Who We Are (Covered Companies)

This Privacy Policy applies to all the entities listed on Attachment A (collectively, “Spark Entities,” “we,” “us,” or “our”).

The Spark Entity that is responsible for your personal information (sometimes called the “business,” “controller,” or “company”) depends on the brand and state in which you enroll for service and will be identified in your enrollment materials, customer communications, and/or bill.

Scope of this Privacy Policy

This Privacy Policy applies to consumers, prospective consumers, customers, website visitors, and other individuals whose personal information we collect in connection with the Services.

If you apply for a job with us, communicate with us about employment opportunities, or engage with us as an employee or contractor, we may collect and process information for those purposes. That information is governed by Attachment C – Applicant and Workplace Privacy Notice.

This Privacy Policy is intended for U.S. residents and U.S.-based services. If we transfer information outside of the United States (for example, to service providers), we will do so in accordance with applicable law and appropriate safeguards.

Personal Information We Collect

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual or household.

Information You Provide to Us

• Identifiers and contact information such as full name, service address, billing address, email address, telephone number (including mobile number), customer or account identification number, and login credentials (where applicable).
• Utility, Energy, and Service-Related Information such as utility account numbers, meter numbers, ESIDs, premise or service identifiers, enrollment details, selected products or plans, pricing information, service start and stop dates, and energy usage or consumption information provided by you or your utility.
• Billing and Payment Information such as payment method details (e.g., bank account or payment card information, typically processed and stored by third-party payment processors), billing history, transaction records, payment status, and account balances.
• Identity Verification, Credit, and Eligibility Information (collected only where required or permitted by law and depending on the enrollment channel), such as date of birth, partial Social Security number, government-issued identification numbers (e.g., driver’s license or state ID), and information used for credit checks, identity verification, fraud prevention, or eligibility determinations.
• Communications and Customer Support Information such as emails, chat messages, webform submissions, written correspondence, customer service inquiries, complaint records, and call recordings or transcripts when you communicate with us by phone.
• Marketing, Promotions, and Preference Information such as communication preferences, marketing opt-in or opt-out selections, participation in promotions, referrals, surveys, contests, or loyalty programs, and information you provide in connection with marketing campaigns.
• Commercial or Business-Related Information (if applicable), such as business name, job title, role, business contact details, and information related to commercial, non-residential, or small business energy services.
• Authentication and Account Security Information such as information used to authenticate your identity, verify account access, prevent unauthorized activity, and secure your account.
• Regulatory, Compliance, and Dispute-Related Information such as information required to comply with legal or regulatory obligations, respond to inquiries from utilities or regulators, resolve disputes, process complaints, or enforce our agreements.
• Information You Voluntarily Provide such as feedback, reviews, survey responses, or any other information you choose to submit through our Services or communications with us.
• Authorized Agent or Third-Party Information such as information provided by an authorized representative, broker, aggregator, or referral partner acting on your behalf.

Information We Automatically Collect

• Device and Technical Information such as IP address, device type, operating system, browser type, language settings, unique device identifiers, and network or carrier information.
• Usage and Interaction Information such as pages viewed, links clicked, referring and exit pages, timestamps, session duration, search queries, and other activity logs related to your use of our Services.
• Location Information such as general geographic location derived from IP address or device settings. We do not intentionally collect precise geolocation data unless expressly disclosed and permitted by law.
• Cookies and Similar Tracking Technologies such as cookies, pixels, SDKs, web beacons, and similar technologies used to recognize your browser or device, remember preferences, measure site performance, and support analytics and advertising.
• Session Replay or Monitoring Data (if applicable), such as limited recordings or reconstructions of user interactions to help diagnose errors, improve usability, and enhance security.

Information We Receive from Third Parties

• Utilities and Market Participants such as electric or gas utilities, transmission or distribution companies, independent system operators (ISOs), or similar entities, in connection with enrollment, service delivery, usage data, billing, or regulatory requirements.
• Brokers, Aggregators, Referral Partners, and Authorized Agents such as information provided by third parties that market or enroll customers on our behalf, including contact details, enrollment information, and lead source data.
• Payment Processors and Financial Institutions such as confirmation of payment status, transaction outcomes, or account updates from third-party payment service providers.
• Identity Verification, Credit, and Fraud Prevention Providers such as information used to verify identity, assess eligibility, prevent fraud, or comply with legal or contractual requirements.
• Marketing and Advertising Partners such as information about advertising interactions, campaign performance, or inferred interests, subject to applicable law and your choices.
• Publicly Available Sources such as public records or publicly accessible information, where permitted by law.

