Trustworthy data handling begins with an explicit processing purpose, defined roles, documented retention decisions and an understandable path for people to exercise their privacy rights.
Numerish can act in different processing roles. Information gathered for its own website, commerce or account administration differs from customer-managed employee, client, project or operational data held inside a subscribed tenant.
The descriptions below outline control expectations and evidence to evaluate. They do not claim that a specific Numerish product has completed independent certification.
Each domain brings a specific objective and a practical review item. Choose the level of assurance needed for the relevant service and regulatory context.
Identify the entity determining each processing purpose and who receives and fulfils rights requests. Customer records must not be confused with Numerish’s own account and security records.
Entity and processing-role map, signed DPA and customer instruction boundaries.
Assess collection, use, sharing, access, storage, archiving and deletion by information class. A retention rule needs an actual business and statutory basis.
Data-category inventory, retention schedule, deletion procedures and legal-hold exceptions.
Understand storage location, support access, backup locations and transfers involving subprocessors; configuration can differ by service or sovereign deployment.
Region and subprocessor schedules, transfer mechanisms, support-access locations and residency exceptions.
Separate service notices from optional analytics, marketing and other consent-dependent activities. Consent evidence and withdrawal controls must be context-appropriate.
Consent policy, preference management test, notice versions and withdrawal event logs.
Support authenticated requests for access, correction, deletion, restriction, portability or objection when applicable, while avoiding disclosures to unauthorised requesters.
Request-intake workflow, verification protocol, processing timeline and escalation path.
Determine whether AI features transmit content to an external provider, what is logged, which contractual rights apply and whether the feature can be disabled by policy.
AI data-flow map, provider terms, purpose limitations, logging and tenant-control evidence.
The dividing line between supplier capability and customer responsibilities should be agreed before implementation or procurement sign-off.
Privacy commitments depend on applicable law, the selected Numerish services, the actual responsible entity and contracted data-processing arrangements.
Request product- and version-specific artefacts; identify the relevant jurisdiction, data classes, hosting model and procurement requirements.
Controls and independently verified outcomes should not be confused.
Some deployment offerings may support regional or sovereign controls, but no universal region selection is promised. Confirm the supported locations and transfers in the order and data-processing terms.
No. The public notice describes general processing. A data processing agreement can define customer-controller and supplier-processor duties for contracted services.