ERP1. Scope and responsibility
This notice covers the Spona website, business accounts, enquiries, support and optional financing requests. Top Digital Agency Limited, company number 642562, VAT ID IE3613706OH, 6B Raven Terrace, Galway, H91 H24H, Ireland, provides the ERP. Top Digital d.o.o., MBS 081170998, OIB 72317551155, VAT ID HR72317551155, Vladimira Nazora 23, 49210 Zabok, Croatia, administers financing. For privacy enquiries and rights requests, contact [email protected] and identify the service concerned. This address is the privacy contact, not a claim that a statutory Data Protection Officer has been appointed.
2. Two different roles
For managing its business relationships, account security and its own enquiries, the operator acts as a controller. For personal data a customer places in Work, People, Salaries, Purchasing, Sales or Finance, the customer generally decides the purposes and acts as controller; the operator processes those records on documented instructions under the Data Processing Agreement. A customer acting for another controller must obtain the necessary authority. Financing participants may act as separate controllers for their own assessment and legal obligations; their notices must identify those activities.
3. Data and its sources
Data may include names, work email addresses, company identifiers, account roles, authentication records, enquiries and support messages. Customer-controlled ERP records may include employees, salary amounts, clients, suppliers, project assignments, milestones, orders, invoices and attachments. Financing requests may add identification and contact information, transaction documents, requested amounts and terms, acknowledgements and application status. Sources are you, your organisation and its authorised users, counterparties and documents you supply. When article feedback is available in Help, submitting it records your helpful/not-yet choice and the article version. A company- and article-version-specific pseudonymous key prevents duplicate responses; authorised editors see counts, not reader names. You can change or remove your response while you have access to that published version, or contact [email protected] about a retained response. This explicit feedback is used to improve Help and is separate from optional browser analytics; it is not used for employee ranking or financing decisions. Contacting Support from a guide shares the question you enter and, if you choose to include it, the guide title, reference and version shown before sending. It does not automatically capture business records or page contents. These records follow the support-purpose retention criteria below; the key is not a general-purpose tracking identifier. Where data comes from another source, the responsible controller must provide the required indirect-collection information, subject to lawful exceptions. When counterparty financing invitations are enabled, the inviting company supplies the recipient’s email address. Before an invitation link is created, its authorised user must confirm that the recipient agreed to that specific invitation and that evidence can be provided. We record the confirming account and company, recipient address, source invoice reference, time, language and wording version to administer the invitation and handle related queries or disputes. This records the sender’s statement; it is not independent proof of the recipient’s consent, a marketing subscription or permission to act for the recipient’s company. The sender must retain the actual agreement and stop sharing or sending after withdrawal. Contact [email protected] to object, report an unexpected invitation, or request access, correction or deletion. These records follow the applicable service, enquiry and claims retention criteria below; revoking an invitation does not automatically erase its history. This notice does not announce activation of invitations or replace the first-contact information and opt-out controls required before release. When invitation stop controls are enabled, you can use the separate stop link in the invitation email without an account, or stop invitations to your own verified account address. Opening a link alone does not change your preference. We keep a pseudonymous digest of the normalized address, the first stop time and whether the request came from the email link or account, so future financing invitations from all companies on Spona can be blocked. This digest is personal data, not anonymous data. The stop has no automatic expiry; retention and deletion requests are assessed against the need to continue honoring it and applicable legal requirements. Email stop credentials are stored only as digests and permit only this choice. An email already being dispatched may still arrive. The choice does not cancel existing applications or stop necessary account and service messages. Contact [email protected] for help or to review the preference; senders and desk users cannot override it in the product. Signatory identity checks take place when a financing contract is supplied, whether signing uses an uploaded PDF or a secure signing link. We collect the signatory’s name and clear copies of the front and back of their identity card, together with upload dates and review decisions, to verify the person signing in the financing process with Valoris Capital d.o.o. Authorised financing reviewers and company members with signing permission can access these private records. Do not upload unrelated persons’ documents. Provide both sides again one calendar year after upload, or earlier if the signatory or document changes. This is a renewal rule for verification, not