ERP1. Parties, scope and instructions
This DPA forms part of the customer’s ERP agreement for personal data processed on the customer’s instructions. The customer acts as controller, or as an authorised processor appointing the operator as subprocessor; the operator acts as processor for the covered customer records. Process only on documented instructions, including transfers, unless Union or Member State law requires otherwise; inform the customer of that requirement beforehand unless prohibited. Immediately inform the customer if an instruction appears to infringe data-protection law and suspend the affected instruction while it is resolved. Own-controller activities disclosed in the Privacy Notice are outside this DPA.
2. Processing schedule
Subject: delivery and support of selected ERP modules. Duration: the service term plus agreed retrieval and deletion periods, subject to lawful retention. Operations: collection, storage, organisation, access, calculation, transmission, export and deletion as instructed. Data subjects: customer users, employees, contractors, business contacts, clients and suppliers. Categories: identifiers and work contacts, roles, activity records, project and transaction records, salary and payment information and instructed attachments. The signed order must narrow these categories to the modules actually used and expressly identify any permitted special-category data. Financing-partner assessment is not automatically included in this processor schedule.
3. Confidentiality and security
Authorised personnel must be bound by confidentiality. The processor must implement appropriate Article 32 measures proportionate to risk, including access management, tenant isolation, protection of data in transit and at rest where appropriate, resilience, recovery and regular evaluation. Any agreed security annex identifies the measures applicable to your service. This DPA does not claim an independent certification or a specific recovery time. Security changes must not materially reduce the agreed protection.
4. Subprocessors and transfers
The customer must receive the completed subprocessor register before authorisation. Under the general-authorisation mechanism, give at least 30 days’ advance notice of additions or replacements and allow reasoned data-protection objections. Resolve an objection through reasonable alternatives or permit termination of the affected service before the provider begins processing. Each subprocessor must accept materially equivalent data-protection duties; the operator remains responsible for its performance. No international transfer may occur without applicable Chapter V safeguards and documented instructions. The provider register identifies approved hosting; additional providers require disclosure and authorisation under this clause.
5. Rights, incidents and regulatory assistance
Taking account of the nature of processing, assist the customer with data-subject requests, security duties, breach assessment, DPIAs and prior consultation. Forward requests without answering for the customer unless authorised or legally required. Notify the customer without undue delay after becoming aware of a personal-data breach, with available facts about its nature, affected categories and approximate numbers, contact, likely consequences and mitigation; supplement information as it becomes available. The controller determines its own notification duties, including the GDPR 72-hour authority deadline where applicable. Assistance arrangements must not prevent statutory compliance.
6. Demonstrating compliance
Make available the information necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the customer or its mandated auditor. Reasonable confidentiality, scheduling and security arrangements may protect other customers and systems but must not defeat Article 28 audit rights or regulatory access. Maintain the required processing records and evidence of instructions, provider approvals, incidents and deletion. The customer remains responsible for its lawful purposes, notices, minimisation and employee-monitoring assessment.
7. Return, deletion and further use
At the customer’s choice, return or delete covered personal data after the service ends and delete remaining copies unless applicable law requires storage. Agree export and retrieval periods before closure. Legally retained copies must be isolated and used only for that obligation. The final annex must define backup expiry and restoration controls so deleted records are not returned to active use. Processing to create anonymous datasets requires documented customer instructions and the customer’s lawful authority; this DPA does not permit independent reuse of personal data for advertising or general AI training. Genuine anonymous outputs may be used only within the Terms’ confidentiality and re-identification safeguards.
8. Reporting boundaries and analytics
Reports generated for the customer from its ERP records remain within the documented service instructions and applicable access controls. This DPA does not authorise the operator to repurpose employee, client, payroll or financing content for its own unrestricted analytics, advertising or model training. Any separate controller purpose requires an identified lawful basis, transparent information and safeguards before processing; the operator must not rely on the customer’s contract as blanket consent for individuals. Optional browser events are governed by the separately described consent controls. Random identifiers remain protected where individuals are identifiable. Analytics copies, derived personal data and links must be included in applicable rights, deletion, hold and backup procedures; aggregation alone does not remove these obligations.
