Privacy Notices
This page contains two privacy notices in which Bellingcourt Oy is the controller: users of the service and customer contacts (A), and the website, the customer offer page and cookies (B). Personal data in a customer's bookkeeping and other Customer Data is processed by Bellingcourt Oy on the customer's behalf under the Data Processing Agreement; the customer is its controller.
A. Users of the service and customer contacts
Data we process
- User account: name, email, password hash (never the password itself), roles and companies, chosen appearance.
- Sign-in and security: sign-in times and change-log identifiers (user, time, IP address, browser).
- Customer relationship: names and contact details of customer contacts, contract and billing details, support requests and messages.
- Invitations: the invitee's email and the inviter's name.
Purposes and legal bases
| Purpose | Legal basis (GDPR Article 6) |
|---|---|
| Providing the user account and the service | Contract (1(b)), or legitimate interest when the user acts for a customer company (1(f)) |
| Security, abuse prevention, change log | Legitimate interest (1(f)) and the audit-trail requirements of bookkeeping |
| Invoicing and bookkeeping | Legal obligation (1(c)) |
| Customer communications and service news to businesses | Legitimate interest (1(f)); you can opt out at any time |
Sources
The user, the customer company that sent the invitation, and log data created by use of the service.
Recipients and transfers
The data is processed on our behalf by the sub-processors listed in Annex 1 of the Data Processing Agreement. Transfers outside the EU and EEA are made on a basis under Chapter V of the GDPR. Data is not sold or disclosed for marketing.
Retention
- User account: as long as the user has access to at least one company, and at most 12 months after the last access ends. verify
- Change log: as long as the bookkeeping material it relates to (Finnish Accounting Act 1336/1997, chapter 2, section 10). IP addresses and browser data are removed after 24 months. verify
- Invoicing and bookkeeping data: 6 or 10 years under the Accounting Act.
- Support messages: 3 years after the customer relationship ends. verify
Automated decision-making
We make no automated decisions or profiling with legal effects on data subjects. AI booking proposals are always approved by a person.
B. Website, customer offer page and cookies
Cookies and browser storage
We use no analytics, advertising or tracking cookies. The service stores only data needed for it to work in the browser's own storage (localStorage):
| Item | Purpose | Duration |
|---|---|---|
| Supabase sign-in session | Keeps the user signed in | Until sign-out |
| numar-skin, numar_company, numar_mod | Chosen appearance, company and module | Until the user clears browser data |
| numar-timer | Start time of the time-tracking timer | Until the timer is stopped |
Server logs and third-party content
Our delivery provider (Cloudflare) processes IP addresses and technical log data to deliver the pages and to defend against denial-of-service attacks. Fonts are loaded from Google Fonts, so the browser sends its IP address to Google. verify The legal basis is legitimate interest (Article 6(1)(f)).
Customer offer page
When you open an offer link sent by a Numar customer, the company that sent the offer is the controller and Bellingcourt Oy processes the data on its behalf. We store when the offer was opened and, on acceptance or rejection, the name, email, any reason given, the time, IP address and browser. The data stays in the sender's offer records. Requests about it are best directed to the sender of the offer.
Your rights
You have the right to access, rectify and erase your data, to restrict its processing, to object to processing based on legitimate interest, and to data portability where processing is based on a contract. Requests: hello@numar.io. We reply within one month.
You may lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi) if you believe your data is processed unlawfully.