the identity card’s official expiry date or an automatic deletion period. No biometric matching or automated identity decision is performed by this upload workflow. When residence-based Irish service reviews are available, customer-controlled records also contain the selected permanent address or usual residence, relevant personal and occupational ties, evidence references and dates, business and VAT status, and findings that the customer has no business or fixed establishment. Record only information needed for the transaction; do not add unrelated personal or sensitive details. Authorised company users can retain, correct and export review history; an issued document retains its original identity and tax evidence. When you review and send a website enquiry, your name, email address, optional company, message and selected conversation or financing-estimate context are delivered to [email protected] through our existing mail service. An enquiry is not a financing application. Do not include passwords, identity documents or confidential financial records. When stage-specific Work invitations are enabled, the sender supplies the intended representative’s email for one supplier assignment or client delivery confirmation. Records include sender account/company, recipient company/email, stage and commercial snapshot, purpose, issue/expiry times, mailbox verification, typed respondent name, response or question, and audit/delivery history. The named stage and explicitly shared checklist require verification of that email; unrelated stages and private costs are excluded. Questions and objections enter the corresponding business discussion. Authorised stage parties can read the invitation history; authorised financing reviewers can read provenance for the linked stage. Mailbox verification and a typed name are not independently verified identity or proof of corporate authority. Links expire after fourteen days or revocation, one-use email verification after ten minutes and verified browser access after one hour. Access credentials are stored as hashes and excluded from notification message logs. These access durations are not automatic erasure periods; the existing service and claims retention criteria apply to the business history. Contact [email protected] about unexpected invitations. Opening, verifying or responding does not apply for financing or sign a financing agreement.
3a. ERP display preferences
The ERP stores your selected navigation shortcuts and collapsed-sidebar setting only in this browser, under keys containing the signed-in account and company identifiers. The purpose is to keep your chosen workspace layout when you return. These values are not a record of pages visited, and they are not transmitted for analytics, advertising or financing assessment. The Cookies & browser storage notice explains the exact values, duration and how to clear them. Your account and company identifiers already support access to the service; this local preference does not widen your permissions.
4. Purposes and legal bases
We use necessary account and enquiry information to provide the service, respond to requests and manage the business relationship. Where you personally contract with us, this relies on contract performance or requested pre-contractual steps under Article 6(1)(b) GDPR. For corporate representatives, relationship administration and business communication rely on our legitimate interest in operating and supporting business services under Article 6(1)(f). Security, preventing misuse and establishing or defending legal claims also serve legitimate interests, subject to necessity and your rights. Processing required by a specific legal obligation relies on Article 6(1)(c). Optional tracking and marketing use separate consent where required. Customer-controlled ERP records are processed on documented instructions under the DPA; the customer establishes the basis for those records. Accepting service terms does not consent to every use of data.
5. Employee activity and sensitive records
The ERP code records authenticated activity and visited application routes, and exposes authorised team activity views. Presence buckets and page-view records have a 90-day pruning window, triggered by application activity; this is not a guarantee of deletion at exactly day 90 or a retention rule for all audit logs and backups. Employers must assess necessity, proportionality, access and employee transparency before using these features. Do not use activity alone to make employment decisions. Health, union membership and other special-category data require an Article 9 condition as well as an Article 6 basis; do not upload them unless the service scope and safeguards have been expressly agreed.
6. Recipients and hosting
Authorised personnel and contracted providers may access data where needed to deliver and support the service. Spona hosting is provided by Hetzner in Nuremberg, Germany. Hosting data may include account details, company records, uploaded files and technical logs needed for the service. Relevant transaction data may be shared with the identified financing counterparty and its authorised providers; an enquiry does not grant access to an entire ERP workspace. Professional advisers and competent authorities may receive data where lawfully required. Additional provider, backup and transfer arrangements must be disclosed for the affected service before activation. The German hosting location alone is not a statement that every external service processes data only in Germany. Transfers outside the EEA require applicable safeguards; contact [email protected] for information and copies of relevant safeguards.