Sensitive Personal Information

Certain categories of personal information we collect may be considered “sensitive personal information” or “sensitive data” under applicable privacy laws. Where required, we collect and use such information only for permitted purposes and with appropriate safeguards. This may include:

• Government-Issued Identifiers such as Social Security numbers (or partial SSNs), driver’s license numbers, or state identification numbers.
• Financial Information such as bank account details or payment card information, typically processed by third-party payment processors.
• Account Credentials and Security Information such as passwords, authentication data, or information used to secure and access your account.
• Precise Location Information (if applicable), where expressly disclosed and permitted by law.
• Communications Content such as call recordings or message content, where required for customer service, quality assurance, training, or compliance purposes and subject to applicable consent requirements.

We use sensitive personal information only as necessary to provide our Services, comply with legal obligations, prevent fraud, secure our systems, or for other purposes permitted by applicable law. We do not use sensitive personal information for purposes that require consumer consent unless such consent has been obtained.

How We Use Personal Information

• Provide and administer our Services, including enrolling you in energy supply products or services, processing transactions, managing your account, providing customer support, and delivering service-related communications.
• Facilitate service delivery with utilities and market participants, including verifying eligibility, coordinating enrollments, switches, and drops, managing service start/stop dates, and obtaining or providing information required to provide energy supply services.
• Billing, payments, and collections, including processing payments, sending bills or account notices, addressing payment issues, and managing disputes or chargebacks.
• Identity verification and fraud prevention, including verifying your identity, preventing unauthorized access, detecting and preventing fraud or other illegal activity, and protecting the security and integrity of our systems.
• Communications and customer experience, including responding to requests and inquiries, managing communications preferences, improving customer support quality, training personnel, and maintaining records of communications (including call recordings where permitted).
• Personalization and service improvements, including understanding how users interact with our websites and applications, improving functionality, developing new products or services, conducting analytics, and maintaining and enhancing the performance of our Services.
• Marketing and advertising, including sending promotional communications, presenting offers that may be of interest, measuring campaign effectiveness, and conducting marketing analytics. Where required by law, we provide opt-out rights for targeted advertising and similar marketing activities.
• Administer promotions and surveys, including contests, sweepstakes, referrals, surveys, or other promotions, and communicating with participants.
• Compliance, legal obligations, and regulatory requirements, including complying with applicable laws, regulatory requests, utility requirements, reporting obligations, and responding to lawful requests and legal process.
• Enforce our agreements and protect rights, including enforcing our Terms, investigating and defending against legal claims, resolving disputes, and protecting the rights, safety, and property of the Company, our customers, and others.
• Corporate transactions and business operations, including evaluating, negotiating, or completing mergers, acquisitions, reorganizations, financing, or asset sales, and enabling related due diligence and transition planning.
• Any other purpose disclosed at the time of collection, or otherwise with your consent where required by law.
• Profiling and automated processing (if applicable), limited to purposes such as fraud prevention, security, compliance, or improving customer support and service operations, and not for decisions that produce legal or similarly significant effects on individuals unless expressly disclosed and permitted by law.

We use personal information only as permitted by applicable law and consistent with the purposes described above, and we maintain policies and procedures designed to limit access to personal information to authorized personnel and service providers.

