Data Processing Agreement

Parties and background

This Data Processing Agreement ("DPA") is made between:

1. Beta360 Pte Ltd (trading as Spheron), a company incorporated in Singapore with UEN 202107371K and registered office at 3 Phillip Street, #10-04, Royal Group Building, Singapore 048693 ("Spheron" or "Processor"); and
2. each customer of Spheron that has accepted the Spheron Terms and Conditions of Use, as identified in its account details ("Customer" or "Controller").

Background. Spheron provides GPU compute, orchestration and related cloud services through the Spheron Marketplace under the Spheron Terms and Conditions of Use published on this website, which Customer accepts when it creates an account (the "Agreement"). In providing the Services, Spheron may process Personal Data on Customer’s behalf. This DPA sets out the terms required by Article 28(3) UK GDPR (and, where applicable, Article 28(3) EU GDPR) and forms part of the Agreement. If this DPA conflicts with the Agreement, this DPA prevails for the processing of Personal Data.

How this DPA applies. This DPA applies automatically to every Customer from the time it accepts the Agreement. No signature is needed. Customers that need a countersigned copy for their records can request one at legal@spheron.network.

Scope. This DPA covers Spheron’s GPU compute services: GPU instances and clusters, storage volumes, and the platform, dashboard and API used to deploy and manage them. Spheron’s inference API and agent features are not covered by this DPA and are governed by their own terms.

1. Definitions

1.1 Capitalised terms not defined here have the meaning given in the Agreement. In this DPA:

• "Data Protection Laws" means UK GDPR, the Data Protection Act 2018, the Data (Use and Access) Act 2025 (to the extent in force), and, where applicable to the processing, the EU GDPR and any other law relating to the processing of Personal Data.
• "UK GDPR" means Regulation (EU) 2016/679 as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018.
• "Controller", "Processor", "Data Subject", "Personal Data", "Personal Data Breach", "processing" and "Supervisory Authority" have the meanings given in UK GDPR.
• "Customer Personal Data" means Personal Data processed by Spheron on behalf of Customer in connection with the Services, as described in Annex 1.
• "Services" means the GPU compute, storage and related services supplied under the Agreement, within the scope stated above.
• "Sub-processor" means any third party (including Spheron affiliates and data centre partners) engaged by Spheron to process Customer Personal Data.
• "Restricted Transfer" means a transfer of Customer Personal Data to a country outside the UK that is not covered by UK adequacy regulations, or outside the EEA that is not covered by an EU adequacy decision.
• "UK Addendum" means the International Data Transfer Addendum to the EU Commission Standard Contractual Clauses issued by the UK Information Commissioner under s.119A DPA 2018 (version B1.0, in force 21 March 2022).
• "EU SCCs" means the Standard Contractual Clauses annexed to Commission Implementing Decision (EU) 2021/914.
• "IDTA" means the International Data Transfer Agreement issued by the UK Information Commissioner under s.119A DPA 2018 (version A1.0, in force 21 March 2022), where Customer and Spheron have completed and signed one under Section 9.2.

2. Scope, roles and details of processing

2.1 Roles. For Personal Data that Customer places in its workloads, Customer is the Controller (or, where Customer acts for its own clients, a Processor) and Spheron is a Processor (or Sub-processor). For account, billing, usage and support data about Customer’s personnel, Spheron acts as an independent controller under its Privacy Policy, and this DPA applies to that data only where Data Protection Laws require it. Each party complies with Data Protection Laws in its own role.

2.2 Nature of the Services. Spheron is a GPU compute marketplace and reseller. Spheron sources compute capacity from vetted independent data centres and cloud providers ("DC Partners") and makes it available to Customer through a single API and billing relationship. Customer deploys and controls its own workloads, models and data on that infrastructure. Spheron does not access the content of Customer workloads except as needed to provide, secure and support the Services or as instructed by Customer.

2.3 Details of processing. The subject matter, duration, nature and purpose of processing, the types of Personal Data and the categories of Data Subjects are set out in Annex 1.

