ClientSphere Privacy Policy

1. About this Policy

1.1 This Privacy Policy explains how ClientSphere ("ClientSphere", "we", "us" or "our") handles personal data in connection with the ClientSphere platform at clientsphere.io and its associated applications, interfaces, integrations and services (the "Services").

1.2 This Policy is incorporated into, and forms part of, the ClientSphere Terms of Use under clause 1.6 of those Terms. Capitalised terms used but not defined here have the meanings given in the Terms.

1.3 The Services are provided from the Federal Republic of Nigeria. The Nigeria Data Protection Act 2023 (the "NDPA") and the Nigeria Data Protection Act General Application and Implementation Directive 2025 (the "GAID") are the primary framework governing our processing. Where a data protection law of another jurisdiction applies to us as a matter of law, we will comply with it.

2. Which data this Policy covers

2.1 There are two distinct categories of personal data involved in the Services, and it matters which one is in question.

2.2 Data about our own customers and their users — registration, billing, authentication and support data — is data for which we are the Data Controller. This Policy describes that processing, and sections 3, 4, 7 to 12 and 15 apply to it.

2.3 Customer Data, which our customers upload to or generate within their Workspace, is data for which the customer is the Data Controller and we act only as Data Processor on their instructions. Section 5 explains this. If you are an individual whose data has been entered into a customer's Workspace — for example as one of their contacts, a person who raised a support ticket with them, or a recipient of their messages — that customer, not ClientSphere, decides how your data is used, and you should contact them.

3. Data we collect as Data Controller

3.1 In accordance with clause 7.6 of the Terms, we act as Data Controller in respect of:

• Account registration data — name, work email address, telephone number, job title, employer, and the workspace and company details supplied on registration;
• Billing data — plan, subscription and usage records, invoices issued to the customer, and payment status. Card details are handled by our payment processor and are not stored by us;
• Authentication and access logs — sign-in events, failed sign-in attempts, session records, IP address and approximate location derived from it, browser and device information;
• Support correspondence — the content of messages, tickets and requests sent to us, and our replies;
• Technical and usage telemetry — feature usage, performance data, error reports and diagnostic logs relating to the operation of the Services.

3.2 We do not require, and ask customers not to submit to us, personal data of a sensitive nature in support correspondence.

4. How we use that data, and our lawful basis

4.1 We use the data described in section 3 to: provide, operate, secure and support the Services; authenticate users and protect accounts; administer subscriptions, billing and collections; investigate and prevent fraud, abuse and security incidents; diagnose faults and improve performance and reliability; communicate about service changes, incidents and administrative matters; and comply with legal, regulatory, tax and accounting obligations.

4.2 Our lawful bases under the NDPA are: performance of a contract, where processing is necessary to provide the Services to the customer; our legitimate interests, in securing the Services, preventing abuse, and improving reliability, where those interests are not overridden by the rights of the data subject; compliance with a legal obligation, in respect of tax, accounting and regulatory records; and consent, where we rely on it, which may be withdrawn at any time without affecting processing carried out before withdrawal.

4.3 We send administrative and service messages as part of providing the Services; these are not marketing and cannot be opted out of while an account remains open. Where we send marketing communications, we do so only on a lawful basis and every message carries a working opt-out.

4.4 We may generate aggregated, statistical and de-identified data from use of the Services, as permitted by clause 6.6 of the Terms. Such data does not identify any individual and is not presented in a way that permits identification.

4.5 We do not sell personal data, and we do not disclose it to third parties for their own independent marketing purposes.

5. Customer Data, where we act as Data Processor

5.1 Customer Data is processed only on the documented instructions of the customer, which comprise the Terms, any executed data processing agreement, and the customer's own configuration and use of the Services. The full processor obligations are set out in clause 7 of the Terms, and the particulars of processing in Annex 1 to those Terms.

5.2 We do not use Customer Data for our own purposes, do not sell it, and do not disclose it for third-party marketing.

5.3 Where we receive a request from an individual to exercise rights in respect of Customer Data, we will not respond to it substantively. We will refer the individual to the relevant customer and notify that customer without undue delay, as required by clause 7.13 of the Terms.

5.4 If you do not know which customer holds your data, contact us and we will try to help you identify them, so far as we are able to do so without disclosing another party's information.

6. AI Features

6.1 The Services include AI Features, which may be delivered using third-party model providers. Inputs and outputs are processed by those providers in order to return a response.

6.2 We do not permit those providers to use Customer Data to train generally available or foundation models, as stated in clause 9.7 of the Terms.

6.3 AI Output is generated probabilistically and may be inaccurate. It is not verified by us, and customers are required to apply meaningful human review before relying on it. AI Output must not be used as the sole basis for a decision producing legal or similarly significant effects on an individual.

