SPONA ERP — LEGAL DOCUMENTS 2026-10-11 · 1.30 English is the governing language of the Terms to the extent permitted by law. # Privacy notice ## 1. Scope and responsibility This notice covers the Spona website, business accounts, enquiries, support and optional financing requests. Top Digital Agency Limited, company number 642562, VAT ID IE3613706OH, 6B Raven Terrace, Galway, H91 H24H, Ireland, provides the ERP. Top Digital d.o.o., MBS 081170998, OIB 72317551155, VAT ID HR72317551155, Vladimira Nazora 23, 49210 Zabok, Croatia, administers financing. For privacy enquiries and rights requests, contact connect@spona.io and identify the service concerned. This address is the privacy contact, not a claim that a statutory Data Protection Officer has been appointed. ## 2. Two different roles For managing its business relationships, account security and its own enquiries, the operator acts as a controller. For personal data a customer places in Work, People, Salaries, Purchasing, Sales or Finance, the customer generally decides the purposes and acts as controller; the operator processes those records on documented instructions under the Data Processing Agreement. A customer acting for another controller must obtain the necessary authority. Financing participants may act as separate controllers for their own assessment and legal obligations; their notices must identify those activities. ## 3. Data and its sources Data may include names, work email addresses, company identifiers, account roles, authentication records, enquiries and support messages. Customer-controlled ERP records may include employees, salary amounts, clients, suppliers, project assignments, milestones, orders, invoices and attachments. Financing requests may add identification and contact information, transaction documents, requested amounts and terms, acknowledgements and application status. Sources are you, your organisation and its authorised users, counterparties and documents you supply. When article feedback is available in Help, submitting it records your helpful/not-yet choice and the article version. A company- and article-version-specific pseudonymous key prevents duplicate responses; authorised editors see counts, not reader names. You can change or remove your response while you have access to that published version, or contact connect@spona.io about a retained response. This explicit feedback is used to improve Help and is separate from optional browser analytics; it is not used for employee ranking or financing decisions. Contacting Support from a guide shares the question you enter and, if you choose to include it, the guide title, reference and version shown before sending. It does not automatically capture business records or page contents. These records follow the support-purpose retention criteria below; the key is not a general-purpose tracking identifier. Where data comes from another source, the responsible controller must provide the required indirect-collection information, subject to lawful exceptions. When counterparty financing invitations are enabled, the inviting company supplies the recipient’s email address. Before an invitation link is created, its authorised user must confirm that the recipient agreed to that specific invitation and that evidence can be provided. We record the confirming account and company, recipient address, source invoice reference, time, language and wording version to administer the invitation and handle related queries or disputes. This records the sender’s statement; it is not independent proof of the recipient’s consent, a marketing subscription or permission to act for the recipient’s company. The sender must retain the actual agreement and stop sharing or sending after withdrawal. Contact connect@spona.io to object, report an unexpected invitation, or request access, correction or deletion. These records follow the applicable service, enquiry and claims retention criteria below; revoking an invitation does not automatically erase its history. This notice does not announce activation of invitations or replace the first-contact information and opt-out controls required before release. When invitation stop controls are enabled, you can use the separate stop link in the invitation email without an account, or stop invitations to your own verified account address. Opening a link alone does not change your preference. We keep a pseudonymous digest of the normalized address, the first stop time and whether the request came from the email link or account, so future financing invitations from all companies on Spona can be blocked. This digest is personal data, not anonymous data. The stop has no automatic expiry; retention and deletion requests are assessed against the need to continue honoring it and applicable legal requirements. Email stop credentials are stored only as digests and permit only this choice. An email already being dispatched may still arrive. The choice does not cancel existing applications or stop necessary account and service messages. Contact connect@spona.io for help or to review the preference; senders and desk users cannot override it in the product. Signatory identity checks take place when a financing contract is supplied, whether signing uses an uploaded PDF or a secure signing link. We collect the signatory’s name and clear copies of the front and back of their identity card, together with upload dates and review decisions, to verify the person signing in the financing process with Valoris Capital d.o.o. Authorised financing reviewers and company members with signing permission can access these private records. Do not upload unrelated persons’ documents. Provide both sides again one calendar year after upload, or earlier if the signatory or document changes. This is a renewal rule for verification, not the identity card’s official expiry date or an automatic deletion period. No biometric matching or automated identity decision is performed by this upload workflow. When residence-based Irish service reviews are available, customer-controlled records also contain the selected permanent address or usual residence, relevant personal and occupational ties, evidence references and dates, business and VAT status, and findings that the customer has no business or fixed establishment. Record only information needed for the transaction; do not add unrelated personal or sensitive details. Authorised company users can retain, correct and export review history; an issued document retains its original identity and tax evidence. When you review and send a website enquiry, your name, email address, optional company, message and selected conversation or financing-estimate context are delivered to connect@spona.io through our existing mail service. An enquiry is not a financing application. Do not include passwords, identity documents or confidential financial records. ## 4. Purposes and legal bases We use necessary account and enquiry information to provide the service, respond to requests and manage the business relationship. Where you personally contract with us, this relies on contract performance or requested pre-contractual steps under Article 6(1)(b) GDPR. For corporate representatives, relationship administration and business communication rely on our legitimate interest in operating and supporting business services under Article 6(1)(f). Security, preventing misuse and establishing or defending legal claims also serve legitimate interests, subject to necessity and your rights. Processing required by a specific legal obligation relies on Article 6(1)(c). Optional tracking and marketing use separate consent where required. Customer-controlled ERP records are processed on documented instructions under the DPA; the customer establishes the basis for those records. Accepting service terms does not consent to every use of data. ## 5. Employee activity and sensitive records The ERP code records authenticated activity and visited application routes, and exposes authorised team activity views. Presence buckets and page-view records have a 90-day pruning window, triggered by application activity; this is not a guarantee of deletion at exactly day 90 or a retention rule for all audit logs and backups. Employers must assess necessity, proportionality, access and employee transparency before using these features. Do not use activity alone to make employment decisions. Health, union membership and other special-category data require an Article 9 condition as well as an Article 6 basis; do not upload them unless the service scope and safeguards have been expressly agreed. ## 6. Recipients and hosting Authorised personnel and contracted providers may access data where needed to deliver and support the service. Spona hosting is provided by Hetzner in Nuremberg, Germany. Hosting data may include account details, company records, uploaded files and technical logs needed for the service. Relevant transaction data may be shared with the identified financing counterparty and its authorised providers; an enquiry does not grant access to an entire ERP workspace. Professional advisers and competent authorities may receive data where lawfully required. Additional provider, backup and transfer arrangements must be disclosed for the affected service before activation. The German hosting location alone is not a statement that every external service processes data only in Germany. Transfers outside the EEA require applicable safeguards; contact connect@spona.io for information and copies of relevant safeguards. ## 6a. Measurement update — 4 October 2026 With renewed website analytics consent, Google Analytics also receives the referring website origin and predefined campaign labels, without referral paths, arbitrary URL parameters or form contents. ERP account creation has a separate, optional one-submission consent for a sign_up event, not consent for ongoing ERP tracking. The event is not linked by this integration to the website visitor identifier or an account identifier and does not establish email verification. Google receives browser and network information. The Cookie notice, sections 5, 5a and 6, explains the exact data, short-lived registration cookies, refusal and withdrawal; the Providers and retention notice describes Google processing and transfers. These optional choices do not condition access to the service. With renewed analytics consent, Google Analytics also counts enquiries accepted for email delivery, using only the form type and website language. Names, email addresses, company names, messages, financing amounts and enquiry references are excluded from that event. Acceptance for delivery is not proof that an email has reached the inbox. ## 7. Analytics, datasets and AI Updated 21 September 2026: the public website uses Google Analytics 4 only after analytics consent, for allowlisted page views and registration, sign-in and contact clicks. See the Cookie notice for controls, data and cookie details. Advertising integrations remain off. When activated for a paid month, the optional Insights AI Summary sends the requesting member’s current, permitted findings and figures to the OpenAI API to draft a short summary. Names are replaced with placeholders before transmission and restored by Spona; this is pseudonymisation, not a guarantee of anonymity. Raw documents, attachments and the name key are not sent. Spona stores the resulting summary and token usage with the company, member, language and findings fingerprint. Payment references and monthly usage are recorded to administer the paid allowance. Saved summaries follow the customer-record retention and deletion process in the DPA. AI output can be inaccurate and must be checked against source records. The provider request disables response storage (store=false); OpenAI states API data is not used for training by default, while abuse-monitoring logs may be retained for up to 30 days, subject to applicable exceptions. This does not promise zero retention or EU-only processing. The operator must confirm the actual account’s processing arrangements, transfers and safeguards before customer activation under the DPA. This notice does not authorise customer personal data or confidential content to train general-purpose models, be sold or be shared across customers. Properly anonymised, non-identifying statistics may support product improvement, research and commercial benchmarks under the safeguards in