Last updated 16 September 2026
This applies where you use HoopoeHQ to hold personal data about your own clients. In that arrangement you are the controller and we are your processor.
You, the agency, decide what goes into your workspaces and why, so you are the controller. Sparked FM Ltd processes that data only to provide the service, and only on your documented instructions, so we are the processor. Using the product is itself an instruction to process the data it holds.
We process your data for as long as your account is open, in order to run the client delivery service described in the terms. When the account ends, so does the processing.
The data subjects are your staff and the people at your client organisations whom you invite. The categories are their names, email addresses and role, together with whatever appears in the requests, comments and files they exchange. HoopoeHQ is not designed for special category data, and you should not put it there.
We will process the data only on your instructions; keep it confidential and ensure the people who handle it are bound to do the same; apply appropriate technical and organisational security measures; and help you respond to requests from data subjects and to your obligations around security, breach notification and impact assessments.
Each client workspace is isolated from every other, enforced on the server rather than in the interface, and that isolation is covered by automated tests. Passwords are stored only as hashes. Two-factor authentication is mandatory for staff accounts. Access to files is checked on every request rather than relying on an unguessable link. Traffic is encrypted in transit.
You give general authorisation for the sub-processors listed below. We will give you reasonable notice before adding or replacing one, and you may object on reasonable data protection grounds.
| Provider | Purpose | Location |
|---|---|---|
| Replit | Application hosting and uploaded file storage | United States |
| Neon | Managed PostgreSQL database | Depends on the deployment region |
| Stripe | Payment processing and subscription billing | United States and Ireland |
| Resend | Transactional email (invitations, password resets, notifications) | United States |
| Anthropic | Optional AI features: drafting a ticket from pasted text, and thread summaries. Only the text you submit to those features is sent. | United States |
Where a sub-processor is outside the UK, transfers are made under the International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard.
We will notify you without undue delay after becoming aware of a personal data breach affecting your data, with the information you need to meet your own notification duties.
On reasonable written request, and no more than once a year unless required by a regulator, we will provide the information needed to demonstrate compliance with this agreement.
On termination you may export your data. After a reasonable recovery period we delete it, except where we are required by law to keep a copy.
Questions, or to raise a data protection matter: josh.harris@thesparkedgroup.com.