Privacy policy
Last updated: 13 October 2026
This policy explains how SparkCore.investment OÜ (“SparkCore”, “we”) processes personal data when you visit sparkcore.fund, contact us, subscribe to our newsletter, book a call, or become an investor in one of our funds, in accordance with Regulation (EU) 2016/679 (GDPR).
1. Data controller
- Controller
- SparkCore.investment OÜ
- Registry code
- 16265864 (Estonian Commercial Register)
- Address
- Männimäe 1, Pudisoo, 74626 Harju County, Estonia
- Contact
- [email protected]
Our regulatory status is described on the regulatory information page.
2. Data we collect on this website
| Channel | Data | Purpose | Legal basis |
|---|---|---|---|
| Contact form | First name, last name, email, phone number (optional), how you heard about us, campaign of the link that brought you to the website, language, IP address | Answering your request, sending information on our funds, following up | Steps taken at your request before a contract (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) |
| Newsletter | Email address, language, date you confirmed your subscription, campaign of the link that brought you to the website; email opens and link clicks | Sending our monthly market analysis; measuring the interest of our emails | Consent (Art. 6(1)(a)); legitimate interest for the measurement (Art. 6(1)(f)) |
| Call booking | Name, email, chosen time slot, any message you add | Organising the call | Steps taken at your request (Art. 6(1)(b)) |
| Audience measurement | Pseudonymous browsing data (pages viewed, device, approximate location) | Understanding how the site is used | Consent (Art. 6(1)(a)); only after you accept |
| Technical and security data | IP address, browser, request metadata, anti-bot signals | Delivering, securing and monitoring the website | Legitimate interest (Art. 6(1)(f)) |
A subscription through the website's newsletter form is confirmed by a link sent to the address entered: nothing is sent to you before that click, and the date of the confirmation is kept as proof of your consent. If you contact us through the contact form, we may also send you our monthly newsletter, on the basis of our legitimate interest in informing you about our funds (Art. 6(1)(f)). You can unsubscribe at any time with the link included in every email.
When you arrive on the website through a link of our emails and accept the cookies, the campaign of that link (for example "nl-12-en") is kept by your browser for the visit and attached to a form you may send; nothing is transmitted if you send no form.
Measuring opens and clicks. Our newsletter and our communications to investors contain an invisible image and redirect links that tell us, for each address, whether the email was opened, which links were clicked and when. This information is stored on our own servers; it is not shared with any third party and is used neither for advertising nor for profiling: it only tells us which content interests our readers. You can object at any time by writing to [email protected]: the measurement is then switched off for your address. Blocking the automatic display of images in your email client also prevents the measurement of opens.
We do not use advertising trackers, retargeting or behavioural profiling, and we never sell personal data.
3. Investors
If you invest in a fund managed by SparkCore, we process the data needed to identify you and to manage your investment: identity and contact details, identification documents, source-of-funds information, tax residence, subscription and redemption documents, and your holdings. Anti-money-laundering checks are a legal obligation (Art. 6(1)(c) GDPR; Estonian Money Laundering and Terrorist Financing Prevention Act); managing your investment is necessary for the performance of the contract (Art. 6(1)(b)).
Subscription documents are signed on an electronic signature platform hosted on our own servers. Your investor portal account (investor.sparkcore-investment.com) uses your email address and, if you enable it, a hardware security key; it gives you access to your positions, reports and documents. Communications about your funds are sent to you by email; their opens and the clicks on their links are measured as described in section 2.
4. Recipients and processors
Your data is accessible only to authorised SparkCore staff and to the service providers below, acting on our instructions:
- Cloudflare: website hosting and delivery, security (Turnstile anti-bot check), encrypted backups.
- OVHcloud: servers hosting our internal applications and databases, in the OVHcloud data centre in Erith (London, United Kingdom).
- Mailjet: sending emails and the newsletter.
- Telegram: internal notification of new contact requests to our team (name, email, phone number).
- Cal.com: call booking.
- Google (Google Analytics 4): audience measurement, only with your consent.
- Cronitor: website performance monitoring, without identifying data.
- jsDelivr: delivery of open-source scripts used by the website (receives your IP address).
Our accounting firm, legal counsel, banks and the competent authorities may receive investor data where required by law or by the management of the funds.
5. Transfers outside the European Economic Area
Our servers are located in the United Kingdom, which benefits from an adequacy decision of the European Commission. Some providers may also process data in other countries outside the EEA; such transfers rely on an adequacy decision (including the EU-US Data Privacy Framework for certified providers) or on the Commission's Standard Contractual Clauses.
6. Retention
| Data | Retention period |
|---|---|
| Newsletter email address | Until you unsubscribe or ask for deletion |
| Open and click measurement | Kept with your address, erased with it or on request |
| Contact and call booking data | 3 years from our last exchange, unless an investment relationship follows |
| Investor file | For the period required by anti-money-laundering and accounting obligations, i.e. 10 years minimum |
| Audience measurement data | Event data: 2 months; user-level data: 14 months, the period restarting at each new visit (Google Analytics settings) |
7. Cookies and local storage
Audience measurement cookies are only set after you accept them in the consent banner (Google Consent Mode v2, refused by default). The website also stores two technical preferences in your browser: your language choice and your consent choice. These do not identify you. Once you have accepted the cookies, the campaign of the link that brought you to the website is kept for the visit (session storage, erased when the tab closes or if you refuse). The newsletter confirmation page keeps the link's code for the visit until your subscription is confirmed.
8. Your rights
You may request access to your data, its rectification or erasure, the restriction of its processing, its portability, and object to processing based on legitimate interest. You may withdraw your consent at any time, without affecting processing carried out before. Some data cannot be erased while a legal retention obligation applies.
To exercise your rights, write to [email protected]. We reply within one month.
9. Complaints
You may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or with the data protection authority of your country of residence in the EU.
10. Security
Data is transmitted over encrypted connections (TLS). Access to our internal applications is restricted to authorised staff with strong authentication, and investor documents are stored encrypted.
11. Changes
We may update this policy to reflect changes in our practices or in the law. The date of the latest version is shown at the top of this page.