Privacy Policy

Privacy Policy

Intermediary

Sphere is an intermediary that facilitates the technological platform to connect people and allow the realization of commercial transactions. Sphere does not store merchandise, does not have inventory, does not sell its own products and does not manage delivery. The seller is fully responsible for shipping, delivery, packaging and product compliance. The purchase agreement is concluded between the buyer and the seller. Sphere is not part of that agreement.

Data Controller

Sphere is responsible for the processing of personal data collected through the platform. Personal data is governed by the PDPL (Federal Decree-Law 45/2021) and the regulations of the free zone Ras Al Khaimah Economic Zone Authority (RAKEZ), as well as the federal laws of United Arab Emirates.

Personal data collected

The personal data collected includes:

• User registration: name, surnames, email address, password, phone number, billing address and payment data.
• User profile: information about interests, preferences, navigation history and behavior on the platform.
• Advertisements and posts: content published by users, including text, images, videos and links.
• Orders and transactions: information about products purchased, prices, payment methods and shipping data.
• Chat and communication: messages exchanged between users, including contact data and conversations.
• KYC (Know Your Customer): verified information to identify the user, such as identity documents and banking data.
• Payments: information related to transactions, including data from the Ziina gateway and payment history.
• Analytics: data on platform usage, including visits, time spent, interactions and user behavior.

Purposes and legal bases of processing

Personal data is processed for the following purposes:

• Provide and manage access to the platform.
• Facilitate communication between users and the exchange of information.
• Administer the marketplace and commercial transactions.
• Track orders and manage payments.
• Offer technical support and customer service.
• Perform data analysis to improve the user experience.
• Share information with third parties for the fulfillment of legal obligations.

The legal bases for processing include user consent, the fulfillment of contractual obligations, Sphere's legitimate interest and the need to comply with applicable laws.

Sharing of personal data

Sphere shares personal data with the following third parties:

• Sellers: to facilitate the transaction and order management.
• Ziina gateway: to process payments and manage transactions.
• Technology providers: for the development, maintenance and security of the platform.
• Governmental bodies and competent authorities: to fulfill legal obligations.

International data transfers

Sphere may transfer personal data to third parties located abroad, provided that the conditions established by the PDPL are met, including the fulfillment of data protection standards and the existence of appropriate protection mechanisms.

Data security guarantees

Sphere implements appropriate technical and organizational measures to protect personal data against loss, theft, alteration or unauthorized access. These measures include data encryption, access control and constant updating of security systems.

Data retention periods

Personal data is retained for the time necessary to fulfill the purposes for which it was collected, as well as to fulfill legal, contractual or tax obligations. Once data is no longer necessary for these purposes, it will be deleted or anonymized.

Rights of the data subject

Users have the right to:

• Access their personal data.
• Rectify inaccurate data.
• Delete their data in the cases provided by the PDPL.
• Object to the processing of their data.
• Port their data to another controller.
• Limit the processing of their data.

To exercise these rights, users can contact Sphere through the privacy email legal@cc-sphere.com.

Privacy contact

To any inquiry or exercise of rights related to data protection, you can contact Sphere through the email address legal@cc-sphere.com.

Biometric data and facial verification

As part of the seller identity verification (KYC) process, Sphere may request a short video of your face (liveness check) to compare it, using facial recognition technology, against the photo on the identity document you uploaded. This includes:

• The verification video/selfie itself.
• A mathematical representation of your facial features (a facial vector/embedding) generated from the video and the document, used solely to calculate a similarity score.

Legal basis: this processing is carried out only with your explicit consent, given expressly at the corresponding step of the verification wizard (recorded with date and time). You may decline this step, though doing so may prevent your seller verification from being approved.

Purpose: to prevent identity theft and the use of someone else's document. No approval or rejection decision is automatic: a human reviewer always confirms the result before any change is applied to your account.

Third-party/AI processing: facial similarity analysis runs on Sphere's own infrastructure (it is not sent to social networks or unrelated third parties); reading and authenticity verification of documents uses an external specialized AI service provider, under contractual confidentiality terms.

Retention: the video/selfie and the facial vector are kept while your seller account remains active and for the additional period required to comply with legal obligations or resolve disputes. You may request their early deletion by writing to legal@cc-sphere.com, unless there is a legal obligation to retain them.