the Terms and DPA; creating those statistics is itself processing that first needs authority and a lawful basis. ## 8. Retention and security We retain account records while needed to administer the service and complete closure; enquiries and support records while needed to respond, resolve the matter and handle related claims; and financing and transaction records for the agreement and applicable legal recordkeeping or claims periods. Customer-controlled ERP records follow documented instructions and the DPA. Legal holds are limited to the relevant records and obligation. Backup copies are restricted to recovery and lawful retention and must not restore deleted records to ordinary use. Contact connect@spona.io for the period or criteria applicable to a specific record and to request deletion. Account access and file access are permission-controlled. No system is absolutely secure; no independent security certification or contractual availability percentage is claimed here. Any specific recovery or availability commitment must be separately agreed. The annual signatory-ID renewal date does not authorise indefinite storage or require automatic erasure on that date. Current and earlier copies follow the financing-record retention criteria above, including applicable legal recordkeeping and claims requirements; unnecessary copies must be reviewed for deletion under that process. Contact connect@spona.io for the period or criteria applying to your record. The website enquiry service keeps a random reference, message digest, IP-address digest, delivery state and timestamp for up to seven days, with hourly expiry cleanup, to prevent duplicate sends and limit abuse. It does not keep a separate database copy of the message or your contact fields. The email itself follows the enquiry retention criteria above. ## 9. Your choices and rights Subject to the applicable conditions, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You can object to direct marketing at any time and withdraw consent without affecting earlier lawful processing. Contact connect@spona.io and identify the service and request; provide only information reasonably needed to verify identity. Requests are normally answered within one month. A lawful extension of up to two further months requires notice and reasons within the first month. For customer-controlled ERP records, contact your organisation; the operator assists it. You may complain to a supervisory authority in your habitual residence, workplace or the place of the alleged infringement, including the Data Protection Commission in Ireland and AZOP in Croatia. No prior complaint to us is required. ## 10. Required information and decisions Without necessary account or transaction information, the relevant service or financing assessment may not be possible. Optional marketing permission must not be a condition of core ERP access. The reviewed financing flow contains a review process; it does not establish that every production decision is manual. Before any solely automated decision with legal or similarly significant effects is used, the responsible controller must establish a lawful basis, provide meaningful information about its logic and consequences, and implement applicable safeguards, including human intervention and challenge rights. ## 11. Operational reporting and optional browser analytics We distinguish operational reporting from optional behavioural measurement. Account registration and verification, authentication and security records, business-record creation and financing workflow records are generated to operate the requested services. Relevant reports may describe those records without relying on the optional browser-analytics switch. Each use remains subject to its purpose, lawful basis, access restrictions and retention; server-side collection is not a general exemption from data-protection rules. Processing customer-controlled records remains subject to the DPA. Spona’s separate product-improvement use of personal data requires its own documented lawful basis and transparency; where legitimate interests apply, you may object by contacting connect@spona.io. Optional website page views and ERP module visits use separate prior consent when enabled. The native collector sends an event identifier, time, random browser identifier, consent version, language and an allowlisted page or module category. These identifiers are pseudonymous, not a guarantee of anonymity. It excludes form contents, record identifiers, messages, payroll and transaction amounts from these event payloads. Technical network information may still be processed to deliver and protect the endpoint. Authorised Spona personnel access aggregate reports; this is not permission to expose one company’s records to another. Refusing browser analytics does not prevent ERP use or a financing application. Withdrawal stops future optional collection but does not automatically delete records already received or necessary operational/security records; rights requests remain available. Heatmaps, replay and additional profiling require their own assessment and disclosure before activation. Company-level operational usage records selected completed actions by module, action type and UTC day to support clients and understand module adoption. Only daily counts and a company identifier are stored in this usage dataset; it excludes user and browser identifiers, business-record identifiers, document contents, salary amounts and message text. It is not an employee-performance measure or a financing eligibility input. Access is limited to authorised Spona staff with company-usage permissions. Counts cover 90 UTC calendar days including today, with scheduled removal of older counts; original business and security audit records follow their own retention rules. This operational reporting does not enable optional browser analytics or join its identifiers. Contact connect@spona.io for access, objection or deletion requests; collection can be suppressed for the company while a request is handled. ## 12. Planned measurement The Data-use notice describes planned acquisition analysis, funnels, retention, journeys, heatmaps, replay, experiments and surveys, and their activation safeguards. This is advance information about the roadmap, not a statement that every feature is operating. Existing consent does not automatically extend to new tracking purposes or replay. Before introducing materially different browser storage or tracking, disclose its purpose, identifiers, duration, recipients and controls, and obtain fresh consent where required. No future feature is a condition of core ERP access merely because it appears in this notice. ## 13. CRM contacts and sales activity When your company enables CRM, it can manage prospect and business contact details, company relationships, opportunities, activities and notes, enquiry submissions, proposals and private files. The company determines the purpose of these records and who may access them; Spona processes customer-controlled records under its documented instructions and the DPA. Shared ownership, assigned follow-ups and selected teammate notifications remain subject to record access. Notification messages identify the relevant record and link back to the ERP; they do not include the full activity notes. The company must provide appropriate privacy information to contacts and publish its own notice and privacy link on any enabled public enquiry form. Submitting an enquiry does not create an ERP account or subscribe a person to marketing. CRM does not by itself enable mailbox synchronisation, tracking pixels, enrichment or AI processing. ## 14. Marketing data Companies control their Marketing plans, content, files, comments and collaborators. Meta connections are not currently available in the customer interface. In authorised integration testing, a company member may connect Meta accounts separately for ad reporting and social publishing. Spona receives the account and business identifiers and names returned by Meta, granted access, token expiry and the member and time of connection. Access credentials are encrypted on the server; Spona does not receive your Meta password. Discovery data is held during account selection; only selected accounts are saved to the company connection. Connecting does not publish content or change advertising budgets. Automatic publishing and spend imports are separate features in development, with their own activation conditions. ## Spona AI — invoice and guide questions When Spona AI is enabled for your workspace, OpenAI processes the question you submit to interpret an invoice request or prepare an answer from guides you may read. For invoice questions, Spona sends your question, interface language, the previous invoice topic when present, and whether a customer is selected. Customer names, invoice numbers, amounts, record identifiers and earlier question text are not automatically added. Spona retrieves the permitted Sales records and calculates the result. For guide questions, Spona searches published guidance within its own infrastructure and sends your question, language and selected guide titles, headings and excerpts to OpenAI. Company business records and earlier questions are not automatically added. Spona's answer instructions also accompany the request. Anything you type in the question is included and is not automatically anonymised. Do not enter passwords or unnecessary personal or confidential information. Check the source records and cited guidance before acting. The assistant cannot change records or send messages. Its processing is separate from the Insights AI Summary; the Insights name-replacement process does not apply to assistant questions. Spona keeps usage and security records linked to the company and requesting account, including request times and outcomes, provider references, model and token usage, and reserved and recorded costs. These records support service operation, usage limits and investigation of failures. The panel keeps your current draft and answer when you close it or move between screens. Clear conversation removes that panel context, not usage records or provider logs. The applicable service and customer-record retention criteria in the Privacy notice and DPA govern retained records; contact connect@spona.io for the criteria applying to your records or to request access or deletion. Spona asks OpenAI not to save the API response for later retrieval. This does not prevent all provider retention. OpenAI states that API data is not used for model training by default unless data sharing is explicitly enabled. By default, abuse-monitoring logs may include questions and responses and be retained for up to 30 days, with applicable exceptions. Provider processing locations, international transfers and retention depend on the applicable service arrangements; neither zero retention nor EU-only processing is promised. Contact connect@spona.io for the applicable provider information and transfer safeguards. # Website & ERP terms ## 1. Parties, scope and acceptance These terms govern business use of Spona websites and ERP services. Businesses worldwide may register for the ERP, subject to these terms and applicable law. Registration does not guarantee financing availability or support for every country’s accounting, payroll or tax requirements. The ERP provider is Top Digital Agency Limited, company number 642562, VAT ID IE3613706OH, 6B Raven Terrace, Galway, H91 H24H, Ireland. Top Digital d.o.o., MBS 081170998, OIB 72317551155, VAT ID HR72317551155, Vladimira Nazora 23, 49210 Zabok, Croatia, administers the optional financing service. Together they are referred to as Spona where the context permits; each is responsible for the services it provides. You must be at least 18, have legal capacity and be authorised to bind the business you represent. By registering or accepting these terms you agree for yourself and that business. A separately signed agreement prevails for its subject matter; the Data Processing Agreement governs processing on your instructions, and the transaction agreement governs financing. Merely using a calculator or viewing these pages does not enter you into a financing agreement. ## 2. Free ERP and separately agreed services The available Work, People, Salaries, Purchasing, Sales and Finance modules and their Power add-ons have no licence or per-user fee, except the separately