How We Disclose Personal Information

• Affiliates and Related Entities. We may disclose personal information among the Spark Entities and their parent companies, subsidiaries, and affiliated entities for lawful business purposes, including providing and administering the Services; customer support; billing and collections; security and fraud prevention; compliance and internal reporting; analytics and business intelligence; developing and improving products, services, and operational tools (including internal AI/ML tools); and marketing products and services offered by the Spark Entities and their affiliates, subject to applicable law and your marketing preferences.
• Service Providers and Vendors. We may disclose personal information to third-party service providers that perform services on our behalf, such as customer service and call center support, enrollment processing, third-party verification (TPV), billing and payment processing, printing and mailing, IT hosting and security, analytics, marketing support, auditing, legal and compliance support, and other operational functions.
• Utilities and Market Participants. We may disclose personal information to electric and gas utilities, transmission and distribution companies, independent system operators (ISOs), and other market participants as necessary to enroll you, provide energy supply services, manage switches/drops, obtain usage or account information, support billing (where applicable), and comply with regulatory requirements.
• Payment Processors and Financial Institutions. We may disclose personal information to payment processors, banks, and other financial institutions to process payments, prevent fraud, manage chargebacks, and support account reconciliation.
• Collection Agencies, Credit Bureaus, and Financial Institutions. We may disclose personal information, including account details, payment history, account balances, and delinquency information, to collection agencies, credit bureaus, payment processors, and financial institutions in connection with billing, collections, dispute resolution, and (where applicable) credit reporting activities, subject to applicable law.
• Brokers, Aggregators, and Channel Partners. If you enroll through, or are served through, a broker, aggregator, referral partner, or similar channel partner, we may disclose personal information to that partner as necessary to support your enrollment, account servicing, customer support, commissions, or related program administration.
• Advertising and Marketing Partners. We may disclose personal information to advertising, marketing, and measurement partners to deliver and measure advertising, understand the effectiveness of our campaigns, and provide offers that may be relevant to you, subject to applicable law and your choices.
• Third-Party Marketing Partners and Data Brokers. Where applicable, we may disclose certain personal information (such as contact information, demographic information, and inferred interests) to third-party marketing partners, advertising networks, and similar third parties for their marketing and business purposes, subject to applicable law and your opt-out choices where required.
• Legal, Regulatory, and Safety Disclosures. We may disclose personal information to comply with applicable law, regulation, legal process, governmental requests, public utility commission requirements, or utility requirements; to enforce our agreements; to protect our rights and property; to investigate and prevent fraud or security incidents; and to protect the rights, safety, and property of the Company, our customers, or others.
• Corporate Transactions. We may disclose personal information in connection with an actual or proposed merger, acquisition, reorganization, financing, bankruptcy, sale of assets, or similar transaction, including for due diligence and transition planning, subject to appropriate confidentiality protections and as permitted by law.
• With Your Direction or Consent. We may disclose personal information to third parties when you direct us to do so, or when you otherwise provide consent where required by law.
• Aggregated or De-Identified Information. We may disclose aggregated or de-identified information that cannot reasonably be used to identify you.
• No Sale/Share (where applicable). We do not sell personal information for monetary consideration. However, some privacy laws define “sale,” “share,” or similar concepts broadly to include certain disclosures of personal information to third parties for advertising or marketing purposes (including disclosures through cookies and similar technologies). Where required by law, you may have the right to opt out of such disclosures.

Cookies, Analytics, and Targeted Advertising

We and our service providers may use cookies and similar tracking technologies to collect information automatically when you visit or use our Services. These technologies help us operate our Services, understand how users interact with our Services, improve performance, and where permitted, deliver and measure advertising.

Cookies and Similar Technologies

Cookies are small text files placed on your browser or device. We may also use similar technologies, such as pixels, SDKs, web beacons, tags, local storage, and scripts (collectively, “cookies and similar technologies”).

• Strictly Necessary / Essential: to enable core functionality, maintain security, prevent fraud, and provide requested features.
• Functional / Preference: to remember your preferences and settings.
• Analytics / Performance: to understand how our Services are used, measure performance, troubleshoot issues, and improve functionality.
• Advertising / Targeting: where applicable, to deliver and measure advertising, personalize offers, limit ad frequency, and evaluate campaign effectiveness.

Analytics

We may use analytics tools and services that help us understand how users interact with our Services. These tools may collect information such as your IP address, browser type, device identifiers, pages viewed, and interactions with content, subject to applicable law and your choices.

Session Replay and Similar Monitoring Tools

We may use session replay or similar monitoring tools to help identify and fix technical issues, improve usability, prevent fraud, and protect the security of our Services. These tools may record or reconstruct your interactions with our Services, such as mouse movements, clicks, page scrolling, and form inputs.

Targeted Advertising and Related Disclosures

If we engage in targeted advertising (sometimes called “interest-based advertising”), we may work with advertising partners who use cookies or similar technologies to collect information over time and across different websites, apps, or services to show ads that may be more relevant to you.

Some privacy laws define certain disclosures of personal information for advertising purposes as “sale,” “sharing,” or “targeted advertising.” Where required by law, you may have the right to opt out of these activities.

