SPHERUM CONSULTING - FZCO
Data Processing Agreement
This Agreement applies to a Client from the date that Client accepts the Terms of Service.
- Version
- 1.2
- Effective from
- 16 October 2026
- Last updated
- 16 October 2026
1. Parties, subject matter and relationship to the Terms
1.1 This Agreement is entered into between SPHERUM CONSULTING - FZCO (“Spherum”) and the legal entity that has subscribed to the Service (the “Client”).
1.2 This Agreement forms an integral part of the Terms of Service and applies from the moment they are accepted. In the event of conflict between this Agreement and the Terms of Service in respect of the processing of personal data, this Agreement prevails.
1.3 This Agreement governs only the processing of personal data carried out by Spherum on the Client’s instruction. Processing that Spherum carries out for its own purposes — the Client’s operator accounts, billing, service logs, and interactions with visitors to its website — is not governed by this Agreement and is disclosed in the Privacy Notice.
1.4 A sphere owner is not a party to this Agreement. The relationship between an owner and Spherum is governed separately and is unaffected by this Agreement.
2. Roles of the parties
2.1 The Client acts as controller and determines the purposes and means of processing the personal data made available to it through the Service.
2.2 Spherum acts as processor and processes that data solely on the Client’s instruction, within the scope set out in this Agreement.
2.3 In respect of the processing described in clause 1.3, Spherum acts as controller in its own right.
2.4 The parties acknowledge that the contents of a sphere are determined by its owner, and the set of fields requested is determined by the Client. Determining the field template is a decision of the Client as controller.
3. Subject matter, nature, purpose, duration and categories
3.1 Subject matter and nature. Storing personal data entered by sphere owners; making that data available to the Client to the extent and for the duration of the access granted by the owner; serving the public emergency view on a token scan; and maintaining service logs and records of how the Service is used.
3.2 Purpose. Enabling the Client to reach the contacts designated for emergencies by the individuals who have granted it access.
3.3 Duration. For the term of the Client’s subscription, followed by the retention periods set out in section 12.
3.4 Categories of data subject.
- Sphere owners: the Client’s employees, contractors and visitors.
- Individuals named by owners as emergency contacts. Those individuals are in no relationship with the Client and have not provided their data to it.
3.5 Categories of data. The owner’s name; the fields defined by the Client’s template and completed by the owner, including the names, telephone numbers and other contact details of emergency contacts; and technical data arising from use of the Service.
3.6 A token scan is recorded. The record holds the identifiers of the owner, the Client and the token, the token’s public reference, the resulting state of the view, and the time. No information capable of identifying the person scanning is recorded.
3.7 The Service is not intended for the processing of special categories of data. See section 6.
4. Instructions
4.1 Spherum processes personal data solely on the Client’s documented instructions. This Agreement, the Terms of Service and the Client’s use of the Service’s functionality constitute those instructions in full.
4.2 The scope of the Client’s instructions is limited to the purposes stated in the consent wording presented to the sphere owner. Spherum may decline to act on an instruction falling outside those purposes and will notify the Client.
4.3 Spherum will inform the Client without delay if, in its opinion, an instruction infringes applicable data protection law.
4.4 Persons authorised by Spherum to process the data are bound by an obligation of confidentiality.
5. Collection of consent
5.1 The legal basis for processing the data of sphere owners and of the emergency contacts they name is the consent of the data subject. That consent is given to the Client as controller.
5.2 The Client authorises Spherum to obtain that consent on its behalf through the Service’s interface.
5.3 The consent wording is determined by Spherum. The Client may not alter or supplement it, nor present owners with its own consent wording in respect of processing within the Service.
5.4 The Client confirms that the purposes stated in the consent wording correspond to the purposes for which it uses the Service, and that it pursues no other purposes.
5.5 Spherum maintains a record of the consents given and will confirm to the Client, on reasonable request, that consent exists.
