content;
15. Not use AI tools to generate decisions concerning Customers; and
16. Return or delete information when access is no longer required.

49. Government and Law-Enforcement Requests

Spark Rack reviews governmental and law-enforcement requests for legal sufficiency and appropriate scope.

Where legally permitted and reasonably appropriate, Spark Rack may:

1. Require valid legal process;
2. Seek clarification;
3. Challenge an overbroad request;
4. Limit disclosure to responsive information;
5. Notify Customer;
6. Preserve relevant information;
7. Document the request and response; and
8. Seek reimbursement of legally recoverable costs.

Spark Rack may delay or withhold notice when notice is legally prohibited, would create a risk of harm, would compromise an investigation, or would be otherwise inappropriate under the circumstances.

50. Legal Holds

Spark Rack may preserve Personal Information beyond ordinary retention periods when it reasonably believes the information is relevant to:

1. Pending or anticipated litigation;
2. Arbitration;
3. A governmental investigation;
4. A security incident;
5. An Abuse investigation;
6. A preservation request;
7. A legal claim;
8. An insurance matter;
9. A contractual dispute; or
10. Another legally significant matter.

A legal hold may delay deletion until the hold is released.

51. Business Continuity and Disaster Recovery

Personal Information may be copied to backup, redundancy, disaster-recovery, or business-continuity systems.

Such copies are used only to:

1. Restore systems;
2. Recover from failure;
3. Maintain service continuity;
4. Protect against data loss;
5. Respond to security incidents;
6. Meet legal obligations; and
7. Support authorized backup Services.

Backup and disaster-recovery information is not used for artificial-intelligence or model training.

52. Privacy by Design

When developing or modifying Services and business processes, Spark Rack may consider:

1. Purpose limitation;
2. Data minimization;
3. Access controls;
4. Retention limits;
5. Deletion procedures;
6. Security safeguards;
7. Customer control;
8. Transparency;
9. Service Provider restrictions;
10. Incident response;
11. Legal compliance;
12. Human oversight;
13. Traditional non-AI operational methods; and
14. The prohibition against artificial-intelligence and model-training use.

53. Accuracy of Personal Information

Customers and authorized users are responsible for keeping Account and contact information accurate and current.

Information may be updated through the Customer Portal or by submitting an appropriate support or privacy request.

Spark Rack may request verification before changing:

1. Account ownership;
2. Primary email address;
3. Billing information;
4. Authorized contacts;
5. Domain registrant information;
6. Multifactor-authentication settings;
7. Recovery information; or
8. Other security-sensitive information.

54. Information Spark Rack Does Not Intentionally Collect

Unless specifically required for an authorized purpose, Spark Rack does not intentionally request or collect:

1. Complete payment-card security codes;
2. Passwords for unrelated third-party accounts;
3. Unnecessary Social Security numbers;
4. Unnecessary government identifiers;
5. Genetic information;
6. Biometric templates;
7. Precise geolocation unrelated to a Service;
8. Medical records unrelated to a legal or accessibility request;
9. Information concerning religious beliefs;
10. Information concerning sexual orientation;
11. Information concerning political affiliation;
12. Private communications unrelated to the Services;
13. Children’s Personal Information;
14. Information for advertising profiles;
15. Information for data brokerage;
16. Information for artificial-intelligence training; or
17. Information for machine-learning model development.

Individuals should not submit such information unless it is necessary for a specific authorized purpose.

55. Accessibility and Accommodation Information

When an individual requests an accessibility accommodation, Spark Rack may process information reasonably necessary to understand and provide the requested accommodation.

Spark Rack will limit use of such information to:

1. Providing the accommodation;
2. Communicating concerning the request;
3. Documenting compliance;
4. Protecting legal rights; and
5. Meeting Applicable Law.

Accessibility information is not used for advertising, profiling, artificial intelligence, or model training.

56. Changes to This Privacy Policy

Spark Rack may update this Privacy Policy to reflect:

1. Changes to the Services;
2. Changes to privacy practices;
3. Changes to Applicable Law;
4. Changes to security requirements;
5. Changes to Service Providers;
6. Changes to business operations;
7. Clarifications;
8. New privacy rights;
9. New operational requirements; or
10. Other developments affecting the Processing of Personal Information.

The updated Policy will display a revised “Last Updated” date.

Spark Rack will provide additional notice of material changes when required by Applicable Law or reasonably appropriate under the circumstances.

Spark Rack will not change this Privacy Policy to authorize the use of Personal Information or Customer Data for artificial-intelligence or model training without providing clear advance notice and obtaining any consent required by Applicable Law. Spark Rack’s current policy and practice prohibit such use entirely.

57. Conflicts with Other Agreements

If a signed data-processing agreement or other specialized privacy agreement conflicts with this Privacy Policy, the signed agreement controls for the specific Processing it governs.

No agreement, Order, integration, or Service Provider arrangement authorizes the use of Personal Information or Customer Data for artificial-intelligence or model training unless Spark Rack expressly agrees in a separately signed written amendment that specifically identifies and modifies the prohibition in this Privacy Policy.

58. Contact Information

Questions, concerns, privacy requests, or complaints concerning this Privacy Policy may be submitted through the appropriate privacy, legal, account, or support channel in the Spark Rack Customer Portal.

Written correspondence may be mailed to:

Spark Rack
Attn: Privacy
PO Box 2215
Valdosta, GA 31604
United States

59. Customer and User Acknowledgment

By creating an Account, submitting an Order, accessing the Customer Portal, visiting a Spark Rack website, communicating with Spark Rack, or using the Services, Customer and each authorized user acknowledge that:

1. They have been provided this Privacy Policy;
2. They understand the categories of information Spark Rack may process;
3. They understand the purposes described in this Privacy Policy;
4. They understand that Spark Rack does not sell Personal Information;
5. They understand that Spark Rack does not share Personal Information for cross-context behavioral advertising;
6. They understand that Spark Rack does not use artificial intelligence in its products or Services;
7. They understand that Spark Rack does not use Personal Information or Customer Data for artificial-intelligence or machine-learning training;
8. They understand that Spark Rack does not authorize any Service Provider, partner, contractor, or third party to use Personal Information or Customer Data for artificial-intelligence or model training;
9. They understand their responsibility to protect Account credentials and Customer Data;
10. They understand that Customer is responsible for privacy compliance concerning Customer-controlled websites, applications, and End Users;
11. They understand that privacy rights may be subject to verification and legal exceptions; and
12. They may contact Spark Rack using the methods provided in this Privacy Policy.