Privacy notice for Sparsa by Dalmos
Sparsa is a newsletter service. Organisations (our customers) use it to send newsletters to people who subscribed or who may otherwise receive them, to run sign-up forms, to handle unsubscribes, and, only where a person has agreed, to measure whether their newsletters are opened and which links are clicked. This notice explains which personal data Sparsa processes, for whom and how. It covers the pages Sparsa shows to recipients (unsubscribe, preferences, sign-up forms and confirmations) and the Sparsa app. Sparsa is provided by DALMOS SYSTEMS, obrt za informatičke usluge, vl. Noa Matas, Šibenik, Ulica Sedmog kontinenta 1 (MBO 99393786).
Who is responsible for your data
The organisation whose newsletter you receive or whose form you fill in (our customer) is the controller of your personal data: it decides whom it writes to, about what, and on which legal basis. Dalmos Systems processes that data only on the organisation’s behalf and on its documented instructions, as its processor under a data processing agreement (Article 28 GDPR).
Dalmos Systems is the controller only for the data it needs to run its own business: the contact and billing details of its customers, its correspondence with them and the security of the service. Enquiries sent through dalmossystems.com are covered by the privacy policy of this website.
What data Sparsa processes about recipients
Your e-mail address, your name, language and time zone, the organisation you belong to, and any other details the sending organisation uses to personalise its newsletters; the lists and topics you are on; and your consent for each topic: when and how you gave or withdrew it and which version of the form or page you saw.
The newsletters sent to you and what happened to them: delivered, bounced, rejected, reported as spam, or unsubscribed.
The organisation provides these details from its own contact records or an import, or you provide them yourself through a sign-up form.
Sign-up forms and confirmation
When you fill in a Sparsa sign-up form, Sparsa stores your submission together with the version of the form you saw and the time, and sends you a confirmation e-mail without any advertising. You are subscribed only when you confirm. If you do not confirm within 7 days, your submission is deleted. Sparsa does not store your IP address as evidence of your consent.
Measuring opens and clicks: only with your consent
Sign-up forms and the preference page may offer a separate, optional box, never ticked in advance, with which you allow the organisation to measure whether you open its newsletters and which links you click, from which kind of device and e-mail program. Your subscription never depends on it.
If you tick it, the newsletters you receive contain a small invisible image and links that pass through t.go.sparsabydalmos.com, an address operated for Sparsa by Amazon Web Services. When you open a newsletter or click a link, Sparsa records the time, the link, the kind of device (for example mobile or desktop) and the family of e-mail program. Your IP address and the technical description of your device and browser reach Amazon SES as part of the request; Sparsa reduces them to the kind of device and the program family and drops them at once, and never stores them. Opens can only be estimated, because some e-mail programs load images automatically and others block them.
If you do not tick it, or the organisation has switched measurement off, the newsletters contain no such image and the links lead straight to their destination.
You can withdraw this consent at any time on the preference page ("Stop measuring my opens and clicks"); unsubscribing from all newsletters of the organisation also withdraws it. Your measured opens and clicks are then deleted at once. The organisation’s staff can see your individual opens and clicks only if you consented to measurement.
What data Sparsa processes about the organisation’s staff
About the people who work in the Sparsa app for an organisation: name, work e-mail address and the identifiers of their Microsoft Entra ID account (staff sign in with their organisation’s Microsoft account), their role, invitations, and the actions they take, which Sparsa records in an audit log by identifier.
Technical data and cookies
To deliver and protect its pages, Sparsa processes IP addresses and request details at the network edge, for example to limit the number of requests. They are not stored in the Sparsa database. Our application logs record technical identifiers, one-way codes and counts, never e-mail addresses, names or the content of newsletters.
Sparsa’s unsubscribe, preference, confirmation and form pages set no cookies. The Sparsa app uses only the cookies needed to keep staff signed in.
We count visits to the Sparsa website, sparsa.dalmossystems.com, with Cloudflare Web Analytics. It sets no cookies, stores nothing on your device and does not identify you; we see only totals such as page views, referring sites, countries and device types.
What the data is used for
Sparsa uses this data only to provide the service to the organisation: to send its newsletters, to honour unsubscribes and objections, to keep evidence of consent, to produce reports, to protect recipients, the organisation and the service against spam and abuse, to keep the service secure, and to help the organisation when it asks for support.
We do not sell personal data, do not use it for advertising or for profiles of our own, and never share one organisation’s lists or unsubscribes with another organisation.
Legal basis
The organisation decides on the legal basis. For newsletters it is your consent (Article 6(1)(a) GDPR and Article 50(1) of the Croatian Electronic Communications Act) or, only for an organisation’s own existing customers and its own similar products, the exception for existing customers (Article 50(2) of that Act), which always lets you object free of charge. Measuring opens and clicks is based on your separate consent (Article 43(4) of that Act and Article 6(1)(a) GDPR).
After you unsubscribe, complain or have your data erased, the organisation keeps a one-way code of your address so that it never writes to you again (see "How long the data is kept"). The basis is the organisation’s legitimate interest in respecting your objection (Article 6(1)(f) GDPR together with Article 21(3)).
