SPONA ERP — LEGAL DOCUMENTS

2026-10-11 · 1.30

English is the governing language of the Terms to the extent permitted by law.

# Privacy notice

## 1. Scope and responsibility

This notice covers the Spona website, business accounts, enquiries, support and optional financing requests. Top Digital Agency Limited, company number 642562, VAT ID IE3613706OH, 6B Raven Terrace, Galway, H91 H24H, Ireland, provides the ERP. Top Digital d.o.o., MBS 081170998, OIB 72317551155, VAT ID HR72317551155, Vladimira Nazora 23, 49210 Zabok, Croatia, administers financing. For privacy enquiries and rights requests, contact connect@spona.io and identify the service concerned. This address is the privacy contact, not a claim that a statutory Data Protection Officer has been appointed.

## 2. Two different roles

For managing its business relationships, account security and its own enquiries, the operator acts as a controller. For personal data a customer places in Work, People, Salaries, Purchasing, Sales or Finance, the customer generally decides the purposes and acts as controller; the operator processes those records on documented instructions under the Data Processing Agreement. A customer acting for another controller must obtain the necessary authority. Financing participants may act as separate controllers for their own assessment and legal obligations; their notices must identify those activities.

## 3. Data and its sources

Data may include names, work email addresses, company identifiers, account roles, authentication records, enquiries and support messages. Customer-controlled ERP records may include employees, salary amounts, clients, suppliers, project assignments, milestones, orders, invoices and attachments. Financing requests may add identification and contact information, transaction documents, requested amounts and terms, acknowledgements and application status. Sources are you, your organisation and its authorised users, counterparties and documents you supply. When article feedback is available in Help, submitting it records your helpful/not-yet choice and the article version. A company- and article-version-specific pseudonymous key prevents duplicate responses; authorised editors see counts, not reader names. You can change or remove your response while you have access to that published version, or contact connect@spona.io about a retained response. This explicit feedback is used to improve Help and is separate from optional browser analytics; it is not used for employee ranking or financing decisions. Contacting Support from a guide shares the question you enter and, if you choose to include it, the guide title, reference and version shown before sending. It does not automatically capture business records or page contents. These records follow the support-purpose retention criteria below; the key is not a general-purpose tracking identifier. Where data comes from another source, the responsible controller must provide the required indirect-collection information, subject to lawful exceptions. When counterparty financing invitations are enabled, the inviting company supplies the recipient’s email address. Before an invitation link is created, its authorised user must confirm that the recipient agreed to that specific invitation and that evidence can be provided. We record the confirming account and company, recipient address, source invoice reference, time, language and wording version to administer the invitation and handle related queries or disputes. This records the sender’s statement; it is not independent proof of the recipient’s consent, a marketing subscription or permission to act for the recipient’s company. The sender must retain the actual agreement and stop sharing or sending after withdrawal. Contact connect@spona.io to object, report an unexpected invitation, or request access, correction or deletion. These records follow the applicable service, enquiry and claims retention criteria below; revoking an invitation does not automatically erase its history. This notice does not announce activation of invitations or replace the first-contact information and opt-out controls required before release. When invitation stop controls are enabled, you can use the separate stop link in the invitation email without an account, or stop invitations to your own verified account address. Opening a link alone does not change your preference. We keep a pseudonymous digest of the normalized address, the first stop time and whether the request came from the email link or account, so future financing invitations from all companies on Spona can be blocked. This digest is personal data, not anonymous data. The stop has no automatic expiry; retention and deletion requests are assessed against the need to continue honoring it and applicable legal requirements. Email stop credentials are stored only as digests and permit only this choice. An email already being dispatched may still arrive. The choice does not cancel existing applications or stop necessary account and service messages. Contact connect@spona.io for help or to review the preference; senders and desk users cannot override it in the product.

