SPHERIC CREATIVE
Back to the site

Privacy Policy

At Spheric Creative we protect the privacy of everyone who visits our website and contacts us. Here we explain clearly how we handle your personal data.

Last updated: October 1, 2026

1. Data controller

Spheric Creative SpA (also known as Spheric Agency; “Spheric”, “we”, “us”) is the controller of the personal data collected through the website sphericagency.com and its versions in other languages (the “Site”).

Spheric is a multinational technology, advertising and artificial intelligence company with offices in Turku, Berlin, Hamburg, London, New York, Miami, Dubai, Pune, Bangalore, Beijing, São Paulo and Chile.

For any matter regarding this Policy or your personal data, please write to legal@sphericagency.com.

2. Scope of this Policy

This Policy explains what personal data we process when you visit the Site or contact us through the contact form, why we use it, who we share it with, how long we keep it and what rights you have. It applies to every language version of the Site.

Personal data processed under a services agreement with our clients is also governed by that agreement and, where applicable, by the data processing agreement signed with each client.

3. Personal data we process

a) Data you give us. When you complete the contact form we process your name, email address, phone number (optional), subject, the content of your message and the language of the page.

b) Submission origin data. To confirm that a message is genuine and to prevent fraud, impersonation and spam, when you submit the form our server records: IP address; approximate country, region and city derived from the IP address (we do not use GPS or precise geolocation); internet service provider; time zone according to the IP address and to your browser; local time; the page you wrote from and the referring site; screen resolution; browser and device type (user agent); and the date and time of submission.

c) Technical logs. Like any website, our server logs IP address, browser, date and time and the pages requested, solely to operate the site and keep it secure.

d) WhatsApp. If you message us on WhatsApp we process your number, profile name and the content of the conversation. First replies may be generated by an artificial intelligence assistant; you can ask to speak to a person at any time.

e) Cookies and browser storage. The site does not set cookies, does not use analytics, advertising or tracking tools and does not build profiles. It only uses your browser’s session storage (sessionStorage) to remember whether you have already seen the opening animation and for the language transition; it is deleted when you close the tab.

f) Typefaces. The Arabic, Chinese and Hindi versions of the site load typefaces from Google Fonts (Google LLC); to do so your browser shares your IP address with Google.

We do not ask for sensitive data (for example health, beliefs or ethnic origin). Please do not include it in your message.

4. Purposes and legal bases

  • Answering your enquiries and requests for information or quotes. Legal basis: steps taken at your request prior to entering into a contract, and our legitimate interest in responding to those who contact us.
  • Managing business relationships with clients, partners and suppliers. Legal basis: performance of a contract.
  • Operating, protecting and improving the Site, including preventing fraud, spam and attacks. Legal basis: our legitimate interest in a secure and functional website.
  • Complying with legal obligations and lawful requests from competent authorities. Legal basis: legal obligation.

We do not sell or rent your personal data, we do not use it to send you marketing without your consent, and we do not make decisions based solely on automated processing that produce legal effects concerning you.

5. Recipients

Only Spheric staff who need your data to deal with your request can access it. The following providers also act on our behalf as processors / service providers, under contract and bound by confidentiality:

  • Web hosting provider (site server and backup copy of messages).
  • FormSubmit (formsubmit.co), which delivers form messages to our mailbox.
  • Google LLC, provider of the mailbox where we receive messages, and of Google Fonts.
  • ipwho.is and, as a fallback, ip-api.com, which return the country and approximate location of an IP address.
  • WhatsApp (Meta Platforms) and Anthropic PBC, provider of the artificial intelligence model that may answer WhatsApp messages.
  • Professional advisers bound by confidentiality (lawyers, auditors) and public authorities, only where required by law.

6. International transfers

Because we operate in several countries, your data may be processed outside the country where you live. When we transfer data from the European Economic Area, the United Kingdom or other jurisdictions with specific requirements, we rely on adequacy decisions or, failing that, on the Standard Contractual Clauses approved by the European Commission, the UK International Data Transfer Addendum or Agreement, or other equivalent safeguards recognised by applicable law. You may request information about these safeguards by writing to our contact email.

7. Retention periods

  • Contact form messages and their origin data: 24 months from the last contact, unless a business relationship begins.
  • Anti-abuse counters (IP address stored only as a hash, never in clear): 48 hours.
  • Server logs: no longer than 90 days, unless needed to investigate a security incident.
  • Client and supplier data: for the duration of the relationship and then for the applicable limitation, accounting and tax periods.

When these periods end, data is deleted or irreversibly anonymised.

8. Security

We apply technical and organisational measures appropriate to the risk to protect your data against loss, unauthorised access, alteration or disclosure: encrypted connections (HTTPS), need-to-know access control, strong passwords, security updates and providers offering sufficient guarantees. If a personal data breach affecting your data occurs, we will notify the authorities and, where required, you, within the legal deadlines.

9. Your rights

You may exercise the following rights over your personal data at any time:

  • Access: know whether we process your data and obtain a copy.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure: ask us to delete your data.
  • Objection to processing based on our legitimate interest.
  • Restriction of processing.
  • Portability: receive your data in a structured, commonly used format.
  • Withdraw consent where processing is based on it, without affecting the lawfulness of prior processing.

To exercise them, write to legal@sphericagency.com stating the right you wish to exercise. We may ask for additional information to verify your identity. We will respond within 30 days, or within any shorter period set by applicable law. Exercising your rights is free of charge.

If you believe we have not handled your request properly, you may lodge a complaint with the competent data protection authority.

10. Additional information by country

Country-specific policies, each in its own language and under its own law: Privacy policies by country →

  • European Union, European Economic Area (including Germany, Finland, Norway, Italy, France and Portugal) and United Kingdom: we process your data under Regulation (EU) 2016/679 (GDPR), the UK GDPR and the Data Protection Act 2018. You may complain to the supervisory authority of your country of residence or work, or of the place of the alleged infringement.
  • Chile: processing is governed by Law No. 19,628 on the Protection of Private Life and, from its entry into force, by Law No. 21,719, including the rights of access, rectification, erasure, objection, portability and blocking.
  • Brazil: the General Data Protection Law (Law No. 13,709/2018 – LGPD) applies. You may exercise the rights set out in Article 18 of the LGPD and file complaints with the ANPD.
  • United States: residents of states with comprehensive privacy laws, such as California (CCPA/CPRA), may request to know, correct and delete their data. We do not sell or “share” personal data for cross-context behavioural advertising and we do not use sensitive personal information. We will not discriminate against anyone for exercising their rights.
  • United Arab Emirates: we process your data in accordance with Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data.
  • India: under the Digital Personal Data Protection Act, 2023, you may exercise your rights and raise grievances through our contact email, which serves as our grievance channel; if you are not satisfied, you may approach the Data Protection Board of India.
  • China: under the Personal Information Protection Law (PIPL), you may exercise your rights to access, copy, correct and delete your data and to request an explanation of our processing rules by writing to our contact email.

11. Children

The Site is aimed at businesses and professionals and is not intended for children under 16 (or the minimum age set by the law of your country). We do not knowingly collect children’s data; if we find that we have, we will delete it.

12. Third-party links

The Site may contain links to or content from brands, clients and partners. Spheric is not responsible for the privacy practices of those sites, so we recommend reviewing their policies.

13. Changes to this Policy

We may update this policy to reflect legal changes or changes to our services. The current version will always be published on this page with its date and significant changes will be highlighted. Last updated: October 15, 2026.

14. Contact

Spheric Creative · legal@sphericagency.com · sphericagency.com