Your Choices and Controls

• Browser and Device Controls: You can configure your browser or device settings to limit or block cookies. Blocking certain cookies may affect site functionality.
• Industry Opt-Out Tools: You can opt out of certain interest-based advertising through industry programs such as the Network Advertising Initiative and the Digital Advertising Alliance.

Global Privacy Control (GPC) and Do Not Track

Some browsers and browser extensions support a preference signal known as Global Privacy Control (GPC). Where required by applicable law, we process qualifying GPC signals as a request to opt out of certain disclosures of personal information for advertising purposes for the applicable website or service.

“Do Not Track” is a separate browser setting that is not uniformly supported. We do not respond to “Do Not Track” signals, except where required by law.

How Long We Retain Personal Information

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, including providing the Services, complying with legal and regulatory obligations, resolving disputes, enforcing our agreements, and protecting our rights and the rights of others.

When personal information is no longer needed, we take reasonable steps to delete, anonymize, aggregate, or de-identify it, unless retention is required or permitted by applicable law.

Nothing in this section limits our ability to retain personal information where required or permitted by applicable law, regulation, or legal process, including in connection with litigation holds or regulatory investigations.

How We Protect Personal Information

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, disclosure, alteration, and destruction. Our safeguards are intended to be appropriate to the nature of the personal information we process and the risks presented by our operations.

• Access controls designed to limit access to personal information to authorized employees, agents, and service providers who have a business need to know.
• Encryption and secure transmission practices where appropriate, including the use of encryption in transit and, in some cases, at rest.
• Vendor and service provider security requirements, including contractual obligations requiring service providers to implement reasonable safeguards and to process personal information only as permitted by contract and applicable law.
• Policies, training, and internal controls designed to promote information security awareness and compliance.
• Data minimization and retention practices designed to limit collection and retention of personal information to what is necessary for business purposes and legal requirements.

While we take reasonable measures designed to protect personal information, no method of transmission or storage is completely secure. Accordingly, we cannot guarantee the absolute security of personal information. In the event of a security incident involving personal information, we will respond in accordance with applicable law, including providing notices where required.

Children’s Privacy

Our Services are intended for use by adults and are not directed to children. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13, we will take reasonable steps to delete it and, where appropriate, terminate the related account or enrollment process.

If you believe we might have collected information from or about a child under 13, please contact us using the information in the “How to Contact Us” section.

Links to Third-Party Websites and Services

Our Services may contain links to third-party websites, applications, platforms, or services that are not operated or controlled by us. These links are provided for your convenience and do not constitute an endorsement of the third party or its practices.

We do not control, and are not responsible for, the privacy practices, content, or security of third-party websites or services. Any personal information you provide to a third party is governed by that third party’s privacy policy and terms, not this Privacy Policy. We encourage you to review the privacy policies and terms of any third-party websites or services before providing personal information.

Your Marketing and Communication Preferences

You have certain choices regarding how we communicate with you and how your personal information is used for marketing and related purposes, subject to applicable law.

Promotional Communications

• Email Communications. You may opt out of promotional emails by following the unsubscribe instructions included in those emails or by contacting us using the information in the “How to Contact Us” section. Even if you opt out, we may continue to send non-promotional communications related to your account, services, transactions, or legal notices.
• Text Messages. You may opt out of promotional text messages by replying “STOP” to a message or by contacting us. Message and data rates may apply.
• Telephone Calls. You may opt out of promotional telephone calls by following the instructions provided during the call or by contacting us. We honor applicable federal and state do-not-call requirements and maintain an internal do-not-call list.

Service-Related Communications

Opting out of promotional communications does not affect our ability to send you service-related communications that are necessary to provide our Services, comply with legal or regulatory obligations, respond to inquiries, or enforce our agreements.

Managing Preferences

You may update or manage your communication preferences at any time by contacting us or, where available, through your account settings.

Your Privacy Choices and Rights

Depending on where you live, you may have certain rights regarding your personal information. These rights may vary by state and may be subject to exceptions and verification requirements permitted by law. Please see Attachment B for additional information about rights that may apply to residents of particular states.