5.6 Withdrawal of consent by an owner ends the provision of the corresponding data to the Client. The consequences of withdrawal are set out in section 12.
6. Client warranties
6.1 Lawfulness of purposes. The Client warrants that its purposes of processing are lawful, and that for any processing beyond the purposes stated in the consent wording it independently secures an appropriate legal basis.
6.2 Third-party data. The Client is aware that the details of emergency contacts are entered by sphere owners, and that the basis for entering them is the owner’s confirmation that those individuals have been informed and that the owner is entitled to share their details. Spherum does not verify that confirmation.
6.3 Special categories of data. The Client may not configure its field template so as to request data concerning health, biometric data, data revealing religious belief, or any other special category of data, nor encourage owners to enter such data.
6.4 The warranty in clause 6.3 extends to cases where such data is entered by an owner through the Client’s own field template or into free-text fields. The Client is responsible for the consequences of such entry, including consequences arising under legislation governing medical data and the requirements as to where it may be held.
6.5 The Service was not designed for the processing of special categories of data, and Spherum gives no warranties in respect of them. Breach of clauses 6.3–6.4 entitles Spherum to suspend access.
7. Sub-processors
7.1 The Client gives Spherum general authorisation to engage sub-processors.
7.2 The sub-processors engaged as at the date of this Agreement:
| Sub-processor | Jurisdiction of processing | Purpose |
|---|---|---|
| Amazon Web Services | Federal Republic of Germany (eu-central-1) | Compute, storage, logs |
| MongoDB Atlas | Federal Republic of Germany (eu-central-1) | Primary data store |
| Amazon Web Services (SES) | Federal Republic of Germany (eu-central-1) | Transactional email |
| PostHog | Federal Republic of Germany (eu-central-1); access by the sub-processor’s personnel from the United States of America | Product usage analytics |
7.3 Spherum will give the Client no less than 14 days’ notice of any change to this list. The Client may object on reasonable grounds relating to data protection; where the objection cannot be resolved, the Client may terminate its subscription.
7.4 Spherum imposes on each sub-processor data protection obligations no lower than those set out in this Agreement, and remains liable to the Client for their performance.
7.5 The Client may connect third-party services to the Service, including AI assistants, and authorise them to access personal data through the integrations Spherum makes available. Such services are selected and engaged by the Client, process that data on the Client’s instructions and under their own terms, and are not sub-processors of Spherum. The Client is responsible for its selection and use of them.
8. Cross-border transfer
8.1 Personal data is processed outside the UAE, in the Federal Republic of Germany (region eu-central-1). Technical data arising from use of the Service may in addition be accessed from the United States of America by the sub-processor engaged for product usage analytics under clause 7.2.
8.2 The transfer is made on the basis of the contractual safeguards provided for in Article 23 of Federal Decree-Law No. 45 of 2021. No adequacy of the recipient jurisdiction’s level of protection is claimed: the competent authority has published no list of adequate jurisdictions and has approved no standard contractual clauses.
8.3 Spherum ensures that obligations corresponding to the requirements of that Decree-Law extend to the recipients.
8.4 Should the competent authority publish a list of adequate jurisdictions or approve standard contractual clauses, Spherum will revisit the basis of transfer and notify the Client of any change.
8.5 Access to the production environment by Spherum personnel takes place from within the UAE.
9. Security measures
9.1 Spherum applies technical and organisational measures proportionate to the risks of the processing, including: encryption in transit; storage of secrets in a managed secrets store; placement of compute resources in private network segments; restriction of network access to the data store by address list; administrative access over a secured channel; the absence of static access keys in deployment processes; logging of processing events; and public emergency view addresses that are not indexed and cannot be derived from the identifier printed on a token.
9.2 Spherum may change these measures provided the level of protection is not reduced.
10. Personal data breaches
10.1 Spherum will notify the Client without undue delay after becoming aware of a personal data breach affecting the Client’s data.
