Privacy policy
Effective and last updated: 20 July 2026
This policy explains how Office Sphere Ltd collects, uses and protects personal information relating to website visitors, Atlas account users, agents and workspace-provider contacts.
Office Sphere is a business service for authorised users aged 18 or over. It is not directed at children or at occupiers or tenant firms seeking premises for themselves.
1. Who we are
Office Sphere Ltd is the controller of the personal information described in this policy, except where we process information solely on the documented instructions of a business customer under a separate data-processing agreement.
Office Sphere Ltd is registered in Scotland under company number SC867827. “Office Sphere” is its trading name.
| Contact detail | Information |
|---|---|
| Registered office | Office 1278 1/1, 3 Fitzroy Place, Sauchiehall Street, Finnieston, Glasgow, Scotland, United Kingdom, G3 7RH |
| Privacy enquiries | info@office-sphere.co.uk |
| ICO registration | ZC077951 |
2. Information we collect
2.1 Registration and account information
- First name and last name.
- Company or agency name.
- Corporate email address.
- Optional additional verification details that you choose to provide.
- Account status, shortlist allocation and portal activity associated with your account.
Do not provide special category information, criminal offence information, identity documents or tenant-identifying information in the optional verification field unless we specifically request it through an approved secure process.
2.2 Enquiry and service information
Enquiry records may include: agent name, agency, business email and telephone number; primary, additional and secondary search locations; requirement type; minimum and maximum desks; budget guidance; required move-in date; minimum term; must-have and nice-to-have requirements; building preference; urgency; search stage; whether the matter is a live instruction; additional notes; enquiry ID and name; processing status; shortlist status and output; matched providers; and processing timestamps.
Agents must not submit the tenant’s or occupier’s name, email address, telephone number or other identifying information. We structure enquiries around anonymous office requirements.
2.3 Technical and usage information
Shopify, TinyCookie and the technologies used to operate the website and portal may collect standard technical information such as IP address, device and browser type, operating system, approximate location derived from IP address, page or feature interactions, session information, login or security events, cookie identifiers, consent choices and diagnostic data. The precise information depends on the settings and technologies active when you use the service.
2.4 Communications and payment information
- Emails, call notes and other correspondence with users, agencies and providers.
- Marketing preferences and opt-out records.
- Subscription status, payment status, transaction reference and limited billing information received from Stripe or our systems. Office Sphere does not receive or store full payment-card details.
2.5 Provider and other business-contact information
We collect provider and landlord business-contact details, job details where relevant, professional communications, availability confirmations and relationship history. This information may be provided directly during calls or correspondence, supplied by the business, or obtained from publicly accessible business sources such as corporate websites and professional directories.
3. How and why we use information
| Purpose | Information used | Lawful basis |
|---|---|---|
| Register and verify eligible business users | Identity, company, corporate email and verification details | Steps requested before a contract; contract; legitimate interests in restricting access to eligible users and preventing abuse. |
| Operate accounts and the Atlas portal | Account, contact, allocation, activity and security information | Contract; legitimate interests in administering and securing the service. |
| Process enquiries and produce shortlists | Agent contact details and anonymous requirement data | Contract or steps requested before a contract; legitimate interests in delivering and improving business sourcing support. |
| Confirm availability with providers | Anonymous space requirements, provider contacts and confirmation history | Legitimate interests in verifying suitable workspace availability and responding to agent requirements. |
| Manage plans and payments | Account, billing, plan, allocation and Stripe transaction information | Contract; legal obligation for accounting and tax records; legitimate interests in preventing payment fraud. |
| Service communications and support | Contact details, enquiries, account history and correspondence | Contract; legitimate interests in supporting users and maintaining service records. |
| Security, misuse and fraud prevention | Technical, account, verification and activity information | Legitimate interests in protecting users, systems, confidential requirements and our business; legal obligation where applicable. |
| Improve Atlas and service quality | Enquiry attributes, outcomes, status and usage information, using aggregated or de-identified data where practicable | Legitimate interests in testing, quality assurance, capacity planning and improving relevance. |
| Record cookie preferences | Cookie identifiers, consent categories and preference timestamps | Consent for optional cookies; legitimate interests and legal obligation in demonstrating and respecting privacy choices. |
| Business marketing | Professional contact details, company, service relationship and preferences | Legitimate interests where permitted by UK marketing rules; consent where required. |
| Legal and regulatory matters | Relevant account, enquiry, payment, contact and system records | Legal obligation; legitimate interests in establishing, exercising or defending legal claims. |
Where we rely on legitimate interests, we consider the purpose, necessity and likely effect on individuals. You may object to processing based on legitimate interests; see section 11.
4. Provider outreach and anonymisation
When checking workspace availability, we share only the requirement information reasonably necessary for the provider to confirm whether suitable space is available—for example location, desk range, budget, timing and operational requirements. We do not share the tenant or occupier’s identity or direct contact details.
We may identify the enquiring agency or agent only where this is necessary, expected and permitted in the sourcing relationship. We do not give providers authority to contact an unidentified tenant through Office Sphere.
5. Atlas ranking and human review
Atlas automatically structures requirements and ranks potential office options using factors such as location, size, budget, timing and stated preferences. This ranking supports sourcing and shortlist preparation. Availability is confirmed with providers by telephone where appropriate, and a person reviews the output before delivery where needed.
Atlas does not make a decision producing legal or similarly significant effects about an individual. Agents remain responsible for reviewing a shortlist and deciding what to communicate or recommend to their clients.
6. Marketing communications
We may send relevant business-to-business marketing about Office Sphere where we reasonably believe it may interest the recipient and where permitted by applicable data-protection and electronic-marketing rules. We use consent where the law requires it.
