SPHERUM CONSULTING - FZCO
Privacy Notice
This notice explains how personal data is handled in connection with the Spherum service, our website, and our dealings with the people who write to us.
- Version
- 1.4
- Effective from
- 1 November 2026
- Last updated
- 1 November 2026
1. Who we are and what this notice covers
1.1 SPHERUM CONSULTING - FZCO (“Spherum”, “we”) is a company registered with IFZA, Dubai Silicon Oasis, United Arab Emirates, licence 88628.
1.2 This notice explains how personal data is handled in connection with the Spherum service, our website and our dealings with the people who contact us. It applies to everyone: visitors to our website, people who book a demonstration, the operators of our client companies, sphere owners, and the individuals named by owners as emergency contacts.
1.3 For questions about this notice or to exercise any right described in it, write to contact@spherum.ae.
2. Our two roles
2.1 Spherum handles personal data in two capacities, and the difference matters for who decides what happens to the data.
2.2 As a processor. The contents of a sphere — the details an owner enters and makes available to a company — are handled on that company’s instruction. The company is the controller. It decides which fields are requested and why it needs them, and its own privacy notice governs what it does with the data. Our role is described in section 5.
2.3 As a controller. Our own accounts, our billing, our website and our correspondence are handled for our own purposes. We decide what is collected and why. That processing is described in section 4.
2.4 An owner’s account belongs to the owner, not to any company. A company sees only what the owner has granted it, for as long as the grant lasts.
3. Legal bases we rely on
3.1 Where we act as controller, we rely on one of the following:
- Performance of a contract — an owner’s account, a client’s subscription, and the services provided under them.
- Steps taken at your request before a contract — a demonstration you book, an enquiry you send us.
- Our legitimate interests — keeping the service secure and available, preventing abuse, and maintaining records for the defence of legal claims.
- Compliance with a legal obligation — accounting, tax and corporate records.
- Consent, where we ask for it and only for what we ask.
3.2 Where we act as processor, the legal basis is determined by the client company. For the contents of a sphere, that basis is the consent given by the owner through the service.
4. Where we act as controller
4.1 Owner accounts. An owner registers to hold their own contact details and decide who may see them. We handle the owner’s name, contact address, authentication data, and the record of the grants they have given, changed or withdrawn. The basis is performance of the agreement between the owner and Spherum. No consent is asked for this, and none is needed: the account exists because the owner asked for it, and closing it ends the processing.
4.2 Operator accounts at client companies. A person who administers a company’s workspace has an account. We handle their name, work address, role, authentication data, and the record of actions taken in the workspace. The basis is performance of our contract with their employer and our legitimate interest in an accountable record of who did what.
4.3 Billing. Subscriptions are billed through Stripe. We handle the company’s details, the name and address of the person paying, the subscription and payment history, and invoices. We do not receive or store full card numbers — card details are entered on Stripe’s own payment page. The basis is performance of the contract and, for invoices and accounting records, compliance with a legal obligation.
4.4 Demonstrations and enquiries. If you book a demonstration through Cal.com or write to us, we handle your name, address, the details you choose to give, and our correspondence with you. The basis is the steps taken at your request. If a subscription follows, the same data continues under clause 4.3; if it does not, we keep the correspondence only as long as it has a purpose.
4.5 Analytics on our website. We use PostHog to understand how our website is used and which of our campaigns bring people to it. This happens in one of two ways, depending on the choice you make in the banner shown on your first visit.
(a) For every visitor. Without setting cookies or storing anything on your device, we record the pages you open, the buttons and links you press, how far you scroll, the campaign or advertisement that brought you to the site and, if you arrived by clicking one of our advertisements, the click identifier the advertising platform adds to its link. To count visitors, PostHog combines your IP address and browser details with a value that changes every day and keeps only the result; the IP address itself is discarded and is not used to work out your location. A visitor is therefore recognised for no longer than one day. Before a page address is sent, every parameter other than campaign parameters and click identifiers is removed from it. The basis is our legitimate interest in understanding and improving our website and in knowing which campaigns work.
