How we collect, use, share and protect your personal data — and the rights you hold under the GDPR, the CCPA, and Croatian data-protection law.
Top Digital Agency Limited (Ireland) and Top Digital d.o.o. (Croatia) (together, “Company,” “we,” “us,” or “our”), operators of spona-performance.com, are committed to protecting your privacy and handling your personal data with care and transparency. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the rights you have in relation to it.
This Policy applies to personal data we process about clients, prospective clients, website visitors, and the representatives of the businesses we work with. It should be read together with our Terms & Conditions.
Your personal data is controlled jointly by the two entities set out below. Each is responsible for the processing carried out in its jurisdiction.
Top Digital Agency LimitedFor any questions about this Policy or your personal data, contact us at office@spona.io.
We collect personal data you give us directly, including:
When you visit our website, we may automatically collect technical data such as your IP address, browser type and version, device information, pages viewed, and the dates and times of your visits, using cookies and similar technologies.
We may receive personal data from the Applicable Platforms (such as Meta, Google, TikTok, Snapchat, Reddit, Bing, and Twitter), from analytics providers, and from publicly available sources, in each case in connection with the advertising services we provide to you.
We process your personal data on the following legal bases under the GDPR:
To set up and manage advertising accounts, plan and buy media, provide consulting and support, and communicate with you about your campaigns. Legal basis: performance of a contract (Article 6(1)(b)).
To meet our obligations under applicable laws, including anti-money laundering, sanctions, tax, and accounting requirements, and to carry out identity and eligibility verification. Legal basis: legal obligation (Article 6(1)(c)).
To operate, improve, and secure our services and website, to prevent fraud and misuse, and to pursue or defend legal claims. Legal basis: legitimate interests (Article 6(1)(f)).
To send you information about our services where you have requested it or where we are otherwise permitted to do so. You can opt out at any time. Legal basis: consent (Article 6(1)(a)) or legitimate interests (Article 6(1)(f)).
For any other purpose we tell you about at the time, where we rely on your consent. Legal basis: consent (Article 6(1)(a)).
We share the data necessary to set up and operate your advertising accounts with the relevant Applicable Platforms, which process it in accordance with their own terms and privacy policies.
We share data with trusted third parties who provide services to us — such as hosting, analytics, payment processing, and professional advisers — who process personal data on our behalf under appropriate contractual safeguards.
We may disclose personal data where required to comply with a legal obligation, a court order, or a request from a competent authority, or to protect our rights, property, or safety.
We do not sell your personal data.
Because we operate across Ireland, Croatia, and other jurisdictions, and because the Applicable Platforms and our service providers may be located outside the European Economic Area, your personal data may be transferred internationally. Where we do so, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or an adequacy decision, to protect your data.
We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including to satisfy any legal, accounting, or reporting requirements. When personal data is no longer needed, we securely delete or anonymise it. Retention periods for financial and AML records are set by applicable law.
If you are in the European Economic Area, you have the right to access your personal data; to have inaccurate data corrected; to have data erased; to restrict or object to processing; to data portability; and to withdraw consent at any time where processing is based on consent. To exercise any of these rights, contact us at office@spona.io.
If you are a California resident, you have the right to know what personal information we collect, use, and disclose; the right to request deletion of your personal information; the right to correct inaccurate information; and the right not to be discriminated against for exercising your rights. We do not sell personal information.
You have the right to lodge a complaint with a supervisory authority. In Croatia, the competent authority is:
Agencija za zaštitu osobnih podataka (AZOP)In Ireland, the competent authority is the Data Protection Commission — dataprotection.ie.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, misuse, or alteration. This includes access controls, encryption in transit, and a requirement that users of advertising accounts enable two-factor authentication. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Our website and communications may contain links to third-party sites and platforms. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.
We may update this Privacy Policy from time to time. When we make material changes, we will post the updated version on this page. We encourage you to review this Policy periodically.
If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us at office@spona.io.