Every marketing email will identify Office Sphere and provide a simple way to opt out. You may object or unsubscribe at any time by using the link in the message or emailing info@office-sphere.co.uk. We may keep a minimal suppression record so that we continue to respect the request.
Service messages about an account, enquiry, shortlist, payment, security or changes to applicable terms are not marketing and may still be sent where necessary.
7. Cookies and Shopify Analytics
The website uses cookies and similar technologies necessary to operate Shopify, maintain sessions, authenticate users, protect the service and remember preferences. TinyCookie, provided by TinyIMG, displays the consent banner and records visitors’ cookie choices. We also use Shopify Analytics to understand website use and performance where consent has been provided.
Where a cookie or similar technology is not strictly necessary, we will request any consent required by law before using it. You can manage non-essential choices through the cookie controls made available on the website. Further details—including cookie names, providers, purposes and durations—should be set out in the Cookie Policy or cookie preference centre.
8. Who receives personal information
We disclose personal information only where reasonably necessary for the purposes described in this policy. Recipients may include:
- Shopify, which hosts and supports the public website and provides analytics and related functionality;
- TinyCookie/TinyIMG, which provides the cookie banner, consent controls and consent records;
- Google Workspace/Gmail, used for business communications;
- Stripe, used to issue payment links and process payments;
- providers supporting the native portal, infrastructure, security and internal custom CRM;
- professional advisers, insurers, auditors and authorities where necessary;
- workspace providers, landlords or their representatives, using anonymised requirement information as described above; and
- a purchaser, investor or successor in connection with a proposed or completed sale, financing or reorganisation, subject to appropriate confidentiality and legal safeguards.
We require service providers handling personal information for us to protect it and use it only for authorised purposes. We do not sell personal information.
More information about Shopify’s processing is available in the Shopify Consumer Privacy Policy at https://www.shopify.com/legal/privacy/consumers.
9. International transfers
Some suppliers, including Shopify, Google and Stripe, may store or access personal information outside the United Kingdom. Where a restricted transfer occurs, we rely on a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement or Addendum, or another safeguard permitted by UK data-protection law. We also assess and apply supplementary protections where required.
You may contact us for further information about the safeguards relevant to your personal information.
10. How long we keep information
We keep information only for as long as reasonably necessary for the relevant purpose, including legal, accounting, security and dispute requirements. Our recommended default schedule is:
| Record | Default retention |
|---|---|
| Active account data | For the life of the account. |
| Closed account profile and routine portal history | 24 months after closure, then delete or anonymise unless linked to a longer-lived contractual or legal record. |
| Enquiries, shortlist records and requirement data | 24 months after completion or last activity, then delete or anonymise unless required for an active relationship, complaint or claim. |
| Contracts, orders and material commercial correspondence | Up to 5 years after the relationship or obligation ends, subject to the nature of the record and applicable Scots-law limitation periods. |
| Invoices, payments and accounting records | Generally 6 years after the relevant financial year or transaction, or longer if required by tax law. |
| Routine support and operational emails | 24 months after the matter closes; longer where incorporated into a contract, complaint, security or legal record. |
| Provider business contacts | While the relationship remains current; review at least annually and remove or suppress details that are no longer relevant, normally within 24 months of last meaningful contact. |
| Security and access logs | Normally up to 12 months, unless needed to investigate an incident or protect legal claims. |
| Marketing suppression records | A minimal record for as long as necessary to honour the opt-out. |
| System backups | Deleted or overwritten through the ordinary backup cycle, normally within 90 days, subject to security and recovery requirements. |
We may retain a record for longer where required by law, a regulatory request, litigation hold, fraud or security investigation, or an unresolved complaint. We periodically review retention and may anonymise information so it can no longer identify an individual.
11. Your rights
Depending on the circumstances, UK data-protection law may give you rights to:
- be informed about how we use your personal information;
- request access to your personal information;
- request correction of inaccurate or incomplete information;
- request erasure;
- request restriction of processing;
- object to processing based on legitimate interests, including an absolute right to object to direct marketing;
- receive information you provided in a portable format where the right applies; and
- withdraw consent at any time where processing is based on consent, without affecting earlier lawful processing.
These rights are not absolute. We may need to verify your identity and may retain information where permitted or required by law. To exercise a right, email info@office-sphere.co.uk. We normally respond within one month, subject to lawful extensions.
12. Information obtained from public or third-party sources
Where we obtain a provider or other professional contact’s personal information from a public business source or from their organisation, we will provide appropriate privacy information within the period required by law—normally at first contact and no later than one month—unless a lawful exception applies. We will identify the source or source category where required.
13. Security
We use appropriate technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss or destruction. Measures include role-based access, account controls, supplier management, secure communications, logging and staff confidentiality practices as appropriate to the risk.
No internet service is completely secure. You must protect your login details and notify us promptly if you suspect unauthorised account access or accidental submission of tenant-identifying information.
14. Complaints
Please contact us first at info@office-sphere.co.uk so that we can try to resolve your concern.
You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority. Current contact and complaint information is available at ico.org.uk. You may also have the right to seek a judicial remedy.
15. Changes to this policy
We may update this policy to reflect changes in law, technology, suppliers or our processing. We will publish the updated version and effective date on the website. Where a change is material, we will take reasonable steps to notify registered users or otherwise bring it to their attention.
16. Contact us
Privacy requests and questions should be sent to info@office-sphere.co.uk.
Company number: SC867827
ICO registration: ZC077951
Registered in Scotland
Registered office: Office 1278 1/1, 3 Fitzroy Place, Sauchiehall Street, Finnieston, Glasgow, Scotland, United Kingdom, G3 7RH
Office Sphere Ltd • ICO ZC077951 • Effective 20 July 2026