10.2 The notification will set out, so far as known at the time, the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures taken or proposed. Information not available at the time will be provided as it is obtained.
10.3 Spherum will provide the Client with reasonable assistance in meeting its own notification obligations. Notifying the competent authority and the data subjects is the Client’s obligation.
11. Assistance to the Client
11.1 Data subject rights. The Service’s functionality enables a sphere owner to view, amend and withdraw the data they have provided, and to obtain a copy of their own record. To the extent not covered by that functionality, Spherum will provide the Client with reasonable assistance in responding to data subject requests.
11.2 A data subject request received directly by Spherum and relating to processing carried out on the Client’s instruction will be passed to the Client without a substantive response being given.
11.3 Impact assessments. Spherum will provide the Client with the information necessary for a data protection impact assessment and for prior consultation with the competent authority, to the extent that information is available to Spherum.
11.4 Regulatory requests. Spherum will notify the Client of requests received that relate to processing carried out on its instruction, unless prohibited from doing so by law.
12. Termination, return and deletion
12.1 Withdrawal of access by an owner. On withdrawal, provision of the data to the Client ceases immediately. The field values held in the access record are deleted 30 days after withdrawal. Re-inviting the owner within that period stops the period running.
12.2 Archiving of a person by the Client. Archiving ends the Client’s access and does not affect the owner’s own data. The field values held in the Client’s record are deleted 90 days after archiving.
12.3 Consent record. The record of an access granted is retained for 24 months after withdrawal and serves as evidence that the processing was lawful while the access was in force. The record shows to whom, in what scope, and on the basis of which version of the consent wording the access was granted, and holds no field values. On expiry of that period the record is deleted.
12.4 Termination of subscription. On termination, Spherum ceases processing on the Client’s instruction. For 30 days the Client may obtain an export of the data available to it at termination; after that period the data is deleted, save for information that must be retained by law.
12.5 Deletion of an owner’s account. An owner may delete their account. Deletion ends every access they have granted. The Client retains the record that an access existed and was ended, to the extent set out in clause 12.3.
12.6 The retention periods in this section apply as in force at the time of the relevant event.
13. Audit
13.1 Spherum will make available to the Client, on written request, the information reasonably necessary to demonstrate compliance with this Agreement. That information may be provided as documentation, completed security questionnaires, or third-party certifications and reports held by Spherum or its sub-processors.
13.2 Where the Client can show that the information provided under clause 13.1 is not sufficient to demonstrate compliance, the Client may request an on-site audit. Any such audit: may be carried out no more than once in any twelve month period, except where required by a regulator or following a personal data breach affecting the Client; requires 30 days’ prior written notice; takes place during business hours and must not disrupt Spherum’s operations; is conducted by the Client or by an independent auditor who is not a competitor of Spherum, in either case subject to confidentiality obligations; and is at the Client’s cost.
13.3 An audit does not extend to the data, systems or premises of other clients, to Spherum’s commercially confidential information, or to the premises or systems of any sub-processor, in respect of which Spherum will instead provide such information as it is able to obtain.
14. Data exported by the Client
14.1 Personal data exported by the Client from the Service, or otherwise obtained by it and held outside the Service, is processed by the Client in its own right as controller and is not governed by this Agreement.
14.2 Withdrawal of access by an owner ends provision of the data through the Service and does not reach copies held outside it. Bringing such copies into line with the withdrawal is the Client’s obligation.
15. Liability
15.1 Liability under this Agreement is limited in accordance with the Terms of Service. No separate limit applies in respect of the processing of personal data.
15.2 The limitation does not apply to obligations that applicable law does not permit to be limited.
16. General
16.1 This Agreement is governed by the federal law of the United Arab Emirates and the law of the Emirate of Dubai. Disputes arising out of this Agreement are subject to the jurisdiction of the courts of Dubai.
16.2 This Agreement is amended in the manner set out in the Terms of Service for amendments to those terms.