ERP1. Parties, scope and instructions
This DPA forms part of the customer’s ERP agreement for personal data processed on the customer’s instructions. The customer acts as controller, or as an authorised processor appointing the operator as subprocessor; the operator acts as processor for the covered customer records. Process only on documented instructions, including transfers, unless Union or Member State law requires otherwise; inform the customer of that requirement beforehand unless prohibited. Immediately inform the customer if an instruction appears to infringe data-protection law and suspend the affected instruction while it is resolved. Own-controller activities disclosed in the Privacy Notice are outside this DPA. Stage-specific Work access also processes intended representative emails, stage snapshots, purpose-limited credentials, mailbox verification and response/audit history on the customer’s instructions. Access durations in the Privacy notice do not replace retention instructions.
2. Processing schedule
Subject: delivery and support of selected ERP modules. Duration: the service term plus agreed retrieval and deletion periods, subject to lawful retention. Operations: collection, storage, organisation, access, calculation, transmission, export and deletion as instructed. Data subjects: customer users, employees, contractors, business contacts, clients and suppliers. Categories: identifiers and work contacts, roles, activity records, project and transaction records, salary and payment information and instructed attachments. The signed order must narrow these categories to the modules actually used and expressly identify any permitted special-category data. Financing-partner assessment is not automatically included in this processor schedule.
3. Confidentiality and security
Authorised personnel must be bound by confidentiality. The processor must implement appropriate Article 32 measures proportionate to risk, including access management, tenant isolation, protection of data in transit and at rest where appropriate, resilience, recovery and regular evaluation. Any agreed security annex identifies the measures applicable to your service. This DPA does not claim an independent certification or a specific recovery time. Security changes must not materially reduce the agreed protection.
4. Subprocessors and transfers
The customer must receive the completed subprocessor register before authorisation. Under the general-authorisation mechanism, give at least 30 days’ advance notice of additions or replacements and allow reasoned data-protection objections. Resolve an objection through reasonable alternatives or permit termination of the affected service before the provider begins processing. Each subprocessor must accept materially equivalent data-protection duties; the operator remains responsible for its performance. No international transfer may occur without applicable Chapter V safeguards and documented instructions. The provider register identifies approved hosting; additional providers require disclosure and authorisation under this clause.
5. Rights, incidents and regulatory assistance
Taking account of the nature of processing, assist the customer with data-subject requests, security duties, breach assessment, DPIAs and prior consultation. Forward requests without answering for the customer unless authorised or legally required. Notify the customer without undue delay after becoming aware of a personal-data breach, with available facts about its nature, affected categories and approximate numbers, contact, likely consequences and mitigation; supplement information as it becomes available. The controller determines its own notification duties, including the GDPR 72-hour authority deadline where applicable. Assistance arrangements must not prevent statutory compliance.
6. Demonstrating compliance
Make available the information necessary to demonstrate compliance and allow and contribute to audits, including inspections, by the customer or its mandated auditor. Reasonable confidentiality, scheduling and security arrangements may protect other customers and systems but must not defeat Article 28 audit rights or regulatory access. Maintain the required processing records and evidence of instructions, provider approvals, incidents and deletion. The customer remains responsible for its lawful purposes, notices, minimisation and employee-monitoring assessment.
7. Return, deletion and further use
At the customer’s choice, return or delete covered personal data after the service ends and delete remaining copies unless applicable law requires storage. Agree export and retrieval periods before closure. Legally retained copies must be isolated and used only for that obligation. The final annex must define backup expiry and restoration controls so deleted records are not returned to active use. Processing to create anonymous datasets requires documented customer instructions and the customer’s lawful authority; this DPA does not permit independent reuse of personal data for advertising or general AI training. Genuine anonymous outputs may be used only within the Terms’ confidentiality and re-identification safeguards.