ordered Insights AI Summary. You choose the modules and permissions that fit your business. Separately agreed implementation, maintenance, consulting and custom or white-label work may carry fees. Agreed API integration development is free; feasibility, scope, timing, third-party costs and maintenance are agreed before work starts. Financing is optional and carries the single disclosed transaction fee described below. There is no additional undisclosed platform administration fee. Features marked coming soon are not available features or delivery commitments. Any future material change to the free offer or charges is prospective, notified reasonably in advance and does not alter an already agreed transaction. AI Summary is €5 per company for an agreed UTC calendar month, including 100 new successful summaries shared by its users. The selected month and applicable tax treatment must be shown before payment. Activation follows confirmation of payment; there is no automatic renewal or overage charge. Unused summaries expire at month-end. Failed attempts and reopening an unchanged saved summary do not consume the allowance. Switching the add-on off stops access but does not itself cancel or refund an agreed paid month; contact support for billing corrections and any applicable refund rights. Existing users are not enrolled or charged automatically. ## 3. Accounts and lawful use The customer controls user invitations, permissions, accurate records and lawful instructions. Protect credentials, remove departing users and report suspected compromise promptly. Do not upload unlawful content, malware or data you lack authority to process; bypass access controls, interfere with other tenants or use the service for fraud. Security testing requires written agreement on scope. The customer must give appropriate employee and counterparty notices and establish a legal basis for their data; accepting these terms cannot waive those individuals’ rights. ## 4. Ownership and processing licence The customer retains its rights in uploaded content. It grants the operator a non-exclusive right to host, reproduce, organise, transmit and otherwise process that content only to deliver the contracted services, follow documented instructions, secure the service and meet applicable law. Approved providers may exercise those rights only within their contracted tasks. The operator retains rights in its software, designs and documentation. Feedback may be used without payment provided it does not disclose customer confidential information or personal data. No general ownership transfer of customer datasets occurs. ## 5. Permitted aggregate datasets Subject to an approved lawful processing arrangement, the operator may develop and commercially use statistics that cannot reasonably identify a person or customer, reveal customer trade secrets, or permit singling out, linkage or reconstruction. Permitted purposes include service improvement, capacity planning, research and published benchmarks. Anonymisation must be assessed against reasonably available means and reviewed as risks change; small groups and identifiable outliers must be excluded or protected. Pseudonymisation alone is insufficient. Personal data remains subject to the DPA and GDPR until effectively anonymised. These terms do not authorise selling personal records, cross-customer disclosure of source records or training general-purpose AI on confidential content. Any such additional project requires a separate, specific assessment and agreement before processing. ## 6. Confidentiality and providers Each party must protect the other’s non-public business information, limit access to people who need it and are bound by confidentiality, and use it only for the agreement. Exceptions apply to information lawfully public, independently developed or lawfully received without restriction. A legally required disclosure must be limited and, where permitted, notified. Approved subprocessors remain subject to the DPA. A financing partner’s independent assessment is governed by its disclosed role and transaction documents, not an unrestricted licence to the ERP database. ## 7. Records, estimates and professional judgement The ERP supports business records and workflows. It does not replace the customer’s accountant, lawyer or statutory reporting responsibilities. Salary records do not promise a compliant payroll calculation or filing. A financing estimate is illustrative and is not an offer, approval or guarantee. Customers must check source records and outputs, including AI summaries, before acting. The operator remains responsible for obligations that cannot lawfully be excluded; these provisions do not excuse its own failure to provide agreed services with the legally required standard of care. ## 8. Suspension and termination Either party may terminate the service agreement by notice. Contact connect@spona.io for account closure. Spona may restrict or suspend access where reasonably necessary for a breach, credible security threat, fraud, unlawful use, inability to verify necessary information or a binding legal requirement. Where lawful and practicable, notice and an opportunity to remedy will be provided; urgent protection may require immediate action. Spona will notify you of a suspension and its grounds within three business days unless prohibited by law. Closing an ERP account does not cancel outstanding financing agreements or accrued payment obligations. Confidentiality, intellectual-property rights, lawful retention, liability provisions and applicable dispute-resolution terms survive termination. Mandatory data retrieval and switching rights remain unaffected. ## 9. Your records, export and switching You retain ownership of your records and applicable portability and switching rights. Contact connect@spona.io to request export or plan a move, identifying the company, records and intended destination. Available module exports can be used directly; a complete workspace transfer may require assistance and is not represented as an automatic one-click feature. Agree the scope, available formats, transition and retrieval arrangements before closing the account. Any charges, exclusions or operational arrangements remain subject to mandatory law, including the EU Data Act where applicable. No intellectual-property or trade-secret exclusion may defeat those rights. At the end of processing, personal data is returned or deleted as provided in the DPA, except where lawful retention applies. ## 10. Availability, warranties and liability To the fullest extent permitted by law, the service is provided as is and as available, without implied warranties of merchantability, fitness for a particular purpose, accuracy or non-infringement. Spona does not promise uninterrupted or error-free operation, business results or a particular financing outcome. Subject to mandatory law and any expressly agreed service commitment, Spona and its affiliates and service providers are not liable for indirect, incidental, consequential or punitive loss, including lost profits, opportunities, reputation, revenues or data. Aggregate liability shall not exceed the lesser of the fees you paid Spona in the twelve months preceding the claim and EUR 1.000. These exclusions and limits do not apply to fraud, wilful misconduct, gross negligence or liability that cannot lawfully be excluded, including mandatory data-subject rights and remedies. Spona remains responsible for its own obligations under applicable law. Nothing transfers liability for Spona’s own breach to you. ## 11. Platform role and your business relationships You choose and evaluate your clients, suppliers and subcontractors and agree the scope, delivery, price and payment dates with them. Spona does not select a counterparty for you, warrant its reliability, carry out its work or become its employer or partner. Ordinary ERP records and recorded payments do not require all your business payments to pass through Spona. An optional financing transaction has its own payment instructions. Spona is not a party to your underlying supply or service contract merely because it is recorded in the ERP. Any expressly appointed agency for transaction notices is limited to that written authority. Information and tools are not legal, tax or financial advice. ## 12. Accounts, notices and authorised users Provide accurate registration information, protect credentials and keep company and contact details current. You are responsible for the users you authorise and for activity under their permissions; revoke access promptly when authority ends and notify us of suspected compromise. Account creation requires the applicable registration and verification steps. Financing may require additional identity and business checks. Notices may be delivered within the service or to your supplied contact details. Optional communication preferences do not prevent necessary security, contractual or service notices. General and privacy enquiries: connect@spona.io. Formal legal notices: office@topdigital.agency; intellectual-property reports: legal@spona.io. ## 13. Optional financing The Financing disclosures form part of these terms. Supplier advances and client payment deferrals are separate alternatives, not two fees on one transaction. Each request requires review, applicable verification and signed transaction documents before a payment can be arranged. The agreement identifies the financing counterparty, recipient, fee, dates and obligations, including any responsibility if the original debtor does not pay. No acceptance of these general terms alone creates a financing commitment. Existing signed financing agreements remain governed by their agreed terms. When your financing contract is supplied, provide both sides of the signatory’s identity card for review as described in the Financing and Privacy notices. Renew the upload after one year or when the signatory or document changes. Accepting these Terms is not a substitute for contract signatures or identity review. ## 14. Disputes, governing law and language For disputes with Spona, email office@topdigital.agency with the account, facts and contact details. The parties will attempt informal resolution for 45 days after notice. Subject to mandatory law, these terms are governed by Irish law and disputes are subject to the exclusive jurisdiction of the Irish courts. A dispute exclusively about the financing service between a Croatian-established user and Top Digital d.o.o. is governed by Croatian law: the parties first negotiate, then attempt mediation through the Croatian Association for Conciliation for up to 60 days unless extended by agreement, and if unresolved proceed before the competent court in Zagreb. Mandatory rights to urgent relief, complaints to authorities and data-protection remedies are not excluded. A signed transaction agreement may specify the law and forum for that transaction. English is the governing language to the extent permitted by law; Croatian is provided for convenience. ## 15. General provisions and changes If a provision is unenforceable, it will be limited to the minimum extent necessary or severed without invalidating the remaining terms. Failure to enforce a provision is not a waiver. You may not transfer your account or agreement without Spona’s written consent. Spona may transfer its agreement to an affiliate or business successor subject to applicable law and without reducing mandatory rights. No employment, partnership or general agency is created and no third-party beneficiary is intended unless expressly stated. Material changes will be notified with the applicable effective date and any required acceptance process; a website edit does not retrospectively rewrite signed transaction agreements. The version shown on this page identifies the terms presented for acceptance. ## 16. Service reporting and analytics choices The service may provide operational reports from records lawfully processed to administer accounts, deliver ERP functions, secure the platform and manage financing workflows. This does not grant a new unrestricted licence to customer content or turn customer-controlled records into Spona-owned data. Separate product analytics must follow the Privacy Notice, DPA and Data-use notice, including purpose limitation and a documented lawful basis. Optional browser measurement is separate from service delivery and is not accepted through this agreement