2.4 Customer responsibilities. Customer warrants that it has a lawful basis for the processing, has given Data Subjects any required notices, and that its instructions comply with Data Protection Laws. Customer is responsible for the security of data it places in its own containers, volumes and applications, including encryption keys it chooses to manage.

2.5 Prohibited data; user-generated content. Unless agreed in writing, Customer will not use the Services to process criminal offence data or data subject to specific regulatory regimes (for example PCI DSS cardholder data or HIPAA PHI). Customer may process in its workloads, on DC Partner infrastructure, any personal data, including special category data (Art 9 UK GDPR) incidentally contained in user-generated content. Such data is not stored by or accessible to Spheron (Section 2.6). Customer remains responsible for the lawful basis and the Article 9 condition for that processing and for any data protection impact assessment it requires.

2.6 Spheron is not in the workload data path. Workload data, model weights, datasets, private keys and application secrets are never collected, stored or accessible by Spheron. All access to provisioned instances, and all workload data, flows directly between Customer and the DC Partner over the DC Partner’s own network and IP addresses; it does not transit or rest on Spheron systems. Spheron holds only: (a) Customer’s SSH public keys, which are passed to the DC Partner to provision access; (b) Customer’s Spheron API keys, stored only as one-way hashes; (c) any startup script Customer submits with a deployment, which Spheron stores with the deployment record and which Customer should not use to carry secrets; and (d) the account, billing and provisioning metadata described in Annex 1.

3. Processor obligations (Art 28(3) terms)

Spheron shall:

1. Instructions. Process Customer Personal Data only on Customer’s documented instructions, which are the Agreement, this DPA, and Customer’s use of the Services’ configuration and APIs. Spheron will inform Customer if, in its opinion, an instruction infringes Data Protection Laws, and may suspend that instruction until resolved. Where UK, EU or Member State law requires Spheron to process otherwise, Spheron will inform Customer first unless the law prohibits it.
2. Confidentiality. Ensure that personnel authorised to process Customer Personal Data are bound by written confidentiality obligations or a statutory duty of confidentiality, and limit access to those who need it to provide the Services.
3. Security. Implement the technical and organisational measures in Annex 2 and such further measures as required by Article 32 UK GDPR, taking into account the state of the art, costs, and the risks to Data Subjects.
4. Sub-processors. Engage Sub-processors only under Section 4.
5. Data subject rights. Assist Customer under Section 6 in responding to requests from Data Subjects.
6. Compliance assistance. Assist Customer, taking into account the nature of the processing and the information available to Spheron, in meeting its obligations under Articles 32 to 36 UK GDPR (security, breach notification, data protection impact assessments and prior consultation).
7. Return and deletion. At the end of the Services, delete or return Customer Personal Data under Section 10.
8. Information and audit. Make available the information needed to demonstrate compliance with Article 28 and allow for and contribute to audits under Section 8.
9. Records. Maintain a record of processing activities carried out on behalf of Customer as required by Article 30(2) UK GDPR.
10. Representative. Where required by Article 27 UK GDPR, appoint a UK representative and notify Customer of its details.

4. Sub-processors

4.1 General authorisation. Customer gives Spheron general written authorisation to engage Sub-processors to deliver the Services. Spheron’s business model is to source capacity from independent data centres and cloud providers, so DC Partners are Sub-processors by design. The categories of Sub-processors engaged, and the countries in which they operate, are set out in Annex 3. DC Partners are vetted Tier 2+ data centre and cloud providers. The platform shows the region of each offer before deployment; the identity of the DC Partner behind an offer, and its terms, are available from Spheron on request under Section 4.4.

4.2 Customer choice of location. Customer selects the region and offer when deploying a workload. Customer Personal Data in that workload is processed only by the DC Partner(s) operating the selected cluster, plus Spheron’s platform tooling Sub-processors in Annex 3. Customer can restrict deployments to specified regions or DC Partners through the platform or by written instruction.