6a. Measurement update — 4 October 2026
With renewed website analytics consent, Google Analytics also receives the referring website origin and predefined campaign labels, without referral paths, arbitrary URL parameters or form contents. ERP account creation has a separate, optional one-submission consent for a sign_up event, not consent for ongoing ERP tracking. The event is not linked by this integration to the website visitor identifier or an account identifier and does not establish email verification. Google receives browser and network information. The Cookie notice, sections 5, 5a and 6, explains the exact data, short-lived registration cookies, refusal and withdrawal; the Providers and retention notice describes Google processing and transfers. These optional choices do not condition access to the service. With renewed analytics consent, Google Analytics also counts enquiries accepted for email delivery, using only the form type and website language. Names, email addresses, company names, messages, financing amounts and enquiry references are excluded from that event. Acceptance for delivery is not proof that an email has reached the inbox.
7. Analytics, datasets and AI
Updated 21 September 2026: the public website uses Google Analytics 4 only after analytics consent, for allowlisted page views and registration, sign-in and contact clicks. See the Cookie notice for controls, data and cookie details. Advertising integrations remain off. When activated for a paid month, the optional Insights AI Summary sends the requesting member’s current, permitted findings and figures to the OpenAI API to draft a short summary. Names are replaced with placeholders before transmission and restored by Spona; this is pseudonymisation, not a guarantee of anonymity. Raw documents, attachments and the name key are not sent. Spona stores the resulting summary and token usage with the company, member, language and findings fingerprint. Payment references and monthly usage are recorded to administer the paid allowance. Saved summaries follow the customer-record retention and deletion process in the DPA. AI output can be inaccurate and must be checked against source records. The provider request disables response storage (store=false); OpenAI states API data is not used for training by default, while abuse-monitoring logs may be retained for up to 30 days, subject to applicable exceptions. This does not promise zero retention or EU-only processing. The operator must confirm the actual account’s processing arrangements, transfers and safeguards before customer activation under the DPA. This notice does not authorise customer personal data or confidential content to train general-purpose models, be sold or be shared across customers. Properly anonymised, non-identifying statistics may support product improvement, research and commercial benchmarks under the safeguards in the Terms and DPA; creating those statistics is itself processing that first needs authority and a lawful basis.
8. Retention and security
We retain account records while needed to administer the service and complete closure; enquiries and support records while needed to respond, resolve the matter and handle related claims; and financing and transaction records for the agreement and applicable legal recordkeeping or claims periods. Customer-controlled ERP records follow documented instructions and the DPA. Legal holds are limited to the relevant records and obligation. Backup copies are restricted to recovery and lawful retention and must not restore deleted records to ordinary use. Contact [email protected] for the period or criteria applicable to a specific record and to request deletion. Account access and file access are permission-controlled. No system is absolutely secure; no independent security certification or contractual availability percentage is claimed here. Any specific recovery or availability commitment must be separately agreed. The annual signatory-ID renewal date does not authorise indefinite storage or require automatic erasure on that date. Current and earlier copies follow the financing-record retention criteria above, including applicable legal recordkeeping and claims requirements; unnecessary copies must be reviewed for deletion under that process. Contact [email protected] for the period or criteria applying to your record. The website enquiry service keeps a random reference, message digest, IP-address digest, delivery state and timestamp for up to seven days, with hourly expiry cleanup, to prevent duplicate sends and limit abuse. It does not keep a separate database copy of the message or your contact fields. The email itself follows the enquiry retention criteria above.