(b) If you accept analytics cookies. In addition, PostHog stores an identifier on your device so that a later visit is recognised as yours, records your visits to our website as session recordings, and builds heatmaps of where visitors click. Session recordings capture what is shown on the page and how you move through it; anything you type into a field is hidden before the recording leaves your browser. The basis is your consent. You may withdraw it at any time through “Cookie settings” at the foot of every page; withdrawal deletes the identifier from your device and does not affect the records made before it.
(c) Our advertising on Google and LinkedIn. If you arrived by clicking one of our advertisements on Google or LinkedIn, we tell that platform when the visit led to an action on our website, such as reading further into it or requesting a trial. What we send is the click identifier from the platform’s own link, the kind of action and its time — never your name, your email address or anything you typed. Each platform uses it to report which of our advertisements work, to decide where to show them, and to show our advertisements again to people who took such an action, or to people the platform considers similar to them. The basis is our legitimate interest in knowing which of our advertising works and in reaching people who have shown interest in the service. You may object at any time by choosing “Decline” in the banner or in “Cookie settings” at the foot of every page, after which the click identifier is no longer recorded or sent, or by writing to us.
Unless you choose “Decline”, our website also loads LinkedIn’s Insight Tag. It tells LinkedIn which of our pages you open and which of the actions above you take, and LinkedIn may recognise you as one of its members through its own cookies. LinkedIn uses this to report which of our advertisements work, including ones you saw without clicking, to show our advertisements again to visitors of our website, and to give us aggregated statistics about our visitors from which no one can be identified; we never receive information that identifies you. The basis and your right to object are the same as above: after “Decline” the tag is no longer loaded and the LinkedIn cookies on our domain are deleted; cookies LinkedIn keeps on its own domain are governed by LinkedIn’s own settings.
(d) We do not link these records to your name or email address, and we share them with no advertising platform except as clause (c) describes.
4.6 Analytics in the service application. We also use PostHog to record how the service application is used, such as which pages are opened and which functions are used. These records never contain the contents of a sphere, the details of emergency contacts, or anything entered into a form, and no session is recorded. By default the records are anonymous, and records relating to owners are never linked to them. The basis is our legitimate interest in understanding and improving the service.
4.7 An operator at a client company may choose to allow us to link their records to their account. The link is made by a pseudonymous identifier and never by a person’s name or email address. Records linked in this way also carry the name of the client company and the status of its subscription. The basis is the operator’s consent. It may be withdrawn at any time in the privacy settings of the application, and withdrawal does not affect the records made before it. Records from the service application are never shared with advertising platforms or used to target advertising.
4.8 Cookies and browser storage. The service application sets no cookies of its own. It keeps in your browser’s storage your sign-in token, the sign-in method you last used and, for an operator, the choice made under clause 4.7. Each is needed to provide the service you asked for or to remember a choice you made, and none is used to track you. The sign-in page loads Google’s sign-in service, which may set Google’s own cookies; from that point Google’s own notice applies alongside ours.
4.9 Cookies and browser storage on our website. Our website sets no cookies of its own and stores nothing on your device unless you accept analytics cookies, with two exceptions. Your choice in the banner, or the fact that you closed it, is remembered in your browser’s storage so that you are not asked again. And unless you choose “Decline”, LinkedIn’s Insight Tag (clause 4.5(c)) uses the following cookies:
| Name | Set by | Purpose | Kept |
|---|---|---|---|
li_fat_id |
LinkedIn, on our domain | The click identifier of a visit from our LinkedIn advertisement | 30 days |
li_giant, ln_or |
LinkedIn, on our domain | Measuring visits for our LinkedIn advertising | Up to 7 days |
bcookie, lidc, li_sugr, UserMatchHistory, AnalyticsSyncHistory |
LinkedIn, on linkedin.com | Recognising LinkedIn members and measuring our advertising | Up to 1 year |
Closing the banner is not a choice: nothing else is stored and clause 4.5(a) applies. If you accept, the following are also used:
| Name | Set by | Purpose | Kept |
|---|---|---|---|
spherum_analytics_consent (browser storage) |
Spherum | Remembers your choice in the banner, or that you closed it | Until you change it or clear your browser |
__ph_opt_in_out_[project key] (browser storage) |
PostHog, on our domain | Records that you accepted | Until you change your choice or clear your browser |
ph_[project key]_posthog (cookie and browser storage) |
PostHog, on our domain | Recognises your later visits; links the pages of one visit into a session recording | 1 year |
ph_[project key]_… (session storage) |
PostHog, on our domain | Keeps one visit together within a browser tab | Until the tab is closed |
Pages that embed our booking calendar load Cal.com, which may set its own cookies; Cal.com’s own notice applies to them.
