1. What this addendum is
This Data Processing Addendum ("DPA") forms part of the Terms and Conditions between the nursery ("you") and SphereHub ("we"). It applies to the personal information in your nursery's records that we handle to provide the Service. It does not need a separate signature.
2. Roles
You are the controller (in Canada, the organization responsible) of your nursery's personal information. We are your processor (service provider). We are the controller of our own account, billing and security records, as the Privacy Policy explains.
3. What we do with your data
We process your data only to provide the Service to you and on your documented instructions, which are these terms, your use of the Service and your support requests. We tell you if an instruction would break the law. We do not sell your data, use it for advertising, or use it to train artificial intelligence models.
4. Confidentiality and security
Everyone at SphereHub who can reach your data is bound by confidentiality and has access only where the work needs it. Access is logged. Each nursery's records sit in a separate database, with encryption in transit, encrypted secrets, encrypted backups, two-step sign-in and passkeys, optional network address limits, and an audit log of changes you can read.
5. Sub-processors
You allow us to use these types of sub-processors. We tell you by email at least 30 days before adding or replacing one that handles your data. You can object in writing within 14 days. We give you the names of the providers on request and with every notice of a change; if we cannot meet your objection, you can end the agreement and we refund fees paid for the period after it ends.
| Provider type | Purpose | Data involved |
|---|---|---|
| Hosting and infrastructure provider (with our hosting provider (the country is available on request)) | Runs the Service and keeps backups | All nursery records |
| Network and website delivery provider | Network protection, DNS and website delivery | Network addresses, page requests |
| Payment provider | Card payments from nurseries and, if connected, from parents | Payment details handled by the provider, invoice amounts |
| Email delivery provider | Sends invitations, receipts and notices | Names, email addresses, message content |
| Push notification provider | Phone notifications, if the apps are used | Device tokens, short notification text |
| Accounting software, only if you connect it | Sends the invoices and payments you choose | Invoice and payment data |
6. Location
Production data is hosted with our hosting provider (the country is available on request). If we move it to a different country, we tell you at least 30 days before. Country sections of the Privacy Policy explain transfers for your country.
7. Incidents
We tell you without undue delay, and within 72 hours of confirming, about any incident that leads to accidental or unlawful loss, access, disclosure or change of your data. We give the nature of the incident, the data and people involved, what we are doing, and a contact. We keep a record of each incident and help you meet your own notification duties.
8. Helping you
We help you answer requests from parents, carers and staff to see, correct, delete or take a copy of their information, and with privacy impact assessments, as far as we reasonably can. Self-service exports are in Settings > Export my data. We may charge for help that takes unusual effort, and we tell you first.
9. Return and deletion
You can export your data at any time. When the agreement ends, the nursery is kept for a grace period of 14 days, during which you can still export and restore it. After that your data is deleted from live systems, and from backups as they expire. We keep what the law requires us to keep, and only for as long as it requires.
10. Audits
We answer reasonable written security questions once a year and give you what you need to show you chose a suitable provider. Where the law gives you a right to audit, we agree it in advance, with reasonable notice and without exposing other nurseries' data.
11. Responsibility
The limits in the Terms and Conditions apply to this addendum.
12. Order of documents
If the Terms and this addendum conflict about personal information, this addendum prevails.
Canada
For Canadian nurseries, "controller" means the organization responsible, and "processor" means a service provider, under the Personal Information Protection and Electronic Documents Act and the provincial laws that apply. We help a Quebec nursery with a privacy impact assessment for communications of personal information outside Quebec.