9. Your choices and rights
Subject to the applicable conditions, you can request access, correction, erasure, restriction and portability, and object to processing based on legitimate interests. You can object to direct marketing at any time and withdraw consent without affecting earlier lawful processing. Contact [email protected] and identify the service and request; provide only information reasonably needed to verify identity. Requests are normally answered within one month. A lawful extension of up to two further months requires notice and reasons within the first month. For customer-controlled ERP records, contact your organisation; the operator assists it. You may complain to a supervisory authority in your habitual residence, workplace or the place of the alleged infringement, including the Data Protection Commission in Ireland and AZOP in Croatia. No prior complaint to us is required.
10. Required information and decisions
Without necessary account or transaction information, the relevant service or financing assessment may not be possible. Optional marketing permission must not be a condition of core ERP access. The reviewed financing flow contains a review process; it does not establish that every production decision is manual. Before any solely automated decision with legal or similarly significant effects is used, the responsible controller must establish a lawful basis, provide meaningful information about its logic and consequences, and implement applicable safeguards, including human intervention and challenge rights.
11. Operational reporting and optional browser analytics
We distinguish operational reporting from optional behavioural measurement. Account registration and verification, authentication and security records, business-record creation and financing workflow records are generated to operate the requested services. Relevant reports may describe those records without relying on the optional browser-analytics switch. Each use remains subject to its purpose, lawful basis, access restrictions and retention; server-side collection is not a general exemption from data-protection rules. Processing customer-controlled records remains subject to the DPA. Spona’s separate product-improvement use of personal data requires its own documented lawful basis and transparency; where legitimate interests apply, you may object by contacting [email protected]. Optional website page views and ERP module visits use separate prior consent when enabled. The native collector sends an event identifier, time, random browser identifier, consent version, language and an allowlisted page or module category. These identifiers are pseudonymous, not a guarantee of anonymity. It excludes form contents, record identifiers, messages, payroll and transaction amounts from these event payloads. Technical network information may still be processed to deliver and protect the endpoint. Authorised Spona personnel access aggregate reports; this is not permission to expose one company’s records to another. Refusing browser analytics does not prevent ERP use or a financing application. Withdrawal stops future optional collection but does not automatically delete records already received or necessary operational/security records; rights requests remain available. Heatmaps, replay and additional profiling require their own assessment and disclosure before activation. Company-level operational usage records selected completed actions by module, action type and UTC day to support clients and understand module adoption. Only daily counts and a company identifier are stored in this usage dataset; it excludes user and browser identifiers, business-record identifiers, document contents, salary amounts and message text. It is not an employee-performance measure or a financing eligibility input. Access is limited to authorised Spona staff with company-usage permissions. Counts cover 90 UTC calendar days including today, with scheduled removal of older counts; original business and security audit records follow their own retention rules. This operational reporting does not enable optional browser analytics or join its identifiers. Contact [email protected] for access, objection or deletion requests; collection can be suppressed for the company while a request is handled.
12. Planned measurement
The Data-use notice describes planned acquisition analysis, funnels, retention, journeys, heatmaps, replay, experiments and surveys, and their activation safeguards. This is advance information about the roadmap, not a statement that every feature is operating. Existing consent does not automatically extend to new tracking purposes or replay. Before introducing materially different browser storage or tracking, disclose its purpose, identifiers, duration, recipients and controls, and obtain fresh consent where required. No future feature is a condition of core ERP access merely because it appears in this notice.
13. CRM contacts and sales activity
When your company enables CRM, it can manage prospect and business contact details, company relationships, opportunities, activities and notes, enquiry submissions, proposals and private files. The company determines the purpose of these records and who may access them; Spona processes customer-controlled records under its documented instructions and the DPA. Shared ownership, assigned follow-ups and selected teammate notifications remain subject to record access. Notification messages identify the relevant record and link back to the ERP; they do not include the full activity notes. The company must provide appropriate privacy information to contacts and publish its own notice and privacy link on any enabled public enquiry form. Submitting an enquiry does not create an ERP account or subscribe a person to marketing. CRM does not by itself enable mailbox synchronisation, tracking pixels, enrichment or AI processing.