4.3 Named list and changes. The named list of Sub-processors is Spheron’s Confidential Information under the Agreement. Spheron provides it to Customer on request at legal@spheron.network, and shares it more widely only to the extent the EU SCCs require. Spheron will give Customer at least 30 days’ notice by email before a new platform tooling Sub-processor processes Customer Personal Data, and before a new DC Partner hosts any Customer workload. A DC Partner that hosts no Customer workload does not process Customer Personal Data, so Spheron may add DC Partners that Customer does not use without notice. Customer may object on reasonable data-protection grounds within that period. If the parties cannot resolve the objection within 30 days, Customer may stop using the affected Services and receive a refund of unused prepaid credits in accordance with the Agreement.

4.4 Flow-down. Spheron contracts with each DC Partner under that DC Partner’s own published terms of service and data processing addendum; Spheron does not negotiate bespoke terms with DC Partners and cannot impose obligations beyond those terms. Before deploying, Customer can see on the platform the region that will host a workload, and may ask Spheron (legal@spheron.network) which DC Partner operates that offer and for that DC Partner’s current terms of service, data processing addendum and security documentation. Spheron will provide or link to them before deployment on request. Customer is responsible for deciding, before it deploys, whether a DC Partner’s terms, location and security measures are suitable for the data it intends to process. For platform tooling Sub-processors (Annex 3, Part B), Spheron accepts the provider’s standard data processing addendum.

4.5 Liability. Customer acknowledges that Spheron is a marketplace facilitator and reseller: the DC Partners own, operate and secure the infrastructure on which Customer workloads run, and under each DC Partner’s published terms the DC Partner is responsible for its own facilities, systems and personnel. To the extent Article 28(4) UK GDPR requires Spheron to remain liable to Customer for a DC Partner’s performance, that liability is subject to Section 11.1, and Spheron’s obligations in respect of DC Partners are limited to: (a) selecting and vetting them as described in Section 5.2; (b) contracting with them on the terms described in Section 4.4; (c) passing on to the relevant DC Partner any instruction, request or notice from Customer; and (d) using reasonable efforts to enforce Spheron’s rights against the DC Partner on Customer’s behalf.

5. Security and personnel

5.1 Spheron will implement and maintain the technical and organisational measures in Annex 2. Spheron may update those measures from time to time provided the overall level of protection is not materially reduced.

5.2 Spheron’s DC Partners operate Tier 2 or higher facilities and, under their own published terms and security programmes, maintain physical security, environmental controls, access logging and incident response procedures appropriate to a co-location or cloud environment. Spheron vets each DC Partner before onboarding and periodically thereafter.

5.3 Spheron will ensure its personnel with access to Customer Personal Data are bound by confidentiality obligations and are given access only to the extent needed for their role.

6. Data subject rights and assistance

6.1 Spheron will notify Customer without undue delay (and within 5 business days) if it receives a request from a Data Subject exercising rights under Chapter III UK GDPR in respect of Customer Personal Data, and will not respond except on Customer’s instruction or as required by law.

6.2 Because Customer controls its own workloads and data, Customer is expected to action most requests directly. Where Customer cannot, Spheron will provide reasonable assistance, taking into account the nature of the processing, at Customer’s reasonable cost where the assistance exceeds what is required by law.

6.3 Spheron will provide reasonable assistance with data protection impact assessments and consultations with the ICO or another Supervisory Authority, to the extent they relate to the Services and the information is available to Spheron.

7. Personal data breach

7.1 Spheron will notify Customer without undue delay, and in any event within 48 hours, after becoming aware of a Personal Data Breach affecting Customer Personal Data. Notice goes to the security contact Customer has given Spheron in writing or, if none, to the email address on Customer’s account.

7.2 The notice will describe, so far as known, the nature of the breach, the categories and approximate number of Data Subjects and records concerned, the likely consequences, the measures taken or proposed, and a Spheron contact point. Spheron may provide information in phases as it becomes available.