Signatory identity checks take place when a financing contract is supplied, whether signing uses an uploaded PDF or a secure signing link. We collect the signatory’s name and clear copies of the front and back of their identity card, together with upload dates and review decisions, to verify the person signing in the financing process with Valoris Capital d.o.o. Authorised financing reviewers and company members with signing permission can access these private records. Do not upload unrelated persons’ documents. Provide both sides again one calendar year after upload, or earlier if the signatory or document changes. This is a renewal rule for verification, not the identity card’s official expiry date or an automatic deletion period. No biometric matching or automated identity decision is performed by this upload workflow. When residence-based Irish service reviews are available, customer-controlled records also contain the selected permanent address or usual residence, relevant personal and occupational ties, evidence references and dates, business and VAT status, and findings that the customer has no business or fixed establishment. Record only information needed for the transaction; do not add unrelated personal or sensitive details. Authorised company users can retain, correct and export review history; an issued document retains its original identity and tax evidence.

When you review and send a website enquiry, your name, email address, optional company, message and selected conversation or financing-estimate context are delivered to connect@spona.io through our existing mail service. An enquiry is not a financing application. Do not include passwords, identity documents or confidential financial records.

## 4. Purposes and legal bases

We use necessary account and enquiry information to provide the service, respond to requests and manage the business relationship. Where you personally contract with us, this relies on contract performance or requested pre-contractual steps under Article 6(1)(b) GDPR. For corporate representatives, relationship administration and business communication rely on our legitimate interest in operating and supporting business services under Article 6(1)(f). Security, preventing misuse and establishing or defending legal claims also serve legitimate interests, subject to necessity and your rights. Processing required by a specific legal obligation relies on Article 6(1)(c). Optional tracking and marketing use separate consent where required. Customer-controlled ERP records are processed on documented instructions under the DPA; the customer establishes the basis for those records. Accepting service terms does not consent to every use of data.

## 5. Employee activity and sensitive records

The ERP code records authenticated activity and visited application routes, and exposes authorised team activity views. Presence buckets and page-view records have a 90-day pruning window, triggered by application activity; this is not a guarantee of deletion at exactly day 90 or a retention rule for all audit logs and backups. Employers must assess necessity, proportionality, access and employee transparency before using these features. Do not use activity alone to make employment decisions. Health, union membership and other special-category data require an Article 9 condition as well as an Article 6 basis; do not upload them unless the service scope and safeguards have been expressly agreed.

## 6. Recipients and hosting

Authorised personnel and contracted providers may access data where needed to deliver and support the service. Spona hosting is provided by Hetzner in Nuremberg, Germany. Hosting data may include account details, company records, uploaded files and technical logs needed for the service. Relevant transaction data may be shared with the identified financing counterparty and its authorised providers; an enquiry does not grant access to an entire ERP workspace. Professional advisers and competent authorities may receive data where lawfully required. Additional provider, backup and transfer arrangements must be disclosed for the affected service before activation. The German hosting location alone is not a statement that every external service processes data only in Germany. Transfers outside the EEA require applicable safeguards; contact connect@spona.io for information and copies of relevant safeguards.

## 6a. Measurement update — 4 October 2026

With renewed website analytics consent, Google Analytics also receives the referring website origin and predefined campaign labels, without referral paths, arbitrary URL parameters or form contents. ERP account creation has a separate, optional one-submission consent for a sign_up event, not consent for ongoing ERP tracking. The event is not linked by this integration to the website visitor identifier or an account identifier and does not establish email verification. Google receives browser and network information. The Cookie notice, sections 5, 5a and 6, explains the exact data, short-lived registration cookies, refusal and withdrawal; the Providers and retention notice describes Google processing and transfers. These optional choices do not condition access to the service.

With renewed analytics consent, Google Analytics also counts enquiries accepted for email delivery, using only the form type and website language. Names, email addresses, company names, messages, financing amounts and enquiry references are excluded from that event. Acceptance for delivery is not proof that an email has reached the inbox.