or a registration checkbox. Declining or withdrawing that measurement does not remove core ERP access or make financing conditional on tracking. Security and necessary business records may continue to be processed under their applicable basis. No term authorises covert employee monitoring, cross-client disclosure or treating a browser visit as a verified business outcome. ## 17. Future analytics features The Data-use notice describes planned acquisition analysis, funnels, retention, journeys, heatmaps, replay, experiments and surveys, and their activation safeguards. This is advance information about the roadmap, not a statement that every feature is operating. Existing consent does not automatically extend to new tracking purposes or replay. Before introducing materially different browser storage or tracking, disclose its purpose, identifiers, duration, recipients and controls, and obtain fresh consent where required. No future feature is a condition of core ERP access merely because it appears in this notice. # Data Processing Agreement ## 1. Parties, scope and instructions This DPA forms part of the customer’s ERP agreement for personal data processed on the customer’s instructions. The customer acts as controller, or as an authorised processor appointing the operator as subprocessor; the operator acts as processor for the covered customer records. Process only on documented instructions, including transfers, unless Union or Member State law requires otherwise; inform the customer of that requirement beforehand unless prohibited. Immediately inform the customer if an instruction appears to infringe data-protection law and suspend the affected instruction while it is resolved. Own-controller activities disclosed in the Privacy Notice are outside this DPA. ## 2. Processing schedule Subject: delivery and support of selected ERP modules. Duration: the service term plus agreed retrieval and deletion periods, subject to lawful retention. Operations: collection, storage, organisation, access, calculation, transmission, export and deletion as instructed. Data subjects: customer users, employees, contractors, business contacts, clients and suppliers. Categories: identifiers and work contacts, roles, activity records, project and transaction records, salary and payment information and instructed attachments. The signed order must narrow these categories to the modules actually used and expressly identify any permitted special-category data. Financing-partner assessment is not automatically included in this processor schedule. ## 3. Confidentiality and security Authorised personnel must be bound by confidentiality. The processor must implement appropriate Article 32 measures proportionate to risk, including access management, tenant isolation, protection of data in transit and at rest where appropriate, resilience, recovery and regular evaluation. Any agreed security annex identifies the measures applicable to your service. This DPA does not claim an independent certification or a specific recovery time. Security changes must not materially reduce the agreed protection. ## 4. Subprocessors and transfers The customer must receive the completed subprocessor register before authorisation. Under the general-authorisation mechanism, give at least 30 days’ advance notice of additions or replacements and allow reasoned data-protection objections. Resolve an objection through reasonable alternatives or permit termination of the affected service before the provider begins processing. Each subprocessor must accept materially equivalent data-protection duties; the operator remains responsible for its performance. No international transfer may occur without applicable Chapter V safeguards and documented instructions. The provider register identifies approved hosting; additional providers require disclosure and authorisation under this clause. ## 5. Rights, incidents and regulatory assistance Taking account of the nature of processing, assist the customer with data-subject requests, security duties, breach assessment, DPIAs and prior consultation. Forward requests without answering for the customer unless authorised or legally required. Notify the customer without undue delay after becoming aware of a personal-data breach, with available facts about its nature, affected categories and approximate numbers, contact, likely consequences and mitigation; supplement information as it becomes available. The controller determines its own notification duties, including the GDPR 72-hour authority deadline where applicable. Assistance arrangements must not prevent statutory compliance. ## 6. Demonstrating compliance Make available the information necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the customer or its mandated auditor. Reasonable confidentiality, scheduling and security arrangements may protect other customers and systems but must not defeat Article 28 audit rights or regulatory access. Maintain the required processing records and evidence of instructions, provider approvals, incidents and deletion. The customer remains responsible for its lawful purposes, notices, minimisation and employee-monitoring assessment. ## 7. Return, deletion and further use At the customer’s choice, return or delete covered personal data after the service ends and delete remaining copies unless applicable law requires storage. Agree export and retrieval periods before closure. Legally retained copies must be isolated and used only for that obligation. The final annex must define backup expiry and restoration controls so deleted records are not returned to active use. Processing to create anonymous datasets requires documented customer instructions and the customer’s lawful authority; this DPA does not permit independent reuse of personal data for advertising or general AI training. Genuine anonymous outputs may be used only within the Terms’ confidentiality and re-identification safeguards. ## 8. Reporting boundaries and analytics Reports generated for the customer from its ERP records remain within the documented service instructions and applicable access controls. This DPA does not authorise the operator to repurpose employee, client, payroll or financing content for its own unrestricted analytics, advertising or model training. Any separate controller purpose requires an identified lawful basis, transparent information and safeguards before processing; the operator must not rely on the customer’s contract as blanket consent for individuals. Optional browser events are governed by the separately described consent controls. Random identifiers remain protected where individuals are identifiable. Analytics copies, derived personal data and links must be included in applicable rights, deletion, hold and backup procedures; aggregation alone does not remove these obligations. ## 9. CRM processing instructions For enabled CRM functionality, the processing schedule also covers prospect and business contacts, their company relationships, enquiry messages, opportunity and proposal details, activity notes, private attachments, team assignments and review history. Processing consists of customer-directed recording, organisation, retrieval, internal sharing under permissions, notification, import, export and record review. The customer determines the lawful purpose, required contact notices and appropriate retention criteria. Company-configured data review intervals schedule a review, not automatic deletion. Decisions to keep a record store the reviewer, date, record revision and reason. Archiving and merging preserve associated history and are not erasure. Permanent deletion and service closure follow the return/deletion procedure above, taking account of linked records, documented instructions and any necessary legal retention. When the Forecast & sales performance add-on is enabled, this also includes company-configured stage probabilities, personal monthly targets and personal saved forecast snapshots. Estimates are calculated from existing CRM records and do not make decisions about contacts. Saved snapshots retain the original estimate; their display and export are limited by current record permissions. Their creator can delete them. The same company-directed retention and service-closure procedures apply. The optional Tenders add-on records bid decisions and reasons, requirements and their completion, deadlines, results and assigned guarantee follow-ups linked to existing opportunities. Access follows the opportunity team and separate add-on rights; the service does not submit bids or obtain guarantees. These records and their history follow the same company-directed retention and service-closure procedures. The optional Renewals & account development add-on records renewal dates, manually assessed relationship health and reasons, recurring internal follow-up plans, generated task references and explicit expansion opportunities. Plans use current member permissions and do not renew contracts, send client emails or make automated decisions about clients. The same company-directed retention and service-closure procedures apply to these records and their history. The optional Advanced pipelines add-on records customer-configured sales processes, typed opportunity fields, stage requirements and internal approval requests with reviewer, reason and revision history. Transfers preserve previous additional field values in a permission-controlled history. These workflow controls do not make financial or legal decisions and follow the same company-directed retention and service-closure procedures. No general permission for marketing, mailbox access or AI training follows from enabling CRM. ## 10. Marketing integration instructions For customer-controlled Marketing records, the company determines the purposes and permitted users. A member with connection-management permission instructs Spona to obtain Meta account information for the selected connection purpose and save the selected accounts for that company. Reporting and publishing authorisations are separate. No People, payroll, CRM or financing records are sent to Meta by this connection flow. The company must hold the necessary authority over connected accounts and may request removal of an existing test connection at connect@spona.io. The provider’s own services and processing remain subject to its applicable terms. ## Insights AI Summary — optional paid processing When activated for a paid month, the optional Insights AI Summary sends the requesting member’s current, permitted findings and figures to the OpenAI API to draft a short summary. Names are replaced with placeholders before transmission and restored by Spona; this is pseudonymisation, not a guarantee of anonymity. Raw documents, attachments and the name key are not sent. Spona stores the resulting summary and token usage with the company, member, language and findings fingerprint. Payment references and monthly usage are recorded to administer the paid allowance. Saved summaries follow the customer-record retention and deletion process in the DPA. AI output can be inaccurate and must be checked against source records. The provider request disables response storage (store=false); OpenAI states API data is not used for training by default, while abuse-monitoring logs may be retained for up to 30 days, subject to applicable exceptions. This does not promise zero retention or EU-only processing. The operator must confirm the actual account’s processing arrangements, transfers and safeguards before customer activation under the DPA. ## Spona AI — invoice and guide questions When Spona AI is enabled for your workspace, OpenAI processes the question you submit to interpret an invoice request or prepare an answer from guides you may read. For invoice questions, Spona sends your question, interface language, the previous invoice topic when present, and whether a customer is selected. Customer names, invoice numbers, amounts, record identifiers and earlier question text are not automatically added. Spona retrieves the permitted Sales records and calculates the result. For guide questions, Spona searches published guidance within its own infrastructure and sends your question, language and selected guide titles, headings and excerpts to OpenAI. Company business records and earlier questions are not automatically added. Spona's answer instructions also accompany the request. Anything you type in the question