14. Marketing data
Companies control their Marketing plans, content, files, comments and collaborators. Meta connections are not currently available in the customer interface. In authorised integration testing, a company member may connect Meta accounts separately for ad reporting and social publishing. Spona receives the account and business identifiers and names returned by Meta, granted access, token expiry and the member and time of connection. Access credentials are encrypted on the server; Spona does not receive your Meta password. Discovery data is held during account selection; only selected accounts are saved to the company connection. Connecting does not publish content or change advertising budgets. Automatic publishing and spend imports are separate features in development, with their own activation conditions.
Spona AI — questions and optional financial explanations
When the relevant Spona AI feature is enabled for your workspace, OpenAI processes questions you choose to submit about invoices, permitted guides, procurement comparisons, cash timing, selected Work stage costs or Sales and Work planning. For invoice questions, Spona sends your question, interface language, the previous invoice topic when present, and whether a customer is selected. Customer names, invoice numbers, amounts, record identifiers and earlier question text are not automatically added. Spona retrieves the permitted Sales records and calculates the result. For guide questions, Spona searches published guidance within its own infrastructure and sends your question, language and selected guide titles, headings and excerpts to OpenAI. Company business records and earlier questions are not automatically added. Spona's answer instructions also accompany the request. Where available, GPT explanations of procurement comparisons and cash timing are optional. Spona first shows the question, language and exact summary facts that would be sent. Nothing is sent to OpenAI to prepare this preview; sending starts only when you choose Send to GPT. Procurement facts can include recorded prices, quantities, comparison periods, counts and calculated differences from your company's own accepted-order history. Cash facts can include the plan period, missing-evidence counts, projected balances and dates, the payment-history comparison and, if selected, the receipt amount, dates and calculated effects of your temporary scenario. These are financial data. Company, customer and supplier names, invoice numbers, record identifiers, complete invoice lists, source documents and the full cash curve are not automatically added. Spona calculates the figures; the explanation does not change records or save the scenario. A calculation or scenario does not guarantee a future outcome. Earlier questions and answers are not included in these requests. Where available, optional Work cost explanations use the currently selected stage. Spona shows your question and exact stage facts in your chosen language before you choose Send to GPT; preparing the preview sends nothing to OpenAI. Facts can include original EUR stage values, recorded costs, reviewed remaining commitments and additional estimates, expected cost, budget differences, indicative margin, review date, coverage and overhead settings. Aggregate recorded costs may include invoice, purchasing or payroll allocations. These financial data are not guaranteed anonymous. Names, record identifiers, individual invoice or payroll details, detailed purchase lines, notes, source documents, full records and history are not automatically added. Spona calculates the figures; GPT explains the supplied stage evidence without changing records, calculating a new hypothetical scenario or guaranteeing final company profit. Earlier questions and answers are not included in Work requests. Where available, optional Sales and Work planning explanations use the source you selected. Spona shows the exact question, language and summary facts before you choose Send to GPT. Preparing a plan, temporary target comparison or preview makes no OpenAI request. Sales facts can include the selected months, scope and currency, recorded won and open deal totals, manually weighted pipeline values, missing-data counts and, if you compared a target, that temporary target and the supported calculated difference. Manual weights are recorded assumptions, not guaranteed chances of winning. Work facts can include the selected months, planning date, original EUR stage values before VAT, scheduled values, counts and values requiring date review and, if you compared a target, that temporary scheduled-value target and its calculated difference or surplus. Work values describe recorded plans, not agreed contracts, remaining effort, revenue, cash or capacity. These are financial data and are not guaranteed anonymous. Names, record identifiers, individual deal or stage rows, full lists, private costs, source documents and earlier questions or answers are not automatically added. Sales and Work facts are kept separate. Spona calculates the figures; GPT explains the reviewed evidence and possible read-only next steps without changing records, saving targets or guaranteeing future