## 7. Analytics, datasets and AI

Updated 21 September 2026: the public website uses Google Analytics 4 only after analytics consent, for allowlisted page views and registration, sign-in and contact clicks. See the Cookie notice for controls, data and cookie details. Advertising integrations remain off. When activated for a paid month, the optional Insights AI Summary sends the requesting member’s current, permitted findings and figures to the OpenAI API to draft a short summary. Names are replaced with placeholders before transmission and restored by Spona; this is pseudonymisation, not a guarantee of anonymity. Raw documents, attachments and the name key are not sent. Spona stores the resulting summary and token usage with the company, member, language and findings fingerprint. Payment references and monthly usage are recorded to administer the paid allowance. Saved summaries follow the customer-record retention and deletion process in the DPA. AI output can be inaccurate and must be checked against source records. The provider request disables response storage (store=false); OpenAI states API data is not used for training by default, while abuse-monitoring logs may be retained for up to 30 days, subject to applicable exceptions. This does not promise zero retention or EU-only processing. The operator must confirm the actual account’s processing arrangements, transfers and safeguards before customer activation under the DPA. This notice does not authorise customer personal data or confidential content to train general-purpose models, be sold or be shared across customers. Properly anonymised, non-identifying statistics may support product improvement, research and commercial benchmarks under the safeguards in the Terms and DPA; creating those statistics is itself processing that first needs authority and a lawful basis.

## 8. Retention and security

We retain account records while needed to administer the service and complete closure; enquiries and support records while needed to respond, resolve the matter and handle related claims; and financing and transaction records for the agreement and applicable legal recordkeeping or claims periods. Customer-controlled ERP records follow documented instructions and the DPA. Legal holds are limited to the relevant records and obligation. Backup copies are restricted to recovery and lawful retention and must not restore deleted records to ordinary use. Contact connect@spona.io for the period or criteria applicable to a specific record and to request deletion. Account access and file access are permission-controlled. No system is absolutely secure; no independent security certification or contractual availability percentage is claimed here. Any specific recovery or availability commitment must be separately agreed.

The annual signatory-ID renewal date does not authorise indefinite storage or require automatic erasure on that date. Current and earlier copies follow the financing-record retention criteria above, including applicable legal recordkeeping and claims requirements; unnecessary copies must be reviewed for deletion under that process. Contact connect@spona.io for the period or criteria applying to your record.

The website enquiry service keeps a random reference, message digest, IP-address digest, delivery state and timestamp for up to seven days, with hourly expiry cleanup, to prevent duplicate sends and limit abuse. It does not keep a separate database copy of the message or your contact fields. The email itself follows the enquiry retention criteria above.

## 9. Your choices and rights

Subject to the applicable conditions, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You can object to direct marketing at any time and withdraw consent without affecting earlier lawful processing. Contact connect@spona.io and identify the service and request; provide only information reasonably needed to verify identity. Requests are normally answered within one month. A lawful extension of up to two further months requires notice and reasons within the first month. For customer-controlled ERP records, contact your organisation; the operator assists it. You may complain to a supervisory authority in your habitual residence, workplace or the place of the alleged infringement, including the Data Protection Commission in Ireland and AZOP in Croatia. No prior complaint to us is required.

## 10. Required information and decisions

Without necessary account or transaction information, the relevant service or financing assessment may not be possible. Optional marketing permission must not be a condition of core ERP access. The reviewed financing flow contains a review process; it does not establish that every production decision is manual. Before any solely automated decision with legal or similarly significant effects is used, the responsible controller must establish a lawful basis, provide meaningful information about its logic and consequences, and implement applicable safeguards, including human intervention and challenge rights.

## 11. Operational reporting and optional browser analytics

We distinguish operational reporting from optional behavioural measurement. Account registration and verification, authentication and security records, business-record creation and financing workflow records are generated to operate the requested services. Relevant reports may describe those records without relying on the optional browser-analytics switch. Each use remains subject to its purpose, lawful basis, access restrictions and retention; server-side collection is not a general exemption from data-protection rules. Processing customer-controlled records remains subject to the DPA. Spona’s separate product-improvement use of personal data requires its own documented lawful basis and transparency; where legitimate interests apply, you may object by contacting connect@spona.io. Optional website page views and ERP module visits use separate prior consent when enabled. The native collector sends an event identifier, time, random browser identifier, consent version, language and an allowlisted page or module category. These identifiers are pseudonymous, not a guarantee of anonymity. It excludes form contents, record identifiers, messages, payroll and transaction amounts from these event payloads. Technical network information may still be processed to deliver and protect the endpoint. Authorised Spona personnel access aggregate reports; this is not permission to expose one company’s records to another. Refusing browser analytics does not prevent ERP use or a financing application. Withdrawal stops future optional collection but does not automatically delete records already received or necessary operational/security records; rights requests remain available. Heatmaps, replay and additional profiling require their own assessment and disclosure before activation. Company-level operational usage records selected completed actions by module, action type and UTC day to support clients and understand module adoption. Only daily counts and a company identifier are stored in this usage dataset; it excludes user and browser identifiers, business-record identifiers, document contents, salary amounts and message text. It is not an employee-performance measure or a financing eligibility input. Access is limited to authorised Spona staff with company-usage permissions. Counts cover 90 UTC calendar days including today, with scheduled removal of older counts; original business and security audit records follow their own retention rules. This operational reporting does not enable optional browser analytics or join its identifiers. Contact connect@spona.io for access, objection or deletion requests; collection can be suppressed for the company while a request is handled.