8. Reporting boundaries and analytics
Reports generated for the customer from its ERP records remain within the documented service instructions and applicable access controls. This DPA does not authorise the operator to repurpose employee, client, payroll or financing content for its own unrestricted analytics, advertising or model training. Any separate controller purpose requires an identified lawful basis, transparent information and safeguards before processing; the operator must not rely on the customer’s contract as blanket consent for individuals. Optional browser events are governed by the separately described consent controls. Random identifiers remain protected where individuals are identifiable. Analytics copies, derived personal data and links must be included in applicable rights, deletion, hold and backup procedures; aggregation alone does not remove these obligations.
9. CRM processing instructions
For enabled CRM functionality, the processing schedule also covers prospect and business contacts, their company relationships, enquiry messages, opportunity and proposal details, activity notes, private attachments, team assignments and review history. Processing consists of customer-directed recording, organisation, retrieval, internal sharing under permissions, notification, import, export and record review. The customer determines the lawful purpose, required contact notices and appropriate retention criteria. Company-configured data review intervals schedule a review, not automatic deletion. Decisions to keep a record store the reviewer, date, record revision and reason. Archiving and merging preserve associated history and are not erasure. Permanent deletion and service closure follow the return/deletion procedure above, taking account of linked records, documented instructions and any necessary legal retention. When the Forecast & sales performance add-on is enabled, this also includes company-configured stage probabilities, personal monthly targets and personal saved forecast snapshots. Estimates are calculated from existing CRM records and do not make decisions about contacts. Saved snapshots retain the original estimate; their display and export are limited by current record permissions. Their creator can delete them. The same company-directed retention and service-closure procedures apply. The optional Tenders add-on records bid decisions and reasons, requirements and their completion, deadlines, results and assigned guarantee follow-ups linked to existing opportunities. Access follows the opportunity team and separate add-on rights; the service does not submit bids or obtain guarantees. These records and their history follow the same company-directed retention and service-closure procedures. The optional Renewals & account development add-on records renewal dates, manually assessed relationship health and reasons, recurring internal follow-up plans, generated task references and explicit expansion opportunities. Plans use current member permissions and do not renew contracts, send client emails or make automated decisions about clients. The same company-directed retention and service-closure procedures apply to these records and their history. The optional Advanced pipelines add-on records customer-configured sales processes, typed opportunity fields, stage requirements and internal approval requests with reviewer, reason and revision history. Transfers preserve previous additional field values in a permission-controlled history. These workflow controls do not make financial or legal decisions and follow the same company-directed retention and service-closure procedures. No general permission for marketing, mailbox access or AI training follows from enabling CRM.
10. Marketing integration instructions
For customer-controlled Marketing records, the company determines the purposes and permitted users. A member with connection-management permission instructs Spona to obtain Meta account information for the selected connection purpose and save the selected accounts for that company. Reporting and publishing authorisations are separate. No People, payroll, CRM or financing records are sent to Meta by this connection flow. The company must hold the necessary authority over connected accounts and may request removal of an existing test connection at [email protected]. The provider’s own services and processing remain subject to its applicable terms.
Insights AI Summary — optional paid processing
When activated for a paid month, the optional Insights AI Summary sends the requesting member’s current, permitted findings and figures to the OpenAI API to draft a short summary. Names are replaced with placeholders before transmission and restored by Spona; this is pseudonymisation, not a guarantee of anonymity. Raw documents, attachments and the name key are not sent. Spona stores the resulting summary and token usage with the company, member, language and findings fingerprint. Payment references and monthly usage are recorded to administer the paid allowance. Saved summaries follow the customer-record retention and deletion process in the DPA. AI output can be inaccurate and must be checked against source records. The provider request disables response storage (store=false); OpenAI states API data is not used for training by default, while abuse-monitoring logs may be retained for up to 30 days, subject to applicable exceptions. This does not promise zero retention or EU-only processing. The operator must confirm the actual account’s processing arrangements, transfers and safeguards before customer activation under the DPA.
