Data Processing Agreement (DPA)
Updated: 2026-10-01
This agreement governs how Numerio (MB „Blue age lab") processes your company's personal data while you use the Service. You (the Customer) remain the data controller — you decide what data is processed; Numerio acts as the data processor — it processes data only on your instructions and only in order to provide the Service. Below you will find what data is processed, what security measures apply and who our sub-processors are (see the table in section 8). This summary is not legally binding — the binding text is below.
1. Parties and scope
This Data Processing Agreement (the Agreement or DPA) is concluded between:
- the Customer — the company that uses the Numerio Service and that acts under this Agreement as the data controller (GDPR Article 4(7)); and
- MB „Blue age lab", company registration number 306656523, VAT number LT100016571516, registered office at Saulėtekio al. 15-1, LT-10224 Vilnius, Lithuania (hereinafter — Numerio or the Processor), which acts under this Agreement as the data processor (GDPR Article 4(8)).
This Agreement supplements the Terms of Service and applies automatically once the Customer begins using the Service and connects data sources containing personal data.
2. Subject matter, duration, nature and purpose of processing
| Aspect | Description |
|---|---|
| Subject matter | Automated collection, recognition and organisation of the Customer's purchase invoices and related documents |
| Duration | For as long as the Customer uses the Service; after use ends — until the data is deleted under section 10 |
| Nature | Automated document extraction and data capture, storage, matching of bank statement lines, assembly of the accountant package |
| Purpose | To provide the Customer with the invoice collection and control Service as described in the Terms of Service |
3. Categories of data subjects
- the Customer's employees and authorised representatives who use the Service;
- contact persons at the Customer's suppliers, whose data (for example name, email address, job title) may appear on invoices or in related emails;
- other natural persons whose data incidentally appears in the email correspondence examined when checking invoice-related messages.
4. Categories of data processed
| Data category | Description |
|---|---|
| Invoice documents and metadata | Supplier name, invoice number, date, amount, VAT, contact details present on the document itself |
| Email metadata | Sender, subject, date, attachment name — only for messages identified as invoice-related; the whole mailbox content is not processed |
| Bank statement lines | Dates, amounts and payment descriptions from bank statement files uploaded by the Customer, used only for matching against invoices |
| Account data | The Customer's user name, email address, sign-in events |
Numerio does not deliberately process special categories of personal data (GDPR Article 9) and does not ask for them to be provided; if such data incidentally appears in a document's content, it is processed only to the extent unavoidably connected with processing that document, and is in no circumstances analysed separately.
5. Documented instructions
Numerio processes personal data only on the Customer's documented instructions — meaning this Agreement, the Terms of Service and the Customer's actions in the Service interface (for example which sources to connect, which documents to confirm, when to generate the accountant package).
If Numerio considers that an instruction infringes the GDPR or other applicable data-protection law, it will inform the Customer without delay.
6. Confidentiality
Numerio ensures that persons with access to the Customer's personal data (employees, contractors) have committed themselves to confidentiality or are under a statutory obligation of confidentiality, and that they are familiar with the data-protection requirements appropriate to the nature of their work. This duty of confidentiality continues after this Agreement ends.
7. Security measures
Numerio applies the technical and organisational security measures set out in Annex 1 — Technical and organisational measures at the end of this Agreement. Numerio stores the Customer's data using managed infrastructure services in the EU region only. Where the Customer's own mailbox is held is the Customer's choice, not Numerio's (see the note on mailbox providers under the table in section 8).
8. Sub-processors
The Customer gives general authorisation for Numerio to engage the sub-processors listed in this table. Numerio will inform the Customer by email at least 30 days in advance of engaging or changing any sub-processor, giving the Customer the opportunity to raise reasoned objections.
If the Customer objects and the parties cannot resolve the objection within a reasonable time, the Customer may end its subscription for the affected part of the Service without penalty, effective from the date on which the new sub-processor would start processing the Customer's data.
International transfers. Numerio transfers the Customer's personal data outside the European Economic Area only under the conditions of Chapter V of the GDPR. For any such transfer that Numerio controls, including a transfer by a sub-processor, Numerio relies on the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), unless a European Commission adequacy decision covers the transfer. Where the Customer's own mailbox is held outside the European Economic Area, that location is the Customer's choice under its own agreement with its mailbox provider (see the note under the table).
This table is versioned and may change — the current version is always published at numerio.ai/dpa.