7.3 Spheron will take reasonable steps to contain and remediate the breach and will cooperate with Customer’s investigation. Spheron will not notify Data Subjects or any Supervisory Authority on Customer’s behalf unless required by law.

7.4 DC Partners notify Spheron of breaches under their own published terms. Spheron will pass on to Customer, within the timeline in Section 7.1, any notice it receives from a DC Partner of a breach affecting Customer workloads.

8. Audits and information

8.1 On written request, no more than once per 12 months (or following a Personal Data Breach), Spheron will make available the information reasonably necessary to demonstrate compliance with Article 28 UK GDPR, including summaries of DC Partner certifications (for example ISO 27001, SOC 2 Type II, Tier 2+ design) where available.

8.2 Where that information is insufficient, Customer or an independent auditor bound by confidentiality may audit Spheron’s relevant systems and records, on 30 days’ notice, during business hours, in a manner that does not unreasonably disrupt Spheron’s operations. Physical access to DC Partner facilities is subject to that DC Partner’s own access policies; Spheron will use reasonable efforts to arrange it.

8.3 Customer bears the cost of audits unless the audit reveals a material breach of this DPA by Spheron.

9. International transfers

9.1 This Section applies where Customer, or its processing, is subject to UK GDPR or EU GDPR. Workload data moves directly from Customer to the DC Partner operating the region Customer selects; DC Partners operate in the United Kingdom, the EEA, the United States, Canada, Japan and India (Annex 3, Part A). Account data is processed by Spheron from Singapore and by the platform Sub-processors in Annex 3, Part B, which store it in the United States. These transfers include Restricted Transfers.

9.2 Transfer mechanism. The parties agree that transfers from Customer to Spheron are made under the EU SCCs (Module Two: controller to processor, or Module Three: processor to processor where Customer acts as processor), as amended by the UK Addendum, both incorporated by reference and completed as set out in Annex 4. Where the EU GDPR also applies, the EU SCCs apply without the UK Addendum for EEA-origin data. A Customer that prefers the UK International Data Transfer Agreement may instead complete and sign an IDTA with Spheron by request at legal@spheron.network. The IDTA names this DPA as its Linked Agreement and, once signed, governs that Customer’s UK Restricted Transfers in place of the UK Addendum.

9.3 Onward transfers. Spheron will ensure that transfers to Sub-processors outside the UK or EEA are covered by the transfer mechanism in the relevant Sub-processor’s published terms (EU SCCs with the UK Addendum, an adequacy regulation, or another valid mechanism under Data Protection Laws), and that onward transfers are made only to the Sub-processors in Annex 3.

9.4 Transfer risk assessment. Spheron will provide reasonable information to support Customer’s transfer risk assessment, including the countries in which the selected DC Partners operate and Spheron’s assessment of local law access requests.

9.5 Customer control. Customer may avoid transfers to a given country by restricting deployments to UK- or EEA-located DC Partners under Section 4.2.

9.6 If the UK Addendum, the IDTA or the EU SCCs are replaced, invalidated or amended, the parties will cooperate in good faith to put in place a replacement mechanism within 60 days.

10. Return and deletion

10.1 Workload data stays on instances and volumes that Customer controls. Customer must copy out any workload data it needs before it terminates an instance or volume; Spheron cannot recover workload data after termination.

10.2 On closure of Customer’s account or termination of the relevant Services, Spheron will, at Customer’s election made within 30 days, return or delete Customer Personal Data. Absent an election, Spheron will delete it. Deletion of a cluster, volume or container on a DC Partner’s infrastructure is carried out according to that DC Partner’s secure-wipe procedure and completed within 30 days.

10.3 Spheron may retain Customer Personal Data to the extent required by law, in platform logs for up to 12 months, and in database backups until those backups expire in the ordinary course (no later than 12 months), in which case this DPA continues to apply.

