ERP1. Intended scope and activation
Spona intends to develop product analytics, anonymised benchmarks, AI training and evaluation, marketing and financing-partner collaboration. These are distinct purposes, not an unlimited data licence. This notice defines conditions for future activation; it does not state that all these uses currently operate. Each programme needs an identified controller, data categories, legal basis, recipients, duration and safeguards before it starts. The customer may authorise use of content it owns but cannot consent on behalf of employees, contacts or other individuals without lawful authority.
2. Product analytics and research
Use the minimum events and attributes needed to understand feature adoption, reliability and user experience. Where legitimate interests are proposed, document the specific benefit, necessity, less intrusive alternatives, reasonable expectations and balancing of individual rights; provide the applicable objection route. Obtain prior consent for non-essential browser access where required even if subsequent processing has another GDPR basis. Research is not a universal exemption. Cross-module linkage, employee-level analysis and new purposes require a fresh assessment and updated information before use.
3. Anonymous benchmarks and commercial datasets
Spona may retain, combine, license and publish genuinely anonymous statistics for research, product development and commercial benchmarking within the Terms’ safeguards. The process must remove reasonably foreseeable identification, linkage and reconstruction risks and protect confidential business information. Approve dataset provenance, permissions, cohort thresholds, outlier treatment and release tests before distribution; do not invent a numeric threshold as a guarantee of anonymity. Retest when datasets are combined or external information changes. Raw customer records and pseudonymous identifiers are not anonymous commercial outputs.
4. AI training and evaluation programmes
AI inference, model evaluation and model training must be distinguished. For a separately approved training programme, a signed schedule must identify the model and provider, training purpose, data scope and sources, intellectual-property permission, lawful basis, retention, recipients, transfers, opt-out or withdrawal process where applicable and how rights can be honoured in datasets and models. Use genuinely anonymous or synthetic inputs where feasible. Do not include payroll, identity documents, special-category records or confidential customer content by default. Consent, where relied on, must be specific and freely given, with no loss of core ERP access for refusal. A legitimate-interest route requires a documented case-specific assessment; these terms do not predetermine the outcome. No training permission is activated by a general terms checkbox.
5. Marketing and financing collaboration
Service messages needed to operate an account are separate from promotional messages. Marketing programmes must identify channels and recipients and comply with applicable electronic-marketing rules, including consent where required and a simple, free unsubscribe. Do not enrich marketing audiences with customer-controlled employee, salary or client records under the ERP processing licence. Financing disclosures must be limited to relevant application and transaction data and the disclosed recipient’s purpose; a partner’s independent marketing requires its own lawful arrangement. Consent choices must be granular and recorded by purpose and version, and changes must reach downstream recipients where required.