is included and is not automatically anonymised. Do not enter passwords or unnecessary personal or confidential information. Check the source records and cited guidance before acting. The assistant cannot change records or send messages. Its processing is separate from the Insights AI Summary; the Insights name-replacement process does not apply to assistant questions. Spona keeps usage and security records linked to the company and requesting account, including request times and outcomes, provider references, model and token usage, and reserved and recorded costs. These records support service operation, usage limits and investigation of failures. The panel keeps your current draft and answer when you close it or move between screens. Clear conversation removes that panel context, not usage records or provider logs. The applicable service and customer-record retention criteria in the Privacy notice and DPA govern retained records; contact connect@spona.io for the criteria applying to your records or to request access or deletion. Spona asks OpenAI not to save the API response for later retrieval. This does not prevent all provider retention. OpenAI states that API data is not used for model training by default unless data sharing is explicitly enabled. By default, abuse-monitoring logs may include questions and responses and be retained for up to 30 days, with applicable exceptions. Provider processing locations, international transfers and retention depend on the applicable service arrangements; neither zero retention nor EU-only processing is promised. Contact connect@spona.io for the applicable provider information and transfer safeguards. # Cookies & browser storage ## 1. Website storage and your choices The website stores spona.website.consent in first-party localStorage to remember your privacy choice for up to 180 days. It contains the policy/provider version, choice time, expiry, language and category choices; no account identifier is added. Accept and reject choices use the same duration. The record expires on the next visit or while the page is active; the browser may retain expired bytes until the site runs again or you clear storage. Expired, missing, malformed or outdated records do not enable optional services. If storage is unavailable, the choice applies to the current page session and the site may ask again on reload. Necessary preference storage is used to honour your choice, not to advertise. When you select a website language, spona.website.language remembers that choice in first-party localStorage for up to 180 days, with the language, save time and expiry only. You can change it using the language switcher or remove it by clearing site storage. On a homepage visit without an explicit language, we use your saved choice first, then a country code supplied by Cloudflare from your connection, or your browser language if that code is unavailable. This feature does not request precise device location or store your IP address in the language preference. Explicit language links remain available. ## 2. ERP authentication The API sets a first-party HttpOnly cookie named token for authenticated sessions. The source sets no explicit cookie expiry, so browser session handling applies; restoring a browser session may preserve it. The dashboard and command centre also use spona.session in sessionStorage and localStorage to maintain and restore sign-in. Session storage normally lasts for the tab session; local storage has no automatic expiry in the reviewed implementation. Logout clears these client-side records and the current server session. Clearing browser storage alone does not establish that every server session has been revoked. When manual Irish invoice issuance is enabled, the ERP stores the exact confirmed invoice request in first-party sessionStorage under spona.ireland.issue.* before sending it. It contains the selected company and customer references, dates, descriptions, amounts, tax-treatment choice, review digest and request identifier. For enabled itemised domestic VAT, it also contains the declared customer VAT status, the supporting note, each line’s classification and supporting note, and the confirmed scope declarations. For enabled cross-border ordinary B2B services, it also contains the declared business-status evidence type, check and validity dates, external proof references, location and receiving-establishment notes, any non-EU tax or trade reference and independent check, per-line classification and destination-taxability notes, and confirmed scope declarations. Spona records your review; this is not an automated VAT-registration verification. The key is scoped to the company and a digest of the current session; the sign-in token is not copied into this record. This supports an explicit retry of the same request after an interrupted response, reducing duplicate invoices. Nothing is resent automatically. The record is removed after confirmed success, a definite pre-issue review refusal or a login-session change, including logout. Otherwise it lasts for the tab session, which browser session restoration may preserve. Closing the invoice form does not remove an unresolved request. This is requested transaction recovery, not analytics or marketing. If storage cannot be used, the ERP does not send a new issuance request. Before clearing unresolved recovery data or starting in another tab, check issued invoices or contact support; clearing browser storage does not cancel an invoice already created on the server. When the Irish credit-note preview is enabled, the same recovery approach uses spona.ireland.credit.* for the confirmed credit request: company and original invoice references, date, language, reason, selected net reductions or full remaining reversal, review digest and request identifier. Its key also includes the original invoice. Credit recovery is removed after confirmed success, an explicit stale-review refusal or a login-session change; other outcomes retain the request for an explicit retry during the tab session. This does not record a cash refund or cancel a credit note already issued. When Irish refund recording is enabled, spona.ireland.refund.* (including spona.ireland.refund.batch.*) stores the exact confirmed recording or correction request in first-party sessionStorage before submission. It contains company and originating invoice references, payment or batch references, allocations, amounts and fees where applicable, reason, correction date where applicable, review digest and request identifiers. Keys include a digest of the current session and company; whole-bank recovery also includes the invoice, while batch recovery is available across invoices in that company. The sign-in token is not copied into these records. Requests are retried only when you explicitly choose to retry. Confirmed success, an explicit stale-review refusal or a login-session change removes the saved request; uncertain outcomes retain it for the tab session, which browser restoration may preserve. Before clearing an unresolved request or using another tab, check refund history: clearing browser storage does not undo a recorded refund or correction. If recovery storage cannot be used, the ERP does not submit a new request. This is transaction recovery, not analytics or marketing, and does not execute a bank payment. When the saved Irish service-review pilot is enabled, spona.ireland.saved-review.* keeps the exact save, withdrawal or issuance request in first-party sessionStorage before submission. A save includes company/customer/review identifiers, expected revision, service descriptions and prices, dated business/receiving/service-location evidence references and notes, and declared VAT classifications and legal bases. Withdrawal and issuance commands contain the source revision and request identifiers; issuance also includes document language and the preparation digest. The key is bound to the company and a digest of the current session, without copying the sign-in token. Nothing is retried automatically. Confirmed success, a definite pre-write validation or refresh refusal, or a login-session change removes the record. Uncertain outcomes remain for explicit retry during the tab session, which browser restoration may preserve; closing the form does not erase them. If this storage cannot be read and checked, new writes are blocked. Before clearing an unresolved request or using another tab, check the saved review and issued invoices or contact support. Clearing browser storage does not withdraw a server review or cancel an issued invoice. This is requested transaction recovery, not analytics or marketing. When the receiving-establishment review pilot is enabled, spona.ireland.receiving-review.* separately stores the exact confirmed save, withdrawal or issuance command in first-party sessionStorage. It contains company/review identifiers, source revision and digest, request identifier and, for issuance, document language, preparation digest and confirmation. A save command for a new review or a correction also contains the customer identifier, full retained service facts, dated business and receiving VAT evidence, qualification findings, service-selection evidence, prices, tax declarations and the corrected receiving address. This preserves the exact revision requested after an interrupted response. The company/session binding, explicit-only retry, removal after confirmed success or definite pre-write validation/refresh refusal, login-session cleanup, tab-session duration and blocked writes when recovery cannot be checked follow the same rules above. Downloaded revision evidence may include business and receiving-establishment details; exported files remain under your control and are not removed by browser recovery cleanup. Residence reviews use the same recovery record and include absence findings, residence addresses, personal and occupational tie notes, and their dated evidence. Keep this information limited to what is needed for the review. Recovery cleanup does not delete retained server review or invoice history. ## 3. Accept, refuse or withdraw Use Reject optional to keep optional services off, Accept all to enable only the configured and disclosed categories, or Manage choices to choose individual categories. Unconfigured categories are disabled; no advance permission is recorded for them. Close or Escape dismisses the settings panel without saving. Cookie settings remains available below the footer and in the legal centre. You can change or withdraw permission there at any time; refusal does not block navigation, calculators or contact features. Changes apply to open tabs on this same origin through browser storage events. This choice does not cover another device, browser, subdomain or ERP application, marketing email, AI training or contractual acceptance. ## 4. Your controls You can clear cookies and site storage in your browser settings and sign out of the ERP. Clearing authentication data may require you to sign in again; clearing preferences resets the saved layout. On a shared device, sign out when finished. Privacy requests about server-side records should be sent to connect@spona.io or to your organisation for its ERP records; browser deletion does not delete those records. ## 5. Google Analytics 4 — updated 4 October 2026 Updated 4 October 2026. Spona uses Google Analytics 4 for optional measurement on spona.io and www.spona.io. Our integration loads Google only after analytics consent, with no analytics requests or denied-consent pings before that choice. It measures allowlisted public page views and clicks to open ERP registration, sign-in or an email to Spona. These clicks indicate intent, not a completed account, successful login or delivered enquiry. After renewed analytics consent, we also measure the referring website origin (without its path, query or fragment) and approved source, medium and campaign labels. Only predefined campaign labels are accepted; arbitrary URL parameters, ad click identifiers, form contents and ERP business records are excluded. Spona subdomains are excluded as acquisition referrers. This website consent does not enable Google Analytics inside the ERP. Google receives browser/device information, cookie identifiers and network information such as IP addresses. Automatic enhanced measurement and Google advertising features are disabled for this integration. Refusing analytics does not prevent