9. CRM processing instructions
For enabled CRM functionality, the processing schedule also covers prospect and business contacts, their company relationships, enquiry messages, opportunity and proposal details, activity notes, private attachments, team assignments and review history. Processing consists of customer-directed recording, organisation, retrieval, internal sharing under permissions, notification, import, export and record review. The customer determines the lawful purpose, required contact notices and appropriate retention criteria. Company-configured data review intervals schedule a review, not automatic deletion. Decisions to keep a record store the reviewer, date, record revision and reason. Archiving and merging preserve associated history and are not erasure. Permanent deletion and service closure follow the return/deletion procedure above, taking account of linked records, documented instructions and any necessary legal retention. When the Forecast & sales performance add-on is enabled, this also includes company-configured stage probabilities, personal monthly targets and personal saved forecast snapshots. Estimates are calculated from existing CRM records and do not make decisions about contacts. Saved snapshots retain the original estimate; their display and export are limited by current record permissions. Their creator can delete them. The same company-directed retention and service-closure procedures apply. The optional Tenders add-on records bid decisions and reasons, requirements and their completion, deadlines, results and assigned guarantee follow-ups linked to existing opportunities. Access follows the opportunity team and separate add-on rights; the service does not submit bids or obtain guarantees. These records and their history follow the same company-directed retention and service-closure procedures. The optional Renewals & account development add-on records renewal dates, manually assessed relationship health and reasons, recurring internal follow-up plans, generated task references and explicit expansion opportunities. Plans use current member permissions and do not renew contracts, send client emails or make automated decisions about clients. The same company-directed retention and service-closure procedures apply to these records and their history. The optional Advanced pipelines add-on records customer-configured sales processes, typed opportunity fields, stage requirements and internal approval requests with reviewer, reason and revision history. Transfers preserve previous additional field values in a permission-controlled history. These workflow controls do not make financial or legal decisions and follow the same company-directed retention and service-closure procedures. No general permission for marketing, mailbox access or AI training follows from enabling CRM.
10. Marketing integration instructions
For customer-controlled Marketing records, the company determines the purposes and permitted users. A member with connection-management permission instructs Spona to obtain Meta account information for the selected connection purpose and save the selected accounts for that company. Reporting and publishing authorisations are separate. No People, payroll, CRM or financing records are sent to Meta by this connection flow. The company must hold the necessary authority over connected accounts and may request removal of an existing test connection at connect@spona.io. The provider’s own services and processing remain subject to its applicable terms.
Insights AI Summary — optional paid processing
When activated for a paid month, the optional Insights AI Summary sends the requesting member’s current, permitted findings and figures to the OpenAI API to draft a short summary. Names are replaced with placeholders before transmission and restored by Spona; this is pseudonymisation, not a guarantee of anonymity. Raw documents, attachments and the name key are not sent. Spona stores the resulting summary and token usage with the company, member, language and findings fingerprint. Payment references and monthly usage are recorded to administer the paid allowance. Saved summaries follow the customer-record retention and deletion process in the DPA. AI output can be inaccurate and must be checked against source records. The provider request disables response storage (store=false); OpenAI states API data is not used for training by default, while abuse-monitoring logs may be retained for up to 30 days, subject to applicable exceptions. This does not promise zero retention or EU-only processing. The operator must confirm the actual account’s processing arrangements, transfers and safeguards before customer activation under the DPA.
Spona AI — invoice and guide questions
When Spona AI is enabled for your workspace, OpenAI processes the question you submit to interpret an invoice request or prepare an answer from guides you may read. For invoice questions, Spona sends your question, interface language, the previous invoice topic when present, and whether a customer is selected. Customer names, invoice numbers, amounts, record identifiers and earlier question text are not automatically added. Spona retrieves the permitted Sales records and calculates the result. For guide questions, Spona searches published guidance within its own infrastructure and sends your question, language and selected guide titles, headings and excerpts to OpenAI. Company business records and earlier questions are not automatically added. Spona's answer instructions also accompany the request. Anything you type in the question is included and is not automatically anonymised. Do not enter passwords or unnecessary personal or confidential information. Check the source records and cited guidance before acting. The assistant cannot change records or send messages. Its processing is separate from the Insights AI Summary; the Insights name-replacement process does not apply to assistant questions. Spona keeps usage and security records linked to the company and requesting account, including request times and outcomes, provider references, model and token usage, and reserved and recorded costs. These records support service operation, usage limits and investigation of failures. The panel keeps your current draft and answer when you close it or move between screens. Clear conversation removes that panel context, not usage records or provider logs. The applicable service and customer-record retention criteria in the Privacy notice and DPA govern retained records; contact connect@spona.io for the criteria applying to your records or to request access or deletion. Spona asks OpenAI not to save the API response for later retrieval. This does not prevent all provider retention. OpenAI states that API data is not used for model training by default unless data sharing is explicitly enabled. By default, abuse-monitoring logs may include questions and responses and be retained for up to 30 days, with applicable exceptions. Provider processing locations, international transfers and retention depend on the applicable service arrangements; neither zero retention nor EU-only processing is promised. Contact connect@spona.io for the applicable provider information and transfer safeguards.