## 12. Planned measurement

The Data-use notice describes planned acquisition analysis, funnels, retention, journeys, heatmaps, replay, experiments and surveys, and their activation safeguards. This is advance information about the roadmap, not a statement that every feature is operating. Existing consent does not automatically extend to new tracking purposes or replay. Before introducing materially different browser storage or tracking, disclose its purpose, identifiers, duration, recipients and controls, and obtain fresh consent where required. No future feature is a condition of core ERP access merely because it appears in this notice.

## 13. CRM contacts and sales activity

When your company enables CRM, it can manage prospect and business contact details, company relationships, opportunities, activities and notes, enquiry submissions, proposals and private files. The company determines the purpose of these records and who may access them; Spona processes customer-controlled records under its documented instructions and the DPA. Shared ownership, assigned follow-ups and selected teammate notifications remain subject to record access. Notification messages identify the relevant record and link back to the ERP; they do not include the full activity notes. The company must provide appropriate privacy information to contacts and publish its own notice and privacy link on any enabled public enquiry form. Submitting an enquiry does not create an ERP account or subscribe a person to marketing. CRM does not by itself enable mailbox synchronisation, tracking pixels, enrichment or AI processing.

## 14. Marketing data

Companies control their Marketing plans, content, files, comments and collaborators. Meta connections are not currently available in the customer interface. In authorised integration testing, a company member may connect Meta accounts separately for ad reporting and social publishing. Spona receives the account and business identifiers and names returned by Meta, granted access, token expiry and the member and time of connection. Access credentials are encrypted on the server; Spona does not receive your Meta password. Discovery data is held during account selection; only selected accounts are saved to the company connection. Connecting does not publish content or change advertising budgets. Automatic publishing and spend imports are separate features in development, with their own activation conditions.

## Spona AI — invoice and guide questions

When Spona AI is enabled for your workspace, OpenAI processes the question you submit to interpret an invoice request or prepare an answer from guides you may read. For invoice questions, Spona sends your question, interface language, the previous invoice topic when present, and whether a customer is selected. Customer names, invoice numbers, amounts, record identifiers and earlier question text are not automatically added. Spona retrieves the permitted Sales records and calculates the result. For guide questions, Spona searches published guidance within its own infrastructure and sends your question, language and selected guide titles, headings and excerpts to OpenAI. Company business records and earlier questions are not automatically added. Spona's answer instructions also accompany the request.

Anything you type in the question is included and is not automatically anonymised. Do not enter passwords or unnecessary personal or confidential information. Check the source records and cited guidance before acting. The assistant cannot change records or send messages. Its processing is separate from the Insights AI Summary; the Insights name-replacement process does not apply to assistant questions.

Spona keeps usage and security records linked to the company and requesting account, including request times and outcomes, provider references, model and token usage, and reserved and recorded costs. These records support service operation, usage limits and investigation of failures. The panel keeps your current draft and answer when you close it or move between screens. Clear conversation removes that panel context, not usage records or provider logs. The applicable service and customer-record retention criteria in the Privacy notice and DPA govern retained records; contact connect@spona.io for the criteria applying to your records or to request access or deletion.

Spona asks OpenAI not to save the API response for later retrieval. This does not prevent all provider retention. OpenAI states that API data is not used for model training by default unless data sharing is explicitly enabled. By default, abuse-monitoring logs may include questions and responses and be retained for up to 30 days, with applicable exceptions. Provider processing locations, international transfers and retention depend on the applicable service arrangements; neither zero retention nor EU-only processing is promised. Contact connect@spona.io for the applicable provider information and transfer safeguards.