use of the website or ERP. With renewed analytics consent, Google Analytics also counts enquiries accepted for email delivery, using only the form type and website language. Names, email addresses, company names, messages, financing amounts and enquiry references are excluded from that event. Acceptance for delivery is not proof that an email has reached the inbox. ## 5a. Optional registration measurement The ERP cookie banner offers Accept all, Reject optional and Manage preferences. Accepting analytics enables optional Spona page measurement and Google registration measurement without a separate registration checkbox or account switch. With that choice, a successful account-creation response triggers one Google Analytics sign_up event containing the language, registration method and consent notice version. It does not establish email verification, company activation or financing approval. The Google tag runs in an isolated www.spona.io frame, not in the ERP form. No name, email, password, company, account identifier or form content is passed to that frame. Google still receives browser and network information, including an IP address. Separate spona_signup-prefixed analytics cookies are configured on www.spona.io under /analytics/signup/ with a one-second lifetime and no rolling renewal. Browser restrictions may prevent measurement. The ERP stores the version, choice and time in spona.erp.analytics.consent for up to 180 days. It does not join this event to the website visitor identifier. Use Reject optional or turn off Optional analytics in Cookie preferences to refuse or withdraw. Cookie preferences is available on the ERP screen and in Settings. Existing refusals are preserved; an earlier native-only consent does not authorize Google measurement. If the choice cannot be saved, optional collection remains off. The website and ERP remember their choices separately. Registration remains available. Events already sent cannot be recalled; contact connect@spona.io for data-rights requests. Google processing and transfer information is in the Providers and retention notice. ## 6. Analytics cookies and withdrawal When analytics is connected and accepted, the integration configures first-party _ga and _ga_ cookies on the current hostname and root path, with a 180-day lifetime and rolling updates disabled. Withdrawal sets Google’s measurement-disable flag, stops our page-view listener, removes the tag and accessible _ga cookies, clears its local command queue and reloads the page to unload already executed Google code. Requests already sent cannot be recalled and withdrawing consent does not automatically erase data already received by Google. Contact connect@spona.io for a separate data-rights request. We cannot delete cookies belonging to unrelated sites or applications. ## 7. Native Spona website analytics Where configured, Spona’s own website analytics starts only after analytics consent. It uses spona.analytics.anonymous in first-party localStorage for a random browser identifier, separate from the consent preference. It sends allowlisted page categories, language, timestamps, random event identifiers and the consent version to a same-origin Spona endpoint; form values and URL parameters are excluded. The identifier is pseudonymous and is not linked by this collector to an ERP account. Withdrawal stops the listener, aborts pending delivery and removes the identifier; renewed consent creates a new one. There is no persistent browser retry queue. The identifier has no independent fixed expiry in the current implementation and is removed by consent withdrawal, collector cleanup or clearing browser storage. The 180-day preference duration is not the retention period of server event records. Native Spona analytics does not require Google Analytics or PostHog. Any separately enabled third-party provider is subject to its own disclosed controls. ## 8. Optional ERP module visits ERP usage measurement follows the analytics choice in the ERP cookie banner; no separate account switch is required. spona.erp.analytics.consent stores the choice, version and choice time in first-party localStorage for up to 180 days. The choice applies to this browser, not an entire company. An in-memory random identifier exists only during consented collection and resets on reload, sign-out or withdrawal. The collector sends broad Home, Work, Purchasing, Sales, Finance and Financing categories, language and event metadata; it excludes People, personal Portal and Messages routes, record IDs, query values, record contents and amounts. Moving between records in the same module does not create another consecutive module visit. Turn collection off through Cookie preferences on the ERP screen or in Settings; pending requests are aborted. Withdrawal cannot recall data already received. Refusal does not affect core access. Cookie controls do not erase separately held security or operational records. ## 9. Future browser technologies The Data-use notice describes planned acquisition analysis, funnels, retention, journeys, heatmaps, replay, experiments and surveys, and their activation safeguards. This is advance information about the roadmap, not a statement that every feature is operating. Existing consent does not automatically extend to new tracking purposes or replay. Before introducing materially different browser storage or tracking, disclose its purpose, identifiers, duration, recipients and controls, and obtain fresh consent where required. No future feature is a condition of core ERP access merely because it appears in this notice. ## 10. Meta connection sign-in Connecting a Meta account opens a Meta sign-in window only after you choose Connect Meta. The connection uses Spona’s existing signed-in session and temporary connection state; it does not add advertising or analytics tracking to Spona. Meta controls cookies and similar technologies on its own sign-in pages under its notices and settings. Authorising an integration is separate from accepting optional analytics cookies. # Financing disclosures ## 1. Roles and scope Top Digital d.o.o., MBS 081170998, OIB 72317551155, VAT ID HR72317551155, Vladimira Nazora 23, 49210 Zabok, Croatia, administers the financing service on the Spona platform. The financier and all contracting parties are identified in the documents for the individual transaction. The administrator is not automatically the financier or the party assuming payment risk. Spona’s ERP provider is Top Digital Agency Limited, Ireland, company number 642562, VAT ID IE3613706OH. Financing is optional; you may use the free ERP without it. No banking licence, regulatory exemption or approval of a transaction is asserted by this page. Valoris Capital d.o.o. provides the financing and makes financing decisions. Spona acts as agent and coordinates applications and contracts. ## 2. Two financing directions As a supplier, you may request earlier payment on an eligible unpaid amount; the agreed fee is deducted and your client pays the original financed amount on the agreed date to the party named in the payment instructions. As a client, you may request more time to pay; your supplier receives the financed amount and you pay that amount plus the agreed fee on the agreed later date. These are separate alternatives. A company’s role depends on the transaction. A counterparty invitation is an invitation to review information, not approval or an obligation to accept financing. ## 3. Requests and eligibility Businesses worldwide may submit financing requests. Each request is assessed individually, including the country, parties, transaction and applicable requirements. Submission does not guarantee availability, an offer or approval. A request may start from a completed, client-confirmed Work stage, an eligible accepted purchase order, an eligible unpaid sales invoice or the direct questionnaire. Internal projects cannot be financed. Provide accurate business and transaction information, the requested documents and relevant identity or business-verification information. Do not submit fictitious, disputed, previously assigned or encumbered amounts, conceal restrictions on transfer, duplicate a financing request for the same exposure or manipulate amounts and dates. Inform Spona promptly of disputes, payments or changes. Supporting records, confirmations and an invitation do not guarantee eligibility. Spona or the identified financier may decline or request further information. ## 4. Fees and payment dates The website illustrates a single one-time transaction fee of 2,95% for 30 days, 6,38% for 60 days and 9,99% for 90 days, calculated on the financed amount. For EUR 10.000 these examples are EUR 295, EUR 638 and EUR 999. The calculator is not a binding offer. The agreement confirms the actual amount, fee, applicable tax treatment, due dates and any consequences of late payment before you accept. There is no separate additional platform administration fee under this offer. Changes to published pricing do not change a signed transaction. Payment timing follows the agreement and completion of its conditions; no same-day or one-business-day payout is promised by the website. ## 5. Review, signing and payment After submission, Spona reviews the request and may ask for additional information or documents. If an offer is made, review its conditions and the parties involved. Complete required verification and signing by all required parties before payment is arranged. Follow requests, responses, documents and status in the financing workspace. A signed status is separate from payment: Spona records when funds have actually been sent. The agreement determines the recipient and payment direction. Where a receivable is assigned, the applicable agreement and notice identify the new recipient of payment; follow verified payment instructions and report any conflicting request. All data, price indications, terms, timelines and specifications displayed or generated through this platform are exclusively indicative, informational and non-binding in nature. Accepting an indicative offer requests preparation of the separate transaction contract; it is not a signature or a payment instruction. Spona may provide a contract PDF for download, signing and return, or a secure DocuSign signing link. Required signatures must be checked and confirmed before the signature step is completed. Opening a link or uploading a copy does not itself confirm completion. Company registration and beneficial ownership are checked manually by Spona. Company register extracts, beneficial ownership extracts and bank account confirmation documents are not part of the standard client upload checklist. Payout account details and any necessary holder checks remain required. A future Fina connection is not active. Identity uploads are requested with the contract, not as a condition of initial application submission. Financing cannot be paid until the required manual checks, current identity review, signatures and other payment conditions are complete. ## 6. Non-payment and disputes Financing does not insure payment or remove all commercial risk. The transaction agreement determines liability if the original debtor does not pay, including whether payment may be demanded from the supplier, relevant deadlines, permitted charges and remedies. Review those provisions before signing. Notify Spona and the named financing counterparty promptly of a dispute or a payment received contrary to assignment instructions. Where the agreement requires onward transfer, follow its stated deadline. ERP confirmation does not waive rights that cannot lawfully be waived. General website copy neither replaces nor changes an existing agreement. ## 7. Documents, privacy and access restrictions Only provide information relevant to the request and ensure you have authority to share it. Relevant data may be disclosed to the identified financier and authorised providers for verification, review and fulfilment of the transaction, under their disclosed roles and privacy notices. It does not give them access to your entire ERP workspace. Marketing choices remain separate. Access may be suspended for suspected fraud, disputed transactions, missing verification or breach, with notice of the grounds within three business days unless prohibited by law. General privacy rights and the applicable DPA remain unaffected. Signatory identity checks take place when a financing contract is