Spona AI — questions and optional financial explanations
When the relevant Spona AI feature is enabled for your workspace, OpenAI processes questions you choose to submit about invoices, permitted guides, procurement comparisons, cash timing, selected Work stage costs or Sales and Work planning. For invoice questions, Spona sends your question, interface language, the previous invoice topic when present, and whether a customer is selected. Customer names, invoice numbers, amounts, record identifiers and earlier question text are not automatically added. Spona retrieves the permitted Sales records and calculates the result. For guide questions, Spona searches published guidance within its own infrastructure and sends your question, language and selected guide titles, headings and excerpts to OpenAI. Company business records and earlier questions are not automatically added. Spona's answer instructions also accompany the request. Where available, GPT explanations of procurement comparisons and cash timing are optional. Spona first shows the question, language and exact summary facts that would be sent. Nothing is sent to OpenAI to prepare this preview; sending starts only when you choose Send to GPT. Procurement facts can include recorded prices, quantities, comparison periods, counts and calculated differences from your company's own accepted-order history. Cash facts can include the plan period, missing-evidence counts, projected balances and dates, the payment-history comparison and, if selected, the receipt amount, dates and calculated effects of your temporary scenario. These are financial data. Company, customer and supplier names, invoice numbers, record identifiers, complete invoice lists, source documents and the full cash curve are not automatically added. Spona calculates the figures; the explanation does not change records or save the scenario. A calculation or scenario does not guarantee a future outcome. Earlier questions and answers are not included in these requests. Where available, optional Work cost explanations use the currently selected stage. Spona shows your question and exact stage facts in your chosen language before you choose Send to GPT; preparing the preview sends nothing to OpenAI. Facts can include original EUR stage values, recorded costs, reviewed remaining commitments and additional estimates, expected cost, budget differences, indicative margin, review date, coverage and overhead settings. Aggregate recorded costs may include invoice, purchasing or payroll allocations. These financial data are not guaranteed anonymous. Names, record identifiers, individual invoice or payroll details, detailed purchase lines, notes, source documents, full records and history are not automatically added. Spona calculates the figures; GPT explains the supplied stage evidence without changing records, calculating a new hypothetical scenario or guaranteeing final company profit. Earlier questions and answers are not included in Work requests. Where available, optional Sales and Work planning explanations use the source you selected. Spona shows the exact question, language and summary facts before you choose Send to GPT. Preparing a plan, temporary target comparison or preview makes no OpenAI request. Sales facts can include the selected months, scope and currency, recorded won and open deal totals, manually weighted pipeline values, missing-data counts and, if you compared a target, that temporary target and the supported calculated difference. Manual weights are recorded assumptions, not guaranteed chances of winning. Work facts can include the selected months, planning date, original EUR stage values before VAT, scheduled values, counts and values requiring date review and, if you compared a target, that temporary scheduled-value target and its calculated difference or surplus. Work values describe recorded plans, not agreed contracts, remaining effort, revenue, cash or capacity. These are financial data and are not guaranteed anonymous. Names, record identifiers, individual deal or stage rows, full lists, private costs, source documents and earlier questions or answers are not automatically added. Sales and Work facts are kept separate. Spona calculates the figures; GPT explains the reviewed evidence and possible read-only next steps without changing records, saving targets or guaranteeing future outcomes. Anything you type in the question is included and is not automatically anonymised. Do not enter passwords or unnecessary personal or confidential information. Check the source records and cited guidance before acting. The assistant cannot change records or send messages. Its processing is separate from the Insights AI Summary; the Insights name-replacement process does not apply to assistant questions. Spona keeps usage and security records linked to the company and requesting account, including request times and outcomes, provider references, model and token usage, and reserved and recorded costs. These records support service operation, usage limits and investigation of failures. Invoice and guide modes can keep the current draft and answer when you close the panel or move between screens. Closing the panel clears the optional procurement-comparison question and answer, and the cash view including its temporary scenario and question. Changing the selected comparison, cash assumption, company, language or access can also clear the affected context. Closing the panel also clears the Work question, preview and explanation. Refreshing or opening stage evidence, navigating away, or changing the stage, company, language, session or access clears that temporary Work context. If source evidence changes, a new preview is required before further use. Closing or leaving the planning view, refreshing, opening source evidence or changing the company, language, session or access also discards the temporary planning question, preview and answer. Editing its source, months, scope, currency, target or question invalidates the affected preview and answer. A fresh preview is required for changed planning evidence. Clear conversation removes panel context, not usage records or provider logs. The applicable service and customer-record retention criteria in the Privacy notice and DPA govern retained records; contact [email protected] for the criteria applying to your records or to request access or deletion. Spona asks OpenAI not to save the API response for later retrieval. This does not prevent all provider retention. OpenAI states that API data is not used for model training by default unless data sharing is explicitly enabled. By default, abuse-monitoring logs may include questions and responses and be retained for up to 30 days, with applicable exceptions. Provider processing locations, international transfers and retention depend on the applicable service arrangements; neither zero retention nor EU-only processing is promised. Contact [email protected] for the applicable provider information and transfer safeguards.