7. Sharing and Sub-processors

7.1 We share personal data only with: Sub-processors engaged to support delivery of the Services, including cloud hosting, storage, email delivery, analytics, payment and AI model providers; our professional advisers, where necessary and subject to confidentiality; a purchaser or successor in the event of a merger, acquisition or reorganisation, subject to this Policy continuing to apply; and public authorities, where required by law.

7.2 Each Sub-processor is engaged under a written contract imposing data protection obligations no less protective than those we owe, and we remain responsible for their performance. We will disclose the identity of our Sub-processors on reasonable written request.

7.3 Where we receive a legally binding request from a public authority, we will, so far as legally permitted, notify the affected customer without undue delay, challenge any request we consider unlawful or excessive, and disclose only the minimum lawfully required.

8. International transfers

8.1 The Services use cloud infrastructure and Sub-processors that may be located outside Nigeria, and personal data may be stored, accessed, replicated or backed up in other jurisdictions.

8.2 Where a transfer is restricted under applicable law, we put an appropriate transfer mechanism in place. Depending on the jurisdictions involved this may be an adequacy finding, a mechanism recognised under sections 41 and 43 of the NDPA, the Standard Contractual Clauses, or another lawful mechanism. The position is set out more fully in clause 8 of the Terms.

8.3 We will disclose the jurisdictions in which Customer Data is hosted on reasonable written request.

9. Security

9.1 We implement and maintain technical and organisational measures appropriate to the risk, taking into account the state of the art, the cost of implementation, and the nature, scope, context and purposes of processing. These include encryption in transit and at rest, access controls and role-based permissions, logical separation of each customer's Workspace, authentication controls, logging and monitoring, and regular testing of the effectiveness of those measures.

9.2 Personnel authorised to process personal data are bound by confidentiality obligations and receive appropriate training.

9.3 No system is perfectly secure. Customers are responsible for protecting their account credentials, configuring roles and permissions appropriately, promptly removing access for users who leave, and maintaining independent backups of data material to their business.

9.4 Where we become aware of a personal data breach affecting Customer Data, we notify the affected customer without undue delay and in any event within seventy-two (72) hours, as required by clause 7.15 of the Terms. Where a breach affects data for which we are the Data Controller, we will notify the Nigeria Data Protection Commission and affected individuals where the NDPA requires it.

10. Retention

10.1 Data for which we are the Data Controller is retained for as long as the account remains open and thereafter for as long as necessary for the purposes described in section 4, including to comply with legal, tax, accounting and audit obligations and to establish, exercise or defend legal claims.

10.2 Customer Data is retained in accordance with clause 20 of the Terms. On termination, customers have thirty (30) days to export their data, after which it may be deleted from live systems. Residual copies may persist in backups and disaster recovery media until overwritten in the ordinary course of our retention cycle, and remain protected while they do.

11. Your rights

11.1 Subject to the conditions and exemptions in the NDPA, and in any other data protection law applicable to you, you have the right to: request access to your personal data; request rectification of inaccurate or incomplete data; request erasure; request restriction of processing; object to processing carried out on the basis of legitimate interests, and to direct marketing at any time; request portability of data you provided to us; withdraw consent where processing is based on consent; and not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects, including a right to human intervention and to contest the decision.

11.2 To exercise a right in respect of data for which we are the Data Controller, contact us using the details in section 15. We will respond within the period required by applicable law. We may need to verify your identity before acting, and we may decline a request where an exemption applies, in which case we will explain why.

11.3 Where your data sits in a customer's Workspace, that customer is the Data Controller and you should direct your request to them. See section 5.

12. Cookies and similar technologies

12.1 We use cookies and similar technologies that are strictly necessary to operate the Services, including to keep you signed in, maintain your session, remember workspace and interface preferences, and protect against fraud and abuse.

12.2 We use limited analytics to understand how the Services are used and to improve reliability and performance. Where consent is required for non-essential cookies under a law applicable to you, we will obtain it before setting them.

12.3 Most browsers allow you to block or delete cookies. Blocking strictly necessary cookies will prevent the Services from functioning.

13. Business use only

13.1 The Services are made available exclusively for business, commercial and professional purposes and are not directed at consumers acting for personal, domestic or household purposes, as stated in clause 3.1 of the Terms.

13.2 The Services are not directed at children, and we do not knowingly collect personal data from anyone under eighteen (18). If you believe a child's data has been provided to us, contact us and we will take appropriate steps.

14. Changes to this Policy

14.1 We may update this Policy from time to time. The current version is always published here with the date of last update.

14.2 Where a change materially and adversely affects the rights of data subjects, we will give reasonable advance notice by email or in-application notification before it takes effect.

15. Contact and complaints

15.1 Questions about this Policy, and requests to exercise rights, may be sent to privacy@clientsphere.io.

15.2 If you are dissatisfied with how we have handled your personal data or your request, you may lodge a complaint with the Nigeria Data Protection Commission, or with the supervisory authority in your jurisdiction where one has authority over the matter. We would ask that you raise it with us first so that we have the opportunity to put it right.