10.4 On request, Spheron will certify deletion in writing.

11. Liability, term and general

11.1 Liability. Each party’s liability under or in connection with this DPA is subject to the exclusions and limitations of liability in the Agreement, which apply in aggregate across the Agreement and this DPA. Spheron is liable for its own acts and omissions. Where a loss arises from an act or omission of a DC Partner (including a security incident on DC Partner infrastructure), Spheron’s aggregate liability to Customer for that loss is limited to the greater of (a) the amount Spheron actually recovers from that DC Partner in respect of it, after using reasonable efforts to recover, and (b) the fees paid by Customer for the affected Services in the three months preceding the event. Nothing in this DPA limits liability under the EU SCCs, the UK Addendum or an IDTA to the extent those clauses do not permit it to be limited, or liability that cannot be limited by law.

11.2 Term. This DPA takes effect when Customer accepts the Agreement (or, for Customers who accepted it earlier, on the effective date above), applies to all processing of Customer Personal Data under the Agreement, and continues until Spheron no longer processes Customer Personal Data.

11.3 Precedence. For the processing of Personal Data, the order of precedence is: (a) the EU SCCs and UK Addendum, or an IDTA where signed; (b) this DPA; (c) the Agreement.

11.4 Governing law. This DPA is governed by the law and dispute-resolution terms of the Agreement (Singapore law), except that the EU SCCs, the UK Addendum and any IDTA are governed by the law stated in them, and nothing in this DPA deprives Data Subjects of rights under UK GDPR.

11.5 Changes. Spheron may update this DPA by publishing a new version on this page. Where a change materially reduces the protection given to Customer Personal Data, Spheron will give Customer at least 30 days’ notice by email, and Customer may object as described in Section 4.3. Either party may also request amendments reasonably necessary to reflect changes in Data Protection Laws, and the other party will not unreasonably withhold agreement.

11.6 Contacts. Spheron’s data protection contact: legal@spheron.network. Customer’s data protection and security contacts are the contacts Customer gives Spheron in writing or, if none, the email address on Customer’s account.

Annex 1. Details of processing

Annex 2. Technical and organisational measures

Annex 3. Sub-processors

Spheron works with a network of independent, vetted Tier 2+ data centre and cloud providers ("DC Partners"). Customer Personal Data in a workload is processed only by the DC Partner operating the region or cluster Customer selects. The region of each offer is shown on the platform before deployment. This Annex lists Sub-processors by category and country. The named list, with each Sub-processor’s entity and hosting location, is Confidential Information and is sent to Customer on request at legal@spheron.network, and with each notice under Section 4.3.

Part A. Data centre and cloud partners (infrastructure sub-processors)

Part B. Platform and business tooling sub-processors

Platform monitoring is performed by Spheron’s own in-house system and involves no third-party sub-processor.

Annex 4. International transfer mechanism

The parties incorporate the EU SCCs, as amended by the UK Addendum, completed as follows. Where Customer has signed an IDTA under Section 9.2, the signed IDTA governs Customer’s UK Restricted Transfers in place of Part 2, and prevails over this Annex if they are inconsistent.

Part 1. EU SCCs (Commission Decision 2021/914)

Part 2. UK International Data Transfer Addendum (ICO, version B1.0, 21 March 2022)

Part 3. Mandatory Clauses. The Mandatory Clauses of the Approved Addendum, being the template Addendum B.1.0 issued by the ICO and laid before Parliament under s.119A DPA 2018 on 2 February 2022, as revised under Section 18 of those Mandatory Clauses, are incorporated by reference.

Part 4. Onward transfers to DC Partners. Spheron procures capacity from each DC Partner as a customer of that DC Partner, under the DC Partner’s published terms of service and data processing addendum, which Spheron accepts on account creation and API integration. Those terms incorporate the DC Partner’s own transfer mechanism for data it receives from outside its home jurisdiction. Spheron relies on those mechanisms for onward transfers and will provide Customer, on request, with links to or copies of the applicable DC Partner terms.