People record corrections and private history
When People is used, authorised managers may record employment decisions and corrections with the previous and resulting terms, reason, actor and time, and correct document expiry metadata while retaining the original file. These history entries and their private reasons are available only to currently authorised People managers. The private reasons and history entries are not included in the company-readable audit, employee portal or AI context. Capacity is limited to 200 employment events per employee and 100 metadata events per document; further changes needing history are refused at capacity, rather than evicting older events. These are capacity limits, not legal retention periods. There is no automatic age-based purge or reconstruction of earlier changes. The customer determines lawful purposes, access requests and retention/deletion instructions, including applicable statutory retention and legal holds, under the existing service and data-processing procedures. A filtered personnel-document CSV is an explicit action requiring separate inventory-export authority; it contains metadata, not file contents or authenticated links. These tools do not make employment, pay or account-access decisions automatically.
Marketing copy versions and selected handoffs
When Marketing is used, new content and edits can retain the exact title and copy with the captured revision, account and time for comparison by members who currently have access to that company’s Marketing content. Existing earlier wording is not reconstructed. At most 200 copy snapshots per content item and 200 saved date-shift operations per campaign are accepted; at capacity, further changes needing a new entry are refused instead of evicting older entries. These are capacity limits, not legal retention periods, and there is no automatic age-based purge. These private copy snapshots do not enter the company-readable audit, AI context or the general company export. An authorised export user may explicitly download one current content item with selected permitted files and a manifest; it does not publish externally or include unrelated company records. An optional campaign coordinator is a current colleague reference, separate from creator ownership, and does not grant access. Existing customer instructions, access/deletion procedures, applicable legal holds and the DPA govern retention and use. No new provider or automated decision is introduced.
Private Sales evidence and period review
When Sales is used, authorised company members may attach optional supporting documents to the exact offer revision they reviewed and retain private decisions about individual billing periods, with the reason, actor, time and reversal history. Supporting files may contain personal or commercial information supplied by the customer. File access requires current record and download authority; removing an association excludes it from ordinary use while retaining the original and its provenance under the existing customer-record retention, deletion and legal-hold procedures. An archive flag affects only the company-private Sales client relationship, preserving existing business documents. Neither an uploaded file nor an internal no-invoice decision constitutes a customer signature, agreement amendment, receivable waiver, statutory invoicing exemption or financing approval. The customer remains responsible for lawful instructions and actual invoicing obligations. There is no new external provider or automatic send, and these private file contents and decision reasons are not added to AI context. Existing customer-directed retention and rights procedures apply; product capacity limits are not legal retention periods.
Private content recipes, file collections and internal review
When a company enables Content Studio, it can store company-private content recipes and exact asset-collection membership, with names, reusable words, selected file references, optional campaign/collection references and retained prior versions. Files are referenced, not copied into a new public store. Up to 200 previous versions per entry are accepted; at capacity, changes are refused without evicting history. Retirement preserves existing business records and is not erasure. Optional internal review requests retain the selected colleague, review deadline and submitted content revision; assignment/submission history preserves those saved facts. These records follow the existing customer-controlled business-record purpose, documented instructions, access/deletion procedures and applicable legal holds. The company archive includes Studio records only under current activation and separate view/export permissions. New drafts retain their recipe source identifier/revision for provenance. The local campaign-link builder only formats a URL; it does not send a request, enable a tracker, measure conversions or introduce a provider. No new legal retention period, advertising permission or automated decision is created.