• Access / Know: Request confirmation of whether we process your personal information and access to the personal information we maintain about you.
• Correction: Request that we correct inaccurate personal information.
• Deletion: Request that we delete personal information we maintain about you.
• Portability: Request a copy of certain personal information in a portable and, where technically feasible, readily usable format.
• Opt Out of Certain Processing: Request to opt out of targeted advertising, “sales” or “sharing” of personal information, and/or profiling in furtherance of decisions that produce legal or similarly significant effects.
• Limit Use of Sensitive Personal Information: Where applicable, request that we limit the use and disclosure of sensitive personal information to purposes permitted by law.
• Non-Discrimination: You will not be discriminated against for exercising your privacy rights, although certain features or services may be impacted if the information is necessary to provide the service.

You (or, where allowed, your authorized agent) may submit a privacy request by contacting us using the methods described in the “How to Contact Us” section of this Privacy Policy.

We may take steps to verify your identity before processing a request. In certain jurisdictions, you may designate an authorized agent to submit requests on your behalf. We may require proof of authorization and may also require you to verify your identity directly with us.

We will respond to requests within the timeframe required by applicable law. We may deny certain requests, in whole or in part, where permitted by law.

In certain states, you may have the right to appeal our decision regarding your privacy request. If we deny your request, you may appeal by contacting us and stating that you wish to appeal our decision, as further described in Attachment B.

Artificial Intelligence and Automated Processing

We may use personal information to develop, train, improve, and operate analytics tools and automated systems, including artificial intelligence and machine learning (AI/ML), to support our operations and improve the Services. We do not use sensitive personal information for targeted advertising and do not train public-facing AI models on the content of your communications with us unless you affirmatively provide it for that purpose and applicable law permits.

Examples of AI/ML uses may include detecting and preventing fraud and security threats; forecasting energy usage patterns and operational needs; improving customer support (including quality assurance and assisted support tools); tailoring offers and communications where permitted; and improving product development and operational efficiency.

Automated Decision-Making

We may use automated processing to support decisions related to fraud prevention, identity verification, credit or eligibility determinations (where permitted), service optimization, pricing, and marketing. Where automated processing produces decisions that have legal or similarly significant effects on you, and where required by applicable law, you may request human review, express your point of view, and contest the decision by contacting us as described in the “How to Contact Us” section.

Telephone and Text Communications (TCPA and State Telemarketing Compliance)

We may contact you by telephone or text messages, at the number you provide to us for purposes related to our Services, including account administration, customer service, billing, collections, and service updates. Marketing or promotional communications will be sent only where permitted by law, and where any required consent has been obtained.

• Consent and Method of Contact. Depending on the nature of the communication and applicable law, we may contact you using live calls, text messages (SMS/MMS), and automated technologies such as an automatic telephone dialing system or prerecorded or artificial voice messages. Your consent is not required as a condition of purchase, except where required by applicable law.
• Opting Out / Revoking Consent. You may opt out of promotional calls or texts at any time:
  • Text Messages: Reply “STOP” to unsubscribe from promotional texts.
  • Phone Calls: Ask to be placed on our internal do-not-call list during any promotional call, or contact us using the information in the “How to Contact Us” section.
  • Email: You may also submit opt-out requests by emailing us using the information in the “How to Contact Us” section.
• Do-Not-Call and State Telemarketing Laws. We comply with applicable federal and state telemarketing laws and do-not-call requirements, including maintaining an internal do-not-call list and honoring opt-out requests as required by law.
• Call Recording. Calls with us or our service providers may be monitored or recorded for quality assurance, training, compliance, and dispute resolution purposes, where permitted by law. If required by applicable law, we will provide additional notice and/or obtain consent prior to recording.

Limitation of Liability and Disclaimers

Security Disclaimer. While we implement reasonable administrative, technical, and physical safeguards designed to protect personal information, no method of transmission over the Internet, method of electronic storage, or security system is completely secure. We cannot and do not guarantee absolute security, and you acknowledge that you provide personal information and use the Services at your own risk.

Limitation of Liability. To the maximum extent permitted by applicable law, the Spark Entities will not be liable for any indirect, incidental, special, consequential, exemplary, or punitive damages arising out of or related to a security incident, unauthorized access, or any matter related to this Privacy Policy. To the maximum extent permitted by law, our total liability for any claim related to this Privacy Policy will not exceed one hundred dollars ($100.00) or the amount you paid us for the Services in the twelve (12) months preceding the claim, whichever is greater.