supplied, whether signing uses an uploaded PDF or a secure signing link. We collect the signatory’s name and clear copies of the front and back of their identity card, together with upload dates and review decisions, to verify the person signing in the financing process with Valoris Capital d.o.o. Authorised financing reviewers and company members with signing permission can access these private records. Do not upload unrelated persons’ documents. Provide both sides again one calendar year after upload, or earlier if the signatory or document changes. This is a renewal rule for verification, not the identity card’s official expiry date or an automatic deletion period. No biometric matching or automated identity decision is performed by this upload workflow. ## 8. Financing records and optional analytics Application, verification, review, signing and payment-status records are processed for the financing service under the applicable notices, agreements and legal bases. Refusing optional website or ERP browser analytics does not prevent submission and is not an approval criterion. Operational reporting must distinguish submitted requests, decisions, signed agreements and recorded funds sent; a browser click is not approval or payment. Additional marketing, profiling or unrelated product-research uses require their own applicable basis and safeguards; accepting financing terms is not blanket consent to those uses. # Providers, retention & requests ## 1. Hosting and service providers Hosting provider: Hetzner. Hosting location: Nuremberg, Germany. Purpose: operating the Spona website and platform infrastructure, including storage and processing needed to deliver the service. Information about Hetzner and its data-processing agreement: https://docs.hetzner.com/general/company-and-policy/data-protection-at-hetzner/. Other services, including separate email delivery, external file storage, backups and optional AI, require service-specific provider and location disclosures before use. Contact connect@spona.io for the register applicable to your service. A provider’s own certification does not certify the Spona application. ## 2. Retention and deletion Retention depends on the record and purpose. Accounts are retained for service administration and closure; enquiry and support records for response, resolution and related claims; business and financing records for the agreement, instructions and applicable statutory obligations. Legal holds apply only to the necessary scope. Presence buckets and page-view records use a 90-day pruning window triggered by application activity; this is not a universal retention period for other records or backups. Website consent preferences last up to 180 days. For account export, closure, deletion or the applicable retention criteria, contact connect@spona.io. Customer-controlled personal data is returned or deleted according to the DPA, subject to lawful retention. Recovery copies must not reintroduce deleted records into normal processing. The annual signatory-ID renewal date does not authorise indefinite storage or require automatic erasure on that date. Current and earlier copies follow the financing-record retention criteria above, including applicable legal recordkeeping and claims requirements; unnecessary copies must be reviewed for deletion under that process. Contact connect@spona.io for the period or criteria applying to your record. ## 3. Make a request Email connect@spona.io with the subject “Privacy request”, “Data export” or “Account closure”. Include the relevant company, service and a concise description; do not send passwords, full identity documents or unrelated employee records. We may need proportionate identity and authority checks. An individual’s GDPR request and a company’s complete ERP export are different requests and may have different scopes. For records controlled by your employer or another customer, contact that organisation; the platform supports its response. ## 4. Google Analytics — website measurement Updated 21 September 2026. Google Analytics 4 provides optional website measurement after analytics consent. The Spona - GA4 property uses the Spona - WEB stream. Its event-data retention is set to 2 months and user-data retention to 14 months, with reset on new activity enabled; aggregated standard reports are not governed by these same limits. The separate browser consent and cookie lifetime is 180 days. Google may process data outside the EEA under the applicable contractual and transfer arrangements; this service is not covered by the location of Spona’s Hetzner hosting. Information about Google processing is available at https://policies.google.com/technologies/partner-sites and https://privacy.google.com/businesses/processorterms/. Contact connect@spona.io for information about applicable safeguards or to make a privacy request. With renewed analytics consent, Google Analytics also counts enquiries accepted for email delivery, using only the form type and website language. Names, email addresses, company names, messages, financing amounts and enquiry references are excluded from that event. Acceptance for delivery is not proof that an email has reached the inbox. ## 5. Native reporting and analytics retention Native Spona browser analytics uses a separate analytics store and restricted Spona reporting access. It does not send these events to Google or PostHog through the native collector. Hetzner hosting in Nuremberg, Germany remains the stated hosting arrangement; additional providers or transfers must be disclosed before use. The 180-day browser-choice lifetime and the existing 90-day operational presence pruning rule are not deletion guarantees for the separate analytics database. Retain personal operational and analytics records only as necessary for their stated purpose, applicable obligations and limited legal holds, with a documented schedule for each dataset. Retention policy updated 21 September 2026: raw native browser events are kept for 90 days from the event date, security-event analytics copies for 180 days from the event date, and successfully delivered queue copies for 7 days from delivery. Bounded scheduled cleanup uses complete UTC days; operational session records and other audit trails have separate retention rules. Anonymous daily traffic totals, without browser, user or session identifiers, are retained for 24 months. Daily visitor counts cannot identify unique visitors across multiple days. Relevant records under a documented, time-limited legal hold are excluded from cleanup; undelivered events are investigated rather than silently deleted. Backups remain subject to the separate recovery policy. Withdrawal stops future optional collection; a separate rights request may cover retained records, subject to applicable exceptions and the ability to identify them. Contact connect@spona.io without sending passwords or unnecessary business documents. Company-level operational usage records selected completed actions by module, action type and UTC day to support clients and understand module adoption. Only daily counts and a company identifier are stored in this usage dataset; it excludes user and browser identifiers, business-record identifiers, document contents, salary amounts and message text. It is not an employee-performance measure or a financing eligibility input. Access is limited to authorised Spona staff with company-usage permissions. Counts cover 90 UTC calendar days including today, with scheduled removal of older counts; original business and security audit records follow their own retention rules. This operational reporting does not enable optional browser analytics or join its identifiers. Contact connect@spona.io for access, objection or deletion requests; collection can be suppressed for the company while a request is handled. ## 6. CRM record review CRM uses the existing Spona hosting, private file storage and notification providers described in this notice. It introduces no separate CRM analytics, enrichment or mailbox provider. Authorised CRM administrators can set a review interval and company instructions, review active and archived records, record a reason for keeping them, and export review evidence. No universal CRM retention period is applied: the interval is chosen by the company, starts unconfigured and does not delete records. Export access and record access remain permission-controlled. For permanent deletion or a rights request, contact connect@spona.io so the required scope, linked records, legal obligations and recovery procedures can be assessed. ## 7. Optional Meta access and retention Meta is an external platform selected and authorised by the company, not a provider automatically activated for every ERP account. Its applicable terms govern its own services, locations and transfers; this notice does not promise that Meta processing remains in the EU. Unfinished connection attempts and their discovery data expire after ten minutes and are purged by a scheduled cleanup running every minute while the API is available. Saved credentials remain until replaced, disconnected or invalidated during a connection check, subject to account deletion and applicable retention instructions. Disconnecting deletes Spona’s saved credential and selected accounts for that company and purpose; a minimal connection status, actor and audit history remain under the existing audit-retention rules. It does not delete Meta content or revoke other companies’ connections. Full provider-side revocation is available in Meta’s business integration settings. ## Insights AI Summary — optional paid processing When activated for a paid month, the optional Insights AI Summary sends the requesting member’s current, permitted findings and figures to the OpenAI API to draft a short summary. Names are replaced with placeholders before transmission and restored by Spona; this is pseudonymisation, not a guarantee of anonymity. Raw documents, attachments and the name key are not sent. Spona stores the resulting summary and token usage with the company, member, language and findings fingerprint. Payment references and monthly usage are recorded to administer the paid allowance. Saved summaries follow the customer-record retention and deletion process in the DPA. AI output can be inaccurate and must be checked against source records. The provider request disables response storage (store=false); OpenAI states API data is not used for training by default, while abuse-monitoring logs may be retained for up to 30 days, subject to applicable exceptions. This does not promise zero retention or EU-only processing. The operator must confirm the actual account’s processing arrangements, transfers and safeguards before customer activation under the DPA. ## Spona AI — invoice and guide questions When Spona AI is enabled for your workspace, OpenAI processes the question you submit to interpret an invoice request or prepare an answer from guides you may read. For invoice questions, Spona sends your question, interface language, the previous invoice topic when present, and whether a customer is selected. Customer names, invoice numbers, amounts, record identifiers and earlier question text are not automatically added. Spona retrieves the permitted Sales records and calculates the result. For guide questions, Spona searches published guidance within its own infrastructure and sends your question, language and selected guide titles, headings and excerpts to OpenAI. Company business records and earlier questions are not automatically added. Spona's answer instructions also accompany the request. Anything you type in the question is included and is not automatically anonymised. Do not enter passwords or unnecessary personal or confidential information. Check the source records and cited guidance before acting. The assistant cannot change records or send messages. Its processing is separate from the Insights AI Summary; the Insights name-replacement process does not apply to assistant questions. Spona keeps usage and security records linked to the company and requesting account, including request times and outcomes, provider references, model and token usage, and reserved and recorded costs. These records support service operation, usage limits and investigation of failures. The panel keeps your current draft and answer when you close it or move between screens. Clear conversation removes that panel context, not usage records