Private Purchasing preparation and history
When Purchasing is used, authorised company members may retire and restore unused drafts, prepare a new draft from selected commercial items, correct a need-by plan, and review future commercial changes. Reasons, actor identity, time and before/after business fields are retained with the company record; earlier changes are not reconstructed. Delivery request identifiers and payload fingerprints prevent duplicate recording and are retained with the delivery event. A corrected receipt may identify its reversed original; the original, reversal and their evidence remain distinct. These records are private to currently authorised company users and do not introduce a signature, supplier agreement amendment, payment or financing decision. Copies do not inherit approvals, credentials or operational and financial relations. Existing customer instructions, access and deletion procedures, legal holds and DPA retention rules apply. There is no automatic age-based purge, new provider or new AI processing purpose. Private history reasons and original evidence are not added to AI context.
Version-bound approvals, client snapshots and campaign associations
When Advanced Workflows & Client Approvals is enabled, the company may retain version-bound reviewer feedback, ordered internal approval policies and decisions, and client-review invitations with the chosen recipient address, expiry, revocation, exact content/file snapshot and recorded responses. The recipient must use a verified Spona account matching the invited address. The invitation does not grant company membership or access to live content, internal discussions or unrelated records. Later content edits do not rewrite the snapshot. Invitation expiry, revocation and current source authority control further review access; they do not erase retained business history. The company decides what it is authorized to share and deliberately copies the scoped review link; this workflow does not automatically send email. When Campaign Intelligence is enabled, optional metric targets and explicit associations to permitted internal CRM opportunities use the existing customer-directed business-record purpose. Manual lifetime metrics are not provider analytics, causal attribution or proof of received revenue. These records and their audit/export history follow the existing documented customer instructions, access, retention, deletion and legal-hold procedures. No new provider, tracker, fee, legal retention period or automated decision is introduced.
Private handover history, recovery and document replacement
When these People features are released and enabled, authorised managers can keep prospective checklist changes with previous and resulting task wording, descriptive owner, dates, completion state, actor and time. Removing a task hides it from active work and employee progress while retaining its record for permitted restoration and history review. Deadline changes also retain private evidence. Up to 200 events are retained per task; further evidence-requiring changes are refused at capacity. Replacing an employee document creates a new file and records its relationship to the retained original. Withdrawing a mistaken replacement link records the reason and retains both files and history. Each document has a limit of 100 replacement events. These capacities are not legal retention periods. Actor- and company-bound submission receipts contain request fingerprints and resulting record references to prevent duplicate accepted additions, copies, date shifts and uploads; fingerprints are not anonymous data. Private histories and reasons are excluded from shared company Activity, the employee portal and AI context. Employees with current portal and document access may see their own permitted current and earlier files and replacement references. The customer determines the lawful purpose, authorised access and retention/deletion instructions under the existing DPA and rights-request process, including retained removed records, original files, relationships and receipts. Ordinary deletion cannot bypass retained evidence. No automatic age-based purge, new provider, employee scoring or automatic employment decision is introduced.
Delivery evidence, receipt links and discrepancies
When Delivery notes is enabled, the company can retain captured issuer and customer names, delivered item quantities, optional carrier notes, exact offer-line references, private supporting files and their saved revision, and operational recovery receipts. A recipient using a confirmation link can enter a name and report a discrepancy; the company can retain the response, date, revision and private review note. An entered name is a recipient claim, not independently verified identity. A discrepancy does not confirm receipt or change delivered quantities. Anyone holding an active confirmation link can read its quantity-only delivery summary and submit the supported recipient action. Private files and company review notes are not exposed by that link. The company can explicitly revoke or replace link access; disabling the add-on alone does not withdraw previously issued delivery links. Link changes do not erase existing receipt, response, revision or audit evidence. Current company and action permissions control private access and downloads. Removal of a file association excludes it from ordinary use while retaining original bytes and provenance under the existing customer-directed retention, rights and deletion procedures. The customer determines lawful purposes, required recipient notices and applicable recordkeeping instructions. Capacity limits and abuse controls do not set legal retention periods. This workflow adds no external provider or automatic external sending, makes no financial transaction and adds no private files or discrepancy text to AI context.