Data Processing Agreement
This Data Processing Agreement is part of the agreement between the Customer and Bellingcourt Oy for the Numar service. It meets the requirements of Article 28 of the EU General Data Protection Regulation ((EU) 2016/679, the GDPR). The Customer is the controller and Bellingcourt Oy is the processor (the Processor).
1. Subject matter, duration, nature and purpose
| Subject matter | Personal data contained in the Customer Data stored in the Service |
|---|---|
| Duration | The term of the customer agreement and the export period after it (section 14.4 of the Terms of Service) |
| Nature | Storage, organisation, retrieval, reading with AI, calculation, reporting, transfer to recipients requested by the Customer, deletion |
| Purpose | The Customer's bookkeeping, invoicing, sales, offers, time tracking and funding management using the Service |
2. Categories of data and data subjects
| Data subjects | Data |
|---|---|
| The Customer's users, staff and shareholders | Name, email, role, time entries, hourly rates, expenses and amounts owed to shareholders, signatures, change-log identifiers (user, time, IP address, browser) |
| The Customer's customers and suppliers and their contacts | Name, contact details, business ID, bank account, invoices and payments, voucher contents, CRM notes and meeting minutes |
| Recipients of offers | Name, email, acceptance or rejection with reason, time, IP address and browser |
| Investors and funding contacts | Name, firm, investor type, stage of discussions, notes |
The Service is not intended for special categories of personal data or criminal-offence data (GDPR Articles 9 and 10). The Customer ensures that such data is not stored in the Service unnecessarily, for example in free-text fields of vouchers.
3. Obligations of the Processor
3.1 The Processor processes personal data only on the Customer's documented instructions: this agreement, the Terms of Service and the Customer's choices and actions in the Service. The Processor informs the Customer if, in its opinion, an instruction infringes the law.
3.2 The Processor ensures that persons processing personal data are bound by confidentiality.
3.3 The Processor implements the technical and organisational measures described in Annex 2 (GDPR Article 32).
3.4 The Processor assists the Customer in fulfilling data subjects' rights and the obligations under GDPR Articles 32–36, such as impact assessments. The Customer can retrieve, correct and export data itself with the Service's features.
3.5 If a data subject contacts the Processor directly, the Processor refers the request to the Customer.
4. Sub-processors
4.1 The Customer gives general prior authorisation to use the sub-processors listed in Annex 1.
4.2 The Processor binds its sub-processors in writing to data protection obligations at least equivalent to this agreement and is responsible for them as for itself.
4.3 The Processor gives at least 30 days' notice of a new or replaced sub-processor. The Customer may object on reasonable grounds. If the parties find no solution, the Customer may terminate the agreement free of charge before the change takes effect.
5. Transfers outside the EU and EEA
Personal data is transferred outside the EU and EEA only on a transfer basis under Chapter V of the GDPR. Transfers and their bases are listed in Annex 1.
6. Personal data breaches
6.1 The Processor notifies the Customer of a personal data breach without undue delay and at the latest within 48 hours of becoming aware of it. verify
6.2 The notice describes the nature of the breach, the categories and approximate numbers of data subjects and records, the likely consequences and the measures taken or proposed. It is supplemented as more information becomes available.
7. Audits
7.1 The Processor provides the Customer with the information needed to demonstrate compliance with this agreement, such as a description of the security measures and a summary of the latest external security test.
7.2 The Customer, or an independent auditor bound by confidentiality, may audit the processing once a year with 30 days' notice and whenever a supervisory authority requires it. The Customer bears the costs of the audit.
8. Return and deletion of data
After the agreement ends, the Customer may export its data in accordance with the Terms of Service. The Processor then deletes the personal data unless Union or Member State law requires it to be kept. Data is removed from backups according to their normal retention cycle. verify
9. Liability and term
Liability is determined by GDPR Article 82 and the Terms of Service. This agreement remains in force for as long as the Processor processes the Customer's personal data.
Annex 1. Sub-processors
| Sub-processor | Purpose | Data location | Transfer basis outside the EU/EEA |
|---|---|---|---|
| Supabase, Inc. | Database, file storage and sign-in | EU region verify | Possible support and maintenance access from outside the EU: EU Standard Contractual Clauses verify |
| Anthropic, PBC | Reading vouchers with AI (Claude) | United States verify | EU Standard Contractual Clauses or the EU–US Data Privacy Framework verify |
| Cloudflare, Inc. | Delivery of the application and website, network protection | Global network | EU Standard Contractual Clauses or the EU–US Data Privacy Framework verify |
An email service, a bank connection service and an e-invoice operator will be added later. They will be announced in accordance with section 4.3 before they are used.
Annex 2. Technical and organisational measures
- Customer separation: every row belongs to a company, and database row level security allows access only to the company's members according to their role. Separation is tested automatically before every release, and a release stops if any table lacks protection.
- Access control: roles (founder, accountant, employee, viewer, consultant) and module restrictions; the organisation owner sees who has access to each company.
- Change log: every insert, update and delete is recorded (who, what, when, from where). The log cannot be edited, and a per-company hash chain reveals later tampering.
- Bookkeeping integrity: posted entries and issued invoices cannot be changed or deleted; corrections are made by reversal or credit note.
- Encryption: data in transit is encrypted (TLS). Stored data is encrypted in the sub-processor's service. verify
- Authentication: password or a one-time sign-in link to a verified email. Invitations can be claimed only with a verified email.
- AI data minimisation: only the voucher to be read and the minimum context needed are sent to the AI service.
- Public links: an offer link is a long random identifier that shows only that offer and stops working when the offer is withdrawn or replaced.
- Backups: backups managed by the sub-processor. Documentation of a restore test is in progress. verify
- Development: every change goes through version control and automated tests before production.