Privacy Notice
The short version
This notice is about you — the person visiting this site or using numrow. It is not about the invoices and business records your organisation puts into the product; for those we act on your organisation's instructions, and that relationship is described on the Data Protection page.
We collect what we need to give you an account, keep it secure, bill your organisation, answer you when you write, and understand which parts of this website people find. We do not sell personal data and we do not use it to advertise to you elsewhere.
Who is responsible
NUMROW LTD, registered in Mauritius at [REGISTERED ADDRESS], is the controller of the personal data described in this notice, within the meaning of the Mauritius Data Protection Act 2017 and, where it applies, the EU General Data Protection Regulation.
Data protection contact: privacy@numrow.com. Our data protection officer, where one is required, is [DPO CONTACT].
What we collect, and why
| What | Why | Lawful basis |
|---|---|---|
| Name, work email, job role, the organisation you belong to | To create and run your user account | Performance of the contract with your organisation; our legitimate interest in running the service |
| Sign-in records: timestamps, IP address, browser and device, identity-provider link | To keep accounts secure, to investigate misuse, and to show you where your account has been used | Legitimate interest in the security of the service; legal obligation where records must be kept |
| Actions you take in the product, recorded in the audit trail | Because financial records must say who did what, and your organisation relies on that | Legal obligation; legitimate interest in an auditable system |
| Billing and contact details of your organisation, and the person who administers it | To invoice and to collect payment | Performance of the contract; legal obligation to keep accounting records |
| What you write to us — email, demo requests, support messages | To answer you, and to keep a record of what was asked and answered | Legitimate interest in responding to enquiries; consent where you volunteered the enquiry |
| Website usage: pages visited, referring site, approximate location from IP | To understand which pages are useful | Legitimate interest in improving this website |
Cookies and tracking
This marketing website sets no analytics or advertising cookies. The application at https://app.numrow.com sets cookies that are strictly necessary to keep you signed in and to protect the session; they carry no advertising identifier and are not shared. If we ever add anything beyond that, we will ask first.
Who we share it with
Only with the suppliers who help us run the service, and only as far as they need it. They act on our instructions under written contracts, and the current list is on the Data Protection page — hosting, email delivery, and payment processing among them.
We also disclose personal data where we are legally required to, and to a buyer if the business is ever sold, in which case this notice travels with it.
Where it goes
The service is hosted at [HOSTING LOCATION]. Where personal data leaves Mauritius, we do so under the transfer conditions of the Data Protection Act 2017, and for transfers out of the EEA under standard contractual clauses or another approved mechanism.
How long we keep it
Account and audit records are kept for as long as the account exists, then for the periods described on the Data Protection page — tax and company law set a floor we cannot go under. Enquiry correspondence is kept for [ENQUIRY RETENTION]. Website usage data is kept in aggregate only.
How we protect it
Encrypted transport, access restricted to the people whose work requires it, tenant-by-tenant separation inside the product, and an audit trail over privileged actions. No system is perfect; if a breach affects you we will tell you and the Data Protection Commissioner as the Act requires.
Your rights
Under the Data Protection Act 2017, and under the GDPR where it applies to you, you may ask us to:
- confirm whether we hold personal data about you, and give you a copy — free of charge;
- correct anything inaccurate or incomplete;
- erase data we no longer have a reason to keep;
- restrict or object to a particular use, including any based on our legitimate interests;
- receive data you gave us in a portable form;
- withdraw consent, where consent was the basis, without affecting what was done before.
Write to privacy@numrow.com. We answer within the statutory period. If your data sits inside your organisation's numrow workspace, we will usually pass the request to them, because it is their instruction we act on — and we will tell you that we have.
If you are not satisfied, you may complain to the Data Protection Office of Mauritius (dataprotection.govmu.org), or to your own supervisory authority in the EEA.
Changes
We update this notice when what we do changes. The effective date is at the top of the page, and material changes are announced in the product before they take effect.
A question about your data?
One address, and a person reads it.
Invoice processing, approvals and reconciliation for businesses and the accountants who serve them.