Cross-Border Transfers

Our Services are intended for use in the United States. Personal information we collect may be processed and stored in the United States and in other locations where we, our affiliates, or our service providers operate. Where we transfer personal information outside of the state or country in which it was collected, we take reasonable steps to require that recipients handle personal information in a manner consistent with this Privacy Policy and applicable law.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version with a new “Last Updated” date. If required by applicable law, we will provide notice of material changes in an appropriate manner. Your continued use of our Services after the updated Privacy Policy becomes effective means you acknowledge the updated Privacy Policy, to the extent permitted by applicable law.

How to Contact Us

If you have questions or concerns about this Privacy Policy or our privacy practices, contact us using the information provided as per the applicable entity:

Governing Law

This Privacy Policy is governed by the laws of the state where you reside, to the extent such laws apply. Disputes related to the Services may be subject to the dispute resolution provisions (including arbitration and class action waiver provisions) in the applicable Terms of Service or Customer Enrollment Agreement for the relevant brand, where properly presented and accepted.

Attachment A – Spark Entities

Attachment B – U.S. State Privacy Notice (Including California)

This Attachment B supplements the Privacy Policy for residents of U.S. states with comprehensive consumer privacy laws, including as of the Effective Date California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia, and any other state that may enact similar laws. Requirements vary by state and may change over time.

California Privacy Notice

The California Consumer Privacy Act of 2018 (“CCPA”) became effective on January 1, 2020. The California Privacy Rights Act (“CPRA”) amended and expanded the CCPA, and those amendments took effect on January 1, 2023.

Categories of Personal Information Collected:

• Identifiers, such as name, postal address, email address, telephone number, account identifiers, and online identifiers.
• Personal information categories listed in Cal. Civ. Code § 1798.80(e), such as signature and payment-related information.
• Commercial information, such as products or services purchased or considered and transaction history.
• Internet or other electronic network activity information, such as browsing or usage information on our Services.
• Geolocation data, such as general location derived from IP address.
• Audio, electronic, visual, or similar information, such as call recordings where permitted by law.
• Professional or employment-related information, if applicable.
• Inferences drawn from information to create a profile reflecting preferences or characteristics.

Your California Privacy Rights:

• Right to Know
• Right to Access
• Right to Delete
• Right to Correct
• Right to Opt-Out of Sale or Sharing of Personal Information
• Right to Limit Use and Disclosure of Sensitive Personal Information, where applicable
• Right Not to Receive Discriminatory Treatment

You may submit an opt-out request using a “Do Not Sell or Share My Personal Information” link on our website where available, by contacting us using the information in the How to Contact Us section, or by using a qualifying Global Privacy Control (GPC) signal where recognized by our website.

Texas Privacy Notice

This Texas Privacy Notice applies to Texas residents and supplements the main Privacy Policy. For purposes of this Notice, “personal data,” “sale,” “targeted advertising,” “profiling,” and “sensitive data” have the meanings given in the Texas Data Privacy and Security Act (“TDPSA”).

• Right to Access
• Right to Correction
• Right to Deletion
• Right to Data Portability
• Right to Opt Out of Targeted Advertising, Sale of Personal Data, and/or Profiling

If we deny your request, you may appeal our decision by contacting us and stating that you are submitting an appeal of a privacy rights request decision.

Utah Privacy Notice

Utah residents may have rights to access, delete, and opt out of targeted advertising and the sale of personal data, subject to applicable law and exceptions.

Colorado Privacy Notice

Colorado residents may have rights to access, delete, correct, and opt out of targeted advertising, sale of personal data, and profiling. Where required by law, we will process qualifying universal opt-out signals.

Virginia Privacy Notice

Virginia residents may have rights to access, correction, deletion, portability, and to opt out of targeted advertising, sale of personal data, and profiling. Appeals rights may apply under Virginia law.

Connecticut Privacy Notice

Connecticut residents may have rights to access, correction, deletion, portability, and to opt out of targeted advertising, sale of personal data, and profiling. Appeals rights may apply under Connecticut law.

Other U.S. State Privacy Rights

Residents of other states may have privacy rights under applicable state laws, which can vary by jurisdiction. Depending on your state of residence, you may be entitled to request access, correction, deletion, portability, and/or to opt out of certain processing such as targeted advertising, sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.

