SPONA ERP — LEGAL DOCUMENTS

2026-09-17 · 1.1

English is the governing language of the Terms to the extent permitted by law.

# Providers, retention & requests

## 1. Hosting and service providers

Hosting provider: Hetzner. Hosting location: Nuremberg, Germany. Purpose: operating the Spona website and platform infrastructure, including storage and processing needed to deliver the service. Information about Hetzner and its data-processing agreement: https://docs.hetzner.com/general/company-and-policy/data-protection-at-hetzner/. Other services, including separate email delivery, external file storage, backups and optional AI, require service-specific provider and location disclosures before use. Contact connect@spona.io for the register applicable to your service. A provider’s own certification does not certify the Spona application.

## 2. Retention and deletion

Retention depends on the record and purpose. Accounts are retained for service administration and closure; enquiry and support records for response, resolution and related claims; business and financing records for the agreement, instructions and applicable statutory obligations. Legal holds apply only to the necessary scope. Presence buckets and page-view records use a 90-day pruning window triggered by application activity; this is not a universal retention period for other records or backups. Website consent preferences last up to 180 days. For account export, closure, deletion or the applicable retention criteria, contact connect@spona.io. Customer-controlled personal data is returned or deleted according to the DPA, subject to lawful retention. Recovery copies must not reintroduce deleted records into normal processing.

## 3. Make a request

Email connect@spona.io with the subject “Privacy request”, “Data export” or “Account closure”. Include the relevant company, service and a concise description; do not send passwords, full identity documents or unrelated employee records. We may need proportionate identity and authority checks. An individual’s GDPR request and a company’s complete ERP export are different requests and may have different scopes. For records controlled by your employer or another customer, contact that organisation; the platform supports its response.

## 4. Google Analytics — not activated

Planned provider: Google Analytics 4. Purpose: consented website measurement. Status: not connected; no measurement ID supplied. Before activation, confirm the Google contracting entity, accepted data-processing terms, relevant processing countries and international-transfer safeguards, account data-sharing settings and event-data retention. The local 180-day consent/cookie setting is not the GA server-side retention period. Google information: https://policies.google.com/technologies/partner-sites and https://privacy.google.com/businesses/processorterms/. This entry discloses the selected service without claiming its contract or transfer arrangements have already been approved.