outcomes. Anything you type in the question is included and is not automatically anonymised. Do not enter passwords or unnecessary personal or confidential information. Check the source records and cited guidance before acting. The assistant cannot change records or send messages. Its processing is separate from the Insights AI Summary; the Insights name-replacement process does not apply to assistant questions. Spona keeps usage and security records linked to the company and requesting account, including request times and outcomes, provider references, model and token usage, and reserved and recorded costs. These records support service operation, usage limits and investigation of failures. Invoice and guide modes can keep the current draft and answer when you close the panel or move between screens. Closing the panel clears the optional procurement-comparison question and answer, and the cash view including its temporary scenario and question. Changing the selected comparison, cash assumption, company, language or access can also clear the affected context. Closing the panel also clears the Work question, preview and explanation. Refreshing or opening stage evidence, navigating away, or changing the stage, company, language, session or access clears that temporary Work context. If source evidence changes, a new preview is required before further use. Closing or leaving the planning view, refreshing, opening source evidence or changing the company, language, session or access also discards the temporary planning question, preview and answer. Editing its source, months, scope, currency, target or question invalidates the affected preview and answer. A fresh preview is required for changed planning evidence. Clear conversation removes panel context, not usage records or provider logs. The applicable service and customer-record retention criteria in the Privacy notice and DPA govern retained records; contact [email protected] for the criteria applying to your records or to request access or deletion. Spona asks OpenAI not to save the API response for later retrieval. This does not prevent all provider retention. OpenAI states that API data is not used for model training by default unless data sharing is explicitly enabled. By default, abuse-monitoring logs may include questions and responses and be retained for up to 30 days, with applicable exceptions. Provider processing locations, international transfers and retention depend on the applicable service arrangements; neither zero retention nor EU-only processing is promised. Contact [email protected] for the applicable provider information and transfer safeguards.
Experience feedback
If you choose Send feedback in Help shape Spona, we receive your rating, selected topics, module or area, an allowlisted page category, interface language, optional comment and submission time. Website feedback is not linked to an ERP account. Feedback sent from a signed-in ERP workspace is linked to that account and company, as stated before submission. Please do not include passwords, personal documents or unnecessary personal or confidential information. Comments are not automatically anonymised. Authorised Spona support staff review responses and their status history to improve usability and service quality. Summary reports count submitted responses, not unique people or all customers. This feedback is not used to assess employees or financing eligibility and is not sent by this feature to Google Analytics, OpenAI or another analytics provider. Existing hosting and security processing still apply, including short-lived abuse controls using hashed identifiers. The enquiry and support retention criteria and rights-request procedure in this notice apply. Contact [email protected] for the criteria applying to your response or an access or deletion request. Sending feedback does not open a support case or promise a reply; use Help & support if you need assistance.
People record corrections and private history
When People is used, authorised managers may record employment decisions and corrections with the previous and resulting terms, reason, actor and time, and correct document expiry metadata while retaining the original file. These history entries and their private reasons are available only to currently authorised People managers. The private reasons and history entries are not included in the company-readable audit, employee portal or AI context. Capacity is limited to 200 employment events per employee and 100 metadata events per document; further changes needing history are refused at capacity, rather than evicting older events. These are capacity limits, not legal retention periods. There is no automatic age-based purge or reconstruction of earlier changes. The customer determines lawful purposes, access requests and retention/deletion instructions, including applicable statutory retention and legal holds, under the existing service and data-processing procedures. A filtered personnel-document CSV is an explicit action requiring separate inventory-export authority; it contains metadata, not file contents or authenticated links. These tools do not make employment, pay or account-access decisions automatically.