Dalmos Systems processes all this data under the data processing agreement with the organisation (Article 28 GDPR). For the data of our customers’ contact persons, our basis is the contract with the customer and our legitimate interest in managing it (Article 6(1)(b) and (f) GDPR), and our obligations under accounting and tax law (Article 6(1)(c)).
Unsubscribing and objecting
Every newsletter sent through Sparsa contains an unsubscribe link, and e-mail programs that support it show a one-click unsubscribe button. Both work at once and without signing in. The preference page lets you choose the topics you want or unsubscribe from all of them. If you mark a newsletter as spam, Sparsa treats this as an objection to all newsletters of that organisation. Because records of who received a newsletter are kept for 13 months only, the links in a newsletter older than that no longer work: use the link in a newer newsletter, or write to the organisation.
Where the data is stored
Sparsa runs in Microsoft Azure in the European Union and sends e-mail through Amazon Web Services in the Europe (Frankfurt) region. Our test systems hold invented test data and no customer data.
Some providers’ networks reach outside the EU and the EEA: Cloudflare’s global network, and the Amazon CloudFront network through which measured opens and clicks pass on their way to Frankfurt. Such transfers rely on the safeguards of the GDPR, such as an adequacy decision of the European Commission or standard contractual clauses.
Service providers
Amazon Web Services, our sub-processor: Amazon SES sends the newsletters from the organisation’s own domain, reports deliveries, bounces and spam complaints, and, only for people who consented, counts opens and clicks; Amazon EventBridge and Amazon SQS pass these reports to Sparsa; Amazon CloudFront provides the secure measurement address; all in the Europe (Frankfurt) region, with CloudFront’s global network as described above.
Microsoft (Microsoft Azure), our sub-processor: hosting, database, file storage, queues, key management and monitoring of Sparsa, and sign-in of the organisation’s staff through Microsoft Entra ID; in the European Union.
Cloudflare, our sub-processor: DNS and secure delivery and protection of the Sparsa web addresses (encryption in transit, firewall). Cloudflare does not store the content of newsletters.
Medius, Dalmos Systems’ own platform, keeps the organisation’s contacts and consent records; it is not a separate provider. Services the organisation chooses and connects under its own agreements, such as its own CRM (for example Microsoft Dynamics 365) and the mailbox it uses for replies, are not our sub-processors.
Dalmos Systems staff access this data only when this is necessary to operate the service, for example to approve an organisation’s first campaign or to handle an abuse report, or when the organisation asks for support.
How long the data is kept
Your contact details stay in Sparsa as long as the organisation keeps you in its contacts. Submissions that are not confirmed are deleted after 7 days.
Records of the newsletters sent to you are kept for 13 months; after that, only counts per newsletter remain, without you. Measured opens and clicks are kept for 13 months, then only as counts without you, and are deleted at once if you withdraw your consent to measurement or have your data erased. Newsletters and their statistics, which contain counts and no recipients, are kept for 3 years. Technical records of delivery events are kept for 30 days without your address. The organisation cannot lengthen these periods.
If you unsubscribe, complain, or your address bounces permanently or is erased, Sparsa keeps a one-way code computed from your address with a key that belongs to that organisation alone. The code cannot be turned back into your address, is used only to make sure the organisation does not write to you again or re-import you, and is kept with no end date while the organisation uses Sparsa.
Deleted data remains in backups for a limited time and then expires automatically. When an organisation stops using Sparsa, all of its data is deleted 30 days after the end of the service.
Data for which Dalmos Systems is the controller, such as contracts, invoices and correspondence with customers, is kept for the duration of the contract and afterwards for as long as Croatian accounting and tax law requires.
Security
Data is encrypted in transit and at rest; e-mail addresses are additionally encrypted with a key that belongs to each organisation. Each organisation’s data is kept separate from every other organisation’s data in the database (row-level security) and at Amazon SES. Links in newsletters contain signed codes instead of your address. Staff sign in with their organisation’s Microsoft account, and the Sparsa services use managed identities without stored passwords.
Your rights
Under the GDPR you have the right of access to your data, to rectification and erasure, to restriction of processing, to object and to data portability, and to withdraw your consent at any time where processing is based on consent.
Please send your request to the organisation whose newsletter you receive, because it decides about your data. Sparsa gives the organisation tools to export and erase one person’s data. If you write to us instead, we forward your request to the organisation without delay and help it to answer. How to request deletion is explained step by step on the Sparsa data deletion page.
For data for which Dalmos Systems is the controller, write to service@dalmossystems.com. We answer within one month.
You may lodge a complaint with the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Ulica Metela Ožegovića 16, 10000 Zagreb, azop@azop.hr, www.azop.hr, or with the supervisory authority of the EU country where you live or work.
Changes and contact
We update this notice when Sparsa or the law changes and show the date of the current version at the top. Questions: service@dalmossystems.com, or by post to Ulica Sedmog kontinenta 1, 22000 Šibenik, Croatia.