Attachment C – Applicant & Workplace Privacy Notice

This Attachment C – Applicant & Workplace Privacy Notice (“Notice”) explains how the Spark Entities (“Company,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal information relating to job applicants, candidates, employees, contractors, interns, temporary workers, and other workforce members (collectively, “Workforce Individuals”) in connection with recruiting, hiring, onboarding, employment or engagement, and workforce management.

Scope and Roles

• Recruiting, interviewing, and hiring, including background screening and reference checks where applicable.
• Onboarding, payroll, benefits, performance management, and workforce administration.
• Security, access management, IT operations, and compliance.
• Offboarding and post-employment obligations.

Personal Information We Collect

Information You May Provide

• Identifiers and contact information.
• Application and recruiting information such as resume/CV, work history, education, certifications, licenses, skills, references, interview notes, and writing samples.
• Work authorization and eligibility information.
• Compensation expectations and employment preferences.
• Onboarding and HR administration information such as tax forms, payroll/benefits elections, and direct deposit details.
• Communications with recruiting or HR.

Information We May Collect Automatically

• Device and usage information when you access our recruiting/HR systems or Company devices.
• Security and access information such as badge access logs, authentication logs, and VPN logs.

Information from Third Parties

• Background check and screening information.
• References and information from prior employers where permitted.
• Recruiting platforms and staffing agencies.
• Benefits providers and payroll vendors.
• Publicly available sources where permitted.

Sensitive Personal Information / Sensitive Data

• Government-issued identifiers.
• Financial account information for payroll.
• Precise geolocation, if needed for security or device management.
• Health-related information strictly for accommodations or leave administration where required.
• Biometric information, if used for timekeeping or access control.
• Voluntary EEO/DEI information, where voluntarily provided or required for reporting.

How We Use Personal Information

• Recruiting and Hiring: evaluate applications, schedule interviews, conduct checks where permitted, make hiring decisions, and prepare offer materials.
• Workforce Administration and Operations: onboard personnel, manage HR records, administer payroll, benefits, leave, performance management, training, and workforce planning.
• Security, IT, and Compliance: maintain system and facility security, manage access controls, investigate policy violations or incidents, and comply with legal obligations.
• Business Operations and Legal: manage corporate governance, audits, internal reporting, legal process, dispute resolution, and support corporate transactions.

AI Tools and Automated Decision-Making

We may use tools that assist with recruiting and workforce administration, such as tools that help with scheduling, candidate communications, document management, or workflow automation. We do not make final hiring decisions based solely on automated processing.

How We Disclose Personal Information

• Affiliates and related entities for legitimate business purposes, HR administration, security, compliance, and internal reporting.
• Service providers and vendors that perform services on our behalf.
• Professional advisors such as auditors, accountants, and outside legal counsel.
• Government authorities and regulators where required to comply with law or protect rights and safety.
• Transaction counterparties in connection with corporate transactions, subject to confidentiality protections and legal requirements.

Your Choices and Communications

Providing information is voluntary, but some personal information may be required to process an application, administer payroll or benefits, comply with the law, or maintain security. If you choose not to provide certain information, we may be unable to proceed with your application or employment or engagement.

How Long We Retain Personal Information

• Applicants not hired: We may retain applicant records for a period after the hiring decision for compliance, audit, and legal purposes.
• Employees/contractors: We retain HR records during the relationship and for a period after separation as required by law and internal policy.
• Litigation hold: We may retain information longer where necessary for investigations, legal claims, or regulatory matters.

How We Protect Personal Information

We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, acquisition, disclosure, alteration, and destruction, appropriate to the nature of the information and associated risks.

Cross-Border Transfers

Personal information may be processed and stored in the United States and in other locations where we or our service providers operate. Where required, we implement reasonable safeguards designed to protect personal information consistent with applicable law.

Children’s Privacy

This Notice does not apply to children, and our recruiting and workforce systems are not directed to children under 13. We do not knowingly collect personal information from children under 13 in an employment context.

Your Privacy Rights

Depending on where you live, you may have certain rights regarding your personal information, which may include the right to access, correct, delete, or obtain a copy of certain personal information, and to opt out of certain processing in some circumstances.

How to Contact Us

To submit a question or request regarding this Notice, contact us by submitting a request using one of the ways listed in the “How to Contact Us” section of the main Privacy Policy.

Changes to This Notice

We may update this Notice from time to time. We will post the updated Notice and revise the “Effective Date” above. If required by applicable law, we will provide notice of material changes in an appropriate manner.