4.10 Our hosting provider records the technical data inherent in serving any web page — the requesting address, the time, the page requested, and the browser’s own description of itself — for security and availability. We do not use those records to identify visitors.
4.11 Pages that embed a third party, such as the demonstration booking form, load that third party only when you choose to open them. From that point the third party’s own notice applies alongside ours.
5. Where we act as a client’s processor
5.1 The contents of a sphere are entered by its owner and made available to a company by the owner’s grant. We store that data, deliver it to the company for as long as the grant lasts, and stop delivering it when the owner withdraws.
5.2 The set of fields an owner is asked to complete is defined by the company. We do not add fields of our own and do not use the contents of a sphere for any purpose of our own. We do not sell personal data and do not use it for advertising.
5.3 A written agreement with each client company governs this processing, including confidentiality, security, the engagement of sub-processors, and the handling of any breach. It is published at /legal/dpa.
5.4 Token scans. A token carries a reference that opens a public emergency view of the sphere it belongs to. When a token is scanned, we record which token, which sphere and which company it relates to, what the view showed, and when. We record nothing about the person scanning — no address, no browser information, no device identifier. The record exists so that an owner can see when their emergency view was opened, and is part of the data handled for the owner and their company. A scan of a reference we do not recognise is not recorded at all.
6. If you were named as someone’s emergency contact
6.1 Your details are in the service because someone named you as a person to be reached in an emergency. You did not give those details to us, and in most cases you have no relationship with the company that holds the sphere.
6.2 The person who named you confirmed, when entering your details, that you had been informed and that they were entitled to share them. We are not able to verify that confirmation.
6.3 We hold your details only as part of that person’s sphere. We do not use them to contact you, do not add you to any list, and do not combine them with anything else.
6.4 If you want your details removed, the quickest route is to ask the person who named you: they can amend or delete the entry themselves at any moment. You may also write to contact@spherum.ae and we will act on the request or pass it to the company responsible, telling you which we have done.
7. Who else handles the data
7.1 We use the following service providers. Each handles data only for the purpose shown and under an agreement that binds it to protect the data.
| Provider | Purpose | Where it processes |
|---|---|---|
| Amazon Web Services | Hosting, storage, logs | Germany |
| MongoDB Atlas | Primary data store | Germany |
| Amazon Web Services (SES) | Invitations and service email | Germany |
| Stripe | Subscription billing and payments | United States, Ireland |
| Cal.com | Scheduling of demonstrations | United States |
| PostHog | Usage analytics for the website and the service | Germany; access by the provider from the United States |
| Google (Google Ads) | Measuring which of our advertisements lead to actions on our website (clause 4.5(c)) | United States and other countries where Google operates |
| LinkedIn (LinkedIn Ads) | Measuring which of our advertisements lead to actions on our website (clause 4.5(c)) | United States and other countries where LinkedIn operates |
7.2 The first three handle the service itself, including the contents of spheres. PostHog receives records of how the website and the application are used, but no sphere contents and no emergency contact details. Stripe and Cal.com handle only our own commercial dealings, and none of that data reaches them either. Google receives only the click identifier of a visit that came from its own advertisement, with the kind of action and its time. LinkedIn receives the same and, through its Insight Tag, the pages of our website opened by visitors who have not declined, as clause 4.5(c) describes.
7.3 We also disclose personal data where we are required to do so by law, or where it is necessary to establish, exercise or defend a legal claim.
7.4 We do not sell personal data, and we do not share it with anyone for their own marketing.
8. Transfers outside the United Arab Emirates
8.1 The service runs in Germany (the eu-central-1 region). The contents of spheres are therefore processed outside the UAE.