| Entity | Purpose | Region | Safeguard |
|---|---|---|---|
| OVH Hosting Limited (OVHcloud) | Hosting of the Service, managed PostgreSQL, object storage and backups; customer data at rest | EU — Warsaw (WAW), Poland | Encryption in transit and at rest, restricted service access, versioned storage and tested backups |
| Mistral AI SAS | Extraction of invoice documents and application of Customer-written processing rules to extracted fields | EU — France; pinned api.mistral.ai endpoint | Pinned endpoint and model versions, provider response storage disabled; processing rules receive extracted fields rather than the original document |
| Sendinblue SAS (Brevo) | Transactional email for workspace invitations, digests and reminders | EU data storage; Brevo publishes hosting in France and Germany and database storage in Belgium | Transactional API over TLS; only recipient and message data needed to send and reconcile each email |
| Plausible Insights OÜ (Plausible Analytics) | Website traffic statistics — no cookies, no personal identification, no cross-site profiling | EU (company in Estonia; servers in Germany) | Data-processing agreement with Plausible; no personal data collected and no cookies used, so no consent banner is required |
| Stripe Payments Europe, Limited (Stripe) | Payment, subscription billing and VAT calculation — billing name, email address, billing address, business tax ID and payment method only; no invoice content and no mailbox data | EU (Ireland); the Stripe group has a US parent, so limited intra-group transfers to the US can occur | Stripe data-processing terms in the Stripe Services Agreement; Standard Contractual Clauses (SCCs) for any US transfer; card data is handled only by Stripe (PCI DSS Level 1) |
Mailbox providers. Your mailbox provider (Google for Gmail, Microsoft for Outlook) is not a sub-processor of Numerio. You hold your own agreement with that provider and you choose where that mailbox is hosted. Numerio reads the mailbox only under the access that you grant and can revoke at any time.
What each sub-processor cannot see. Stripe never sees invoice content or mailbox data. Brevo receives only the recipient's email address and the content of the notification it sends. Plausible receives no personal data. Mistral AI receives the document to be read, never access to the Customer's mailbox. Mailbox credentials are stored, encrypted, only in Numerio's own database at OVHcloud and are never passed to another sub-processor.
Numerio imposes on every sub-processor, by contract, the same data-protection obligations as those set out in this Agreement (GDPR Article 28(4)). If a sub-processor fails to meet those obligations, Numerio remains fully liable to the Customer for that sub-processor's performance, in the same way as for its own acts.
9. Assistance with data subject rights
Taking into account the nature of the processing, Numerio assists the Customer in responding to data subject requests (access, rectification, erasure, restriction, portability or objection to processing), by providing the necessary technical means or information within a reasonable period after the Customer's request.
Where the Customer needs to carry out a data protection impact assessment or to consult a supervisory authority because of how Numerio processes data, Numerio provides the information reasonably needed for that within a reasonable time.
10. Deletion or return of data after processing ends
After cancellation or the end of this Agreement the Customer may export or ask for the return of its data for 90 calendar days, while the workspace stays available. The Customer must export before deleting the workspace. Once the Customer deletes the workspace, or once the export window has ended and the Customer's written retention instruction and applicable law permit deletion, Numerio completes logged deletion within 30 calendar days, unless a legal retention duty requires Numerio to keep specific records for longer. Remaining backup records are removed through the ordinary backup cycle.
11. Personal data breach notification
On becoming aware of a personal data breach affecting the Customer's data, Numerio informs the Customer without undue delay, and in any event within 48 hours of becoming aware of it, providing the information available about the nature of the breach, its likely consequences and the measures taken or planned, so that the Customer can fulfil its own obligations as controller under GDPR Articles 33–34.
12. Audit rights
The Customer has the right to obtain from Numerio the information and documentation needed to demonstrate that Numerio meets its obligations under this Agreement, and to have an audit carried out. An audit takes place no more than once every 12 months and on at least 30 days' written notice (including by email), unless a supervisory authority requires otherwise or a personal data breach has affected the Customer's data. Audits are carried out in a proportionate, pre-agreed manner (for example document review or a questionnaire) rather than as a mandatory on-site inspection, unless the parties agree otherwise, and subject to confidentiality and the protection of other customers' data.
Numerio keeps records of the processing it carries out on the Customer's behalf, as required by GDPR Article 30(2), and makes them available to the Customer or a supervisory authority on request.
13. The Customer's obligations and rights
The Customer, as controller, is responsible for having a lawful basis for the personal data it processes through the Service and for giving Numerio only lawful instructions. The Customer has the right to object to a new sub-processor (section 8), to audit Numerio (section 12) and to require the deletion or return of its data (section 10).
14. Liability
Numerio's liability under this Agreement is subject to the same limits as its liability under the Terms of Service and counts towards the same cap; this Agreement does not add a separate cap. That limit does not apply where Numerio caused the damage intentionally or through gross negligence, or where mandatory law does not allow liability to be limited.
15. Relationship to other documents
This Agreement supplements the Terms of Service and the Privacy Policy. In the event of a conflict on data-processing matters, this Agreement prevails.
16. Contact
MB „Blue age lab", Saulėtekio al. 15-1, LT-10224 Vilnius, Lithuania
Tel. +370 5 208 0417 · email hello@numerio.ai
Annex 1 — Technical and organisational measures
Numerio applies the following technical and organisational security measures:
- encryption in transit (TLS) and at rest;
- encryption of mailbox credentials (OAuth access and refresh tokens) and the ability to disconnect the source (see section 6 of the Terms of Service for provider-specific disconnection mechanics);
- storage of data using managed infrastructure services in the EU region only;
- the principle of least privilege — access to data is granted only to those employees and systems that require it;
- operational logs that do not include document content or unnecessary personal data — logs record events only (for example “document processed”), not the content itself;
- regularly tested backup / restore;
- errors and failures logged so that they are noticeable, auditable and retryable — no invoice disappears without a trace down a silent error path.