Marketing copy versions and selected handoffs
When Marketing is used, new content and edits can retain the exact title and copy with the captured revision, account and time for comparison by members who currently have access to that company’s Marketing content. Existing earlier wording is not reconstructed. At most 200 copy snapshots per content item and 200 saved date-shift operations per campaign are accepted; at capacity, further changes needing a new entry are refused instead of evicting older entries. These are capacity limits, not legal retention periods, and there is no automatic age-based purge. These private copy snapshots do not enter the company-readable audit, AI context or the general company export. An authorised export user may explicitly download one current content item with selected permitted files and a manifest; it does not publish externally or include unrelated company records. An optional campaign coordinator is a current colleague reference, separate from creator ownership, and does not grant access. Existing customer instructions, access/deletion procedures, applicable legal holds and the DPA govern retention and use. No new provider or automated decision is introduced.
Private Sales evidence and period review
When Sales is used, authorised company members may attach optional supporting documents to the exact offer revision they reviewed and retain private decisions about individual billing periods, with the reason, actor, time and reversal history. Supporting files may contain personal or commercial information supplied by the customer. File access requires current record and download authority; removing an association excludes it from ordinary use while retaining the original and its provenance under the existing customer-record retention, deletion and legal-hold procedures. An archive flag affects only the company-private Sales client relationship, preserving existing business documents. Neither an uploaded file nor an internal no-invoice decision constitutes a customer signature, agreement amendment, receivable waiver, statutory invoicing exemption or financing approval. The customer remains responsible for lawful instructions and actual invoicing obligations. There is no new external provider or automatic send, and these private file contents and decision reasons are not added to AI context. Existing customer-directed retention and rights procedures apply; product capacity limits are not legal retention periods.
Private content recipes, file collections and internal review
When a company enables Content Studio, it can store company-private content recipes and exact asset-collection membership, with names, reusable words, selected file references, optional campaign/collection references and retained prior versions. Files are referenced, not copied into a new public store. Up to 200 previous versions per entry are accepted; at capacity, changes are refused without evicting history. Retirement preserves existing business records and is not erasure. Optional internal review requests retain the selected colleague, review deadline and submitted content revision; assignment/submission history preserves those saved facts. These records follow the existing customer-controlled business-record purpose, documented instructions, access/deletion procedures and applicable legal holds. The company archive includes Studio records only under current activation and separate view/export permissions. New drafts retain their recipe source identifier/revision for provenance. The local campaign-link builder only formats a URL; it does not send a request, enable a tracker, measure conversions or introduce a provider. No new legal retention period, advertising permission or automated decision is created.
Private Purchasing preparation and history
When Purchasing is used, authorised company members may retire and restore unused drafts, prepare a new draft from selected commercial items, correct a need-by plan, and review future commercial changes. Reasons, actor identity, time and before/after business fields are retained with the company record; earlier changes are not reconstructed. Delivery request identifiers and payload fingerprints prevent duplicate recording and are retained with the delivery event. A corrected receipt may identify its reversed original; the original, reversal and their evidence remain distinct. These records are private to currently authorised company users and do not introduce a signature, supplier agreement amendment, payment or financing decision. Copies do not inherit approvals, credentials or operational and financial relations. Existing customer instructions, access and deletion procedures, legal holds and DPA retention rules apply. There is no automatic age-based purge, new provider or new AI processing purpose. Private history reasons and original evidence are not added to AI context.
Version-bound approvals, client snapshots and campaign associations
When Advanced Workflows & Client Approvals is enabled, the company may retain version-bound reviewer feedback, ordered internal approval policies and decisions, and client-review invitations with the chosen recipient address, expiry, revocation, exact content/file snapshot and recorded responses. The recipient must use a verified Spona account matching the invited address. The invitation does not grant company membership or access to live content, internal discussions or unrelated records. Later content edits do not rewrite the snapshot. Invitation expiry, revocation and current source authority control further review access; they do not erase retained business history. The company decides what it is authorized to share and deliberately copies the scoped review link; this workflow does not automatically send email. When Campaign Intelligence is enabled, optional metric targets and explicit associations to permitted internal CRM opportunities use the existing customer-directed business-record purpose. Manual lifetime metrics are not provider analytics, causal attribution or proof of received revenue. These records and their audit/export history follow the existing documented customer instructions, access, retention, deletion and legal-hold procedures. No new provider, tracker, fee, legal retention period or automated decision is introduced.