or provider logs. The applicable service and customer-record retention criteria in the Privacy notice and DPA govern retained records; contact connect@spona.io for the criteria applying to your records or to request access or deletion. Spona asks OpenAI not to save the API response for later retrieval. This does not prevent all provider retention. OpenAI states that API data is not used for model training by default unless data sharing is explicitly enabled. By default, abuse-monitoring logs may include questions and responses and be retained for up to 30 days, with applicable exceptions. Provider processing locations, international transfers and retention depend on the applicable service arrangements; neither zero retention nor EU-only processing is promised. Contact connect@spona.io for the applicable provider information and transfer safeguards. # Analytics, AI & data use ## 1. Intended scope and activation Spona intends to develop product analytics, anonymised benchmarks, AI training and evaluation, marketing and financing-partner collaboration. These are distinct purposes, not an unlimited data licence. This notice defines conditions for future activation; it does not state that all these uses currently operate. Each programme needs an identified controller, data categories, legal basis, recipients, duration and safeguards before it starts. The customer may authorise use of content it owns but cannot consent on behalf of employees, contacts or other individuals without lawful authority. ## 2. Product analytics and research Use the minimum events and attributes needed to understand feature adoption, reliability and user experience. Where legitimate interests are proposed, document the specific benefit, necessity, less intrusive alternatives, reasonable expectations and balancing of individual rights; provide the applicable objection route. Obtain prior consent for non-essential browser access where required even if subsequent processing has another GDPR basis. Research is not a universal exemption. Cross-module linkage, employee-level analysis and new purposes require a fresh assessment and updated information before use. Core business reporting is designed to use authoritative server records rather than optional navigation events: registrations and verification, persisted business records and financing workflow outcomes. Reports must state which sources and historical coverage are actually available; this notice does not assert that every funnel is already implemented. Browser measurement remains separately consented and cannot be silently reclassified as necessary operational processing. Do not infer distinct users or company adoption from resetting random browser identities. Existing ERP employee-activity features remain subject to the separate safeguards in the Privacy Notice. Company-level operational usage records selected completed actions by module, action type and UTC day to support clients and understand module adoption. Only daily counts and a company identifier are stored in this usage dataset; it excludes user and browser identifiers, business-record identifiers, document contents, salary amounts and message text. It is not an employee-performance measure or a financing eligibility input. Access is limited to authorised Spona staff with company-usage permissions. Counts cover 90 UTC calendar days including today, with scheduled removal of older counts; original business and security audit records follow their own retention rules. This operational reporting does not enable optional browser analytics or join its identifiers. Contact connect@spona.io for access, objection or deletion requests; collection can be suppressed for the company while a request is handled. ## 3. Anonymous benchmarks and commercial datasets Spona may retain, combine, license and publish genuinely anonymous statistics for research, product development and commercial benchmarking within the Terms’ safeguards. The process must remove reasonably foreseeable identification, linkage and reconstruction risks and protect confidential business information. Approve dataset provenance, permissions, cohort thresholds, outlier treatment and release tests before distribution; do not invent a numeric threshold as a guarantee of anonymity. Retest when datasets are combined or external information changes. Raw customer records and pseudonymous identifiers are not anonymous commercial outputs. ## 4. AI training and evaluation programmes AI inference, model evaluation and model training must be distinguished. For a separately approved training programme, a signed schedule must identify the model and provider, training purpose, data scope and sources, intellectual-property permission, lawful basis, retention, recipients, transfers, opt-out or withdrawal process where applicable and how rights can be honoured in datasets and models. Use genuinely anonymous or synthetic inputs where feasible. Do not include payroll, identity documents, special-category records or confidential customer content by default. Consent, where relied on, must be specific and freely given, with no loss of core ERP access for refusal. A legitimate-interest route requires a documented case-specific assessment; these terms do not predetermine the outcome. No training permission is activated by a general terms checkbox. ## 5. Marketing and financing collaboration Service messages needed to operate an account are separate from promotional messages. Marketing programmes must identify channels and recipients and comply with applicable electronic-marketing rules, including consent where required and a simple, free unsubscribe. Do not enrich marketing audiences with customer-controlled employee, salary or client records under the ERP processing licence. Financing disclosures must be limited to relevant application and transaction data and the disclosed recipient’s purpose; a partner’s independent marketing requires its own lawful arrangement. Consent choices must be granular and recorded by purpose and version, and changes must reach downstream recipients where required. ## 6. Planned Analytics & BI features Planned capabilities include traffic-source and campaign analysis, landing-page and device/approximate-country breakdowns, new/returning browser measurement and engagement; registration, verification and activation funnels; feature adoption, user journeys, company cohorts and retention; financing submission, review, signature and recorded-payout funnels; configurable reports, exports, anomaly alerts and data-quality diagnostics. Later proposals include click/scroll heatmaps, session replay, feature experiments and voluntary surveys. Some reporting components are already implemented; listing a feature here does not mean its collection is enabled or that historical data exists. Each release must identify its actual data sources, purpose, controller/processor roles, lawful basis, access and retention. Campaign and referral inputs must be allowlisted and stripped of personal data; approximate location must not be presented as precise tracking. Cross-domain attribution or linkage to an account/company requires a separately assessed and disclosed method, not silent identity stitching. Operational funnels must use authoritative records and distinguish unknown, incomplete and immature cohorts. Browser visits alone do not establish account activation, employee productivity, creditworthiness or financing approval. ## 7. Safeguards before advanced measurement Heatmaps and replay are not authorised by general Terms acceptance or the existing module-visit choice. Before launch, provide purpose-specific information and obtain any required consent; introduce granular controls and a stop mechanism. Exclude sensitive screens and block inputs, credentials, uploaded documents, messages, payroll and identity/verification data before transmission; masking after capture alone is not sufficient. Do not promise complete masking without testing the actual implementation. Limit replay access, audit access and exports, define a short justified retention period and complete a data-protection impact assessment where required. Experiments must identify assignment identifiers and outcomes, avoid sensitive profiling and not change contractual financing terms or make automated eligibility decisions under an analytics permission. Survey participation is voluntary; explain any link to account records and discourage confidential or sensitive information in free text. New providers, recipients, transfers or materially broader purposes require updated information and fresh consent where necessary. No roadmap entry activates these features or grants a blanket licence to collect data. ## Insights AI Summary — optional paid processing When activated for a paid month, the optional Insights AI Summary sends the requesting member’s current, permitted findings and figures to the OpenAI API to draft a short summary. Names are replaced with placeholders before transmission and restored by Spona; this is pseudonymisation, not a guarantee of anonymity. Raw documents, attachments and the name key are not sent. Spona stores the resulting summary and token usage with the company, member, language and findings fingerprint. Payment references and monthly usage are recorded to administer the paid allowance. Saved summaries follow the customer-record retention and deletion process in the DPA. AI output can be inaccurate and must be checked against source records. The provider request disables response storage (store=false); OpenAI states API data is not used for training by default, while abuse-monitoring logs may be retained for up to 30 days, subject to applicable exceptions. This does not promise zero retention or EU-only processing. The operator must confirm the actual account’s processing arrangements, transfers and safeguards before customer activation under the DPA. ## Spona AI — invoice and guide questions When Spona AI is enabled for your workspace, OpenAI processes the question you submit to interpret an invoice request or prepare an answer from guides you may read. For invoice questions, Spona sends your question, interface language, the previous invoice topic when present, and whether a customer is selected. Customer names, invoice numbers, amounts, record identifiers and earlier question text are not automatically added. Spona retrieves the permitted Sales records and calculates the result. For guide questions, Spona searches published guidance within its own infrastructure and sends your question, language and selected guide titles, headings and excerpts to OpenAI. Company business records and earlier questions are not automatically added. Spona's answer instructions also accompany the request. Anything you type in the question is included and is not automatically anonymised. Do not enter passwords or unnecessary personal or confidential information. Check the source records and cited guidance before acting. The assistant cannot change records or send messages. Its processing is separate from the Insights AI Summary; the Insights name-replacement process does not apply to assistant questions. Spona keeps usage and security records linked to the company and requesting account, including request times and outcomes, provider references, model and token usage, and reserved and recorded costs. These records support service operation, usage limits and investigation of failures. The panel keeps your current draft and answer when you close it or move between screens. Clear conversation removes that panel context, not usage records or provider logs. The applicable service and customer-record retention criteria in the Privacy notice and DPA govern retained records; contact connect@spona.io for the criteria applying to your records or to request access or deletion. Spona asks OpenAI not to save the API response for later retrieval. This does not prevent all provider retention. OpenAI states that API data is not used for model training by default unless data sharing is explicitly enabled. By default, abuse-monitoring logs may include questions and responses and be retained for up to 30 days, with applicable exceptions. Provider processing locations, international transfers and retention depend on the applicable service arrangements; neither zero retention nor EU-only processing is promised. Contact connect@spona.io for the applicable provider information and transfer safeguards.