8.2 That transfer is made on the basis of the contractual safeguards provided for in Article 23 of Federal Decree-Law No. 45 of 2021. Obligations matching the requirements of that law are imposed on the recipients by contract. We make no claim that the level of protection in the receiving country has been declared adequate: the competent authority has published no list of adequate jurisdictions and has approved no standard contractual clauses. Should it do so, we will revisit the basis of transfer.
8.3 Billing data reaches Stripe in the United States and Ireland because that transfer is necessary to perform the subscription contract. Booking data reaches Cal.com in the United States because the transfer is necessary to take the step you asked us to take. Usage records, website analytics and session recordings reach PostHog, which stores them in Germany and whose personnel may access them from the United States; that transfer rests on the same contractual safeguards as clause 8.2. The click identifiers and actions described in clause 4.5(c) reach Google and LinkedIn, which process them in the United States and elsewhere; that transfer rests on the data protection terms agreed with each of them for its advertising services.
8.4 Access to the production environment by our personnel takes place from within the United Arab Emirates.
8.5 You may ask us for information about the safeguards relied on for any transfer described here.
9. How long data is kept
9.1 Within the service:
| Data | Kept |
|---|---|
| Field values in a grant, after the owner withdraws it | 30 days |
| Field values in a company’s record, after the person is archived | 90 days |
| The record that a grant was given and on what terms — without field values | 24 months after withdrawal |
| Data available to a company at the end of its subscription | 30 days, for export, then deleted |
9.2 An owner’s own data is kept for as long as the account exists. Deleting the account ends every grant given from it.
9.3 Outside the service: operator accounts last as long as the person administers the workspace; billing and accounting records are kept for the period required by the tax and corporate legislation of the United Arab Emirates; correspondence and booking records are kept only as long as they serve the purpose for which they arose; technical hosting records are kept for a short period and then discarded. Website analytics records are kept for 12 months and session recordings for 30 days, after which PostHog deletes them. Click identifiers are kept with the website analytics records for 12 months; Google and LinkedIn each keep what they receive under their own terms.
9.4 Where we are required by law to retain something, we retain it for that period regardless of any deletion described above.
10. Your rights
10.1 Subject to the conditions set by applicable law, you may ask us to:
- confirm what data about you is held, and give you access to it;
- correct data that is wrong or incomplete;
- delete data, where there is no basis to keep it;
- give you a copy of data you provided, in a portable form;
- restrict or object to a particular use;
- withdraw a consent you gave, at any time, without affecting the lawfulness of what was done before you withdrew it.
10.2 An owner does not need to write to us for most of this. The application lets you view, change and export your own data, see who you have granted access to, and withdraw any grant at once.
10.3 Write to contact@spherum.ae to exercise a right. We may need to confirm who you are before acting. We answer within the period set by applicable law and, if we cannot do what you ask, we tell you why.
10.4 If your request concerns data held in a sphere on a company’s instruction, we pass it to that company, which decides how to answer, and we tell you that we have done so.
10.5 You may complain to the UAE Data Office. We would rather you came to us first, but nothing requires you to.
11. Security
11.1 We apply technical and organisational measures proportionate to the risks, including encryption in transit, secrets held in a managed store, compute resources placed in private network segments, restricted network access to the data store, administrative access over a secured channel, logging of processing events, and public emergency view addresses that are neither indexed nor derivable from the reference printed on a token.
11.2 No system is beyond risk. If a breach affects your data and the law requires that you be told, you will be told.
12. Age
12.1 The service is intended for use by adults. It does not provide for the independent registration of anyone under the age of 18, and we do not knowingly maintain an account for a person under that age. If you believe such an account exists, write to contact@spherum.ae.
13. Changes to this notice
13.1 We may update this notice. The version and the date it came into force are shown at the top.
13.2 Where a change materially affects how your data is handled, we tell registered users before it takes effect.
14. Contact
14.1 SPHERUM CONSULTING - FZCO, IFZA, Dubai Silicon Oasis, Dubai, United Arab Emirates. Write to contact@spherum.ae.