Private handover history, recovery and document replacement
When these People features are released and enabled, authorised managers can keep prospective checklist changes with previous and resulting task wording, descriptive owner, dates, completion state, actor and time. Removing a task hides it from active work and employee progress while retaining its record for permitted restoration and history review. Deadline changes also retain private evidence. Up to 200 events are retained per task; further evidence-requiring changes are refused at capacity. Replacing an employee document creates a new file and records its relationship to the retained original. Withdrawing a mistaken replacement link records the reason and retains both files and history. Each document has a limit of 100 replacement events. These capacities are not legal retention periods. Actor- and company-bound submission receipts contain request fingerprints and resulting record references to prevent duplicate accepted additions, copies, date shifts and uploads; fingerprints are not anonymous data. Private histories and reasons are excluded from shared company Activity, the employee portal and AI context. Employees with current portal and document access may see their own permitted current and earlier files and replacement references. The customer determines the lawful purpose, authorised access and retention/deletion instructions under the existing DPA and rights-request process, including retained removed records, original files, relationships and receipts. Ordinary deletion cannot bypass retained evidence. No automatic age-based purge, new provider, employee scoring or automatic employment decision is introduced.
Optional registration source measurement
With fresh website analytics consent, Spona keeps only approved source, medium and campaign labels in first-party sessionStorage under spona.website.acquisition for up to 30 minutes since the last consented page visit. This preserves a coarse source through website navigation. A registration click carries these labels in the ERP link; it carries no visitor identifier, click identifier, original referral URL, search query or account data. Only a separate, current ERP analytics choice (spona-erp-cookies-v3) allows the labels to accompany the successful-registration event in the isolated Google frame. Both the ERP and frame validate the approved labels independently. The Google campaign configuration uses those labels; absent or rejected labels are marked unknown. It does not recover earlier unattributed registrations or join website and ERP visitor identifiers. Labels are not saved against a customer account, and operational company reports are not attributed to Google visits. Website withdrawal removes its source storage and decorated links; ERP refusal or withdrawal prevents the registration event. Earlier ERP refusals remain effective, while earlier grants require a new choice for this expanded measurement. Browser restrictions can prevent delivery. Existing Google processing, network information and cookie disclosures continue to apply.
Delivery evidence, receipt links and discrepancies
When Delivery notes is enabled, the company can retain captured issuer and customer names, delivered item quantities, optional carrier notes, exact offer-line references, private supporting files and their saved revision, and operational recovery receipts. A recipient using a confirmation link can enter a name and report a discrepancy; the company can retain the response, date, revision and private review note. An entered name is a recipient claim, not independently verified identity. A discrepancy does not confirm receipt or change delivered quantities. Anyone holding an active confirmation link can read its quantity-only delivery summary and submit the supported recipient action. Private files and company review notes are not exposed by that link. The company can explicitly revoke or replace link access; disabling the add-on alone does not withdraw previously issued delivery links. Link changes do not erase existing receipt, response, revision or audit evidence. Current company and action permissions control private access and downloads. Removal of a file association excludes it from ordinary use while retaining original bytes and provenance under the existing customer-directed retention, rights and deletion procedures. The customer determines lawful purposes, required recipient notices and applicable recordkeeping instructions. Capacity limits and abuse controls do not set legal retention periods. This workflow adds no external provider or automatic external sending, makes no financial transaction and adds no private files or discrepancy text to AI context.