Privacy & Cookie Policy
PART I – PRIVACY POLICY
This Privacy Policy explains how Numonis collects, uses, stores and protects your personal data. It applies to all interactions with Numonis: visiting our website, using the Numonis Platform, and engaging our professional advisory services.
We comply with Regulation (EU) 2016/679 (GDPR) and Spanish Organic Law 3/2018 (LOPDGDD).
1. DATA CONTROLLERS
Numonis operates through two distinct entities that act as data controllers for different categories of your personal data:
Numonis Portugal, LDA (NIF 519110811, Rua Damão de Góis 323, 4050-226 Porto, Portugal) is the data controller for personal data processed in connection with your use of the Numonis Platform and website, including account registration data, Platform usage data, communications and messages exchanged through the Platform, open banking transaction data, and documents stored in the Platform archive, as further described herein.
The relevant operating company within the Numonis Spain Accounting Services, S.L. group (the “Spanish Service Provider”) assigned to provide professional advisory services to you is the data controller for personal data processed in connection with managing, performing and documenting the provision of the Services, invoicing, security, compliance with law, support. The identity, NIF, registered address and Mercantile Registry details of the Spanish Service Provider acting as your data controller for professional services are set out in your Services Agreement and displayed in your Platform account.
For data protection queries, requests to exercise your rights or communications concerning the processing of your personal data, you may contact us at: privacy@numonis.com
Where Numonis processes personal data relating to your employees, customers or other third parties on your behalf as part of the professional advisory services, the Spanish Service Provider acts as data processor. In that capacity, processing is governed by the Data Processing Agreement (DPA) annexed to your Services Agreement, not by this Privacy Policy.
2. WHAT DATA WE COLLECT AND WHY
A. Website visitors (numonis.com)
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, email, message, phone number | Respond to your inquiry or demo request | Consent of the data subject | as long as necessary to respond to the inquiry, plus one (1) year |
| Name, email, phone number, recording of the meeting | Process your call booking. Where calls or meetings are recorded, participants will be informed in advance before the recording starts. | Consent of the data subject | as long as necessary to respond to the inquiry, plus one (1) year |
| IP address, browser type, pages visited | Ensure website security and analyze performance | Legitimate interest / consent for non-technical cookies | Depending on the cookie, please refer to our Cookie Policy. |
| Name, surname, email, phone number, personal URL, CV, image, capabilities and other personal information shared voluntarily | Process your candidature to any of our jobs – [more info: https://numonis.factorialhr.com/terms] | Consent of the data subject. | One (1) year, unless you request access to the talent pool to be contacted about future job opportunities. |
B. Platform users and clients
| Data | Purpose | Legal basis | Retention period |
|---|---|---|---|
| Name, email, phone, company details, Tax ID | Account registration and identity verification | Contract performance | Duration of the contractual relationship plus five (5) years. |
| Messages, instructions and communications via Platform | Service delivery, record-keeping, dispute resolution | Contract performance | Duration of the contractual relationship plus five (5) years. |
| Business documents and accounting records | Provision of accounting and payroll services | Contract performance | Duration of the contractual relationship plus six (6) years. |
| Bank transaction data via open banking* | To enable the secure retrieval of bank transaction data through the Open Banking integration, perform bookkeeping, transaction matching, bank reconciliation, financial reporting and other accounting services available through the Numonis Platform. | Contract performance | Duration of the service relationship plus six (6) years, as the minimum period required under applicable Spanish accounting and tax law. |
| Platform usage data (logins, features used) | Security, service improvement, support | Legitimate interest | Platform usage data are retained only for as long as necessary to ensure platform security, service continuity, troubleshooting, fraud prevention and compliance with legal obligations. |
| Personal data contained in prompts, documents, messages, accounting information, payroll information, financial information, reports, invoices, communications and any other information voluntarily submitted through the AI chatbot assistant. | To assist users in operating the Numonis Platform, retrieve and analyse information, prepare accounting records, generate financial documentation, draft invoices, provide platform assistance, perform authorised operational tasks, generate reports and support users in the use of all functionalities available through the Numonis Platform. | Contract performance | Duration of the contractual relationship plus five (5) years. |
| Name, surname, image, voice. | To record meetings for documentation, training, quality assurance and follow-up purposes | Consent | Until consent is revoked or the recording is no longer necessary for the purposes for which it was made, and in any event for no longer than twelve (12) months, unless a longer retention period is required to establish, exercise or defend legal claims. |
*Open banking services are technically provided through KontoMatik, our integrated Open Banking provider. When activating Open Banking, users are redirected to a dedicated onboarding flow where KontoMatik identifies itself, requests the necessary consents and presents its own Terms of Service and Privacy Policy. Depending on the specific processing activity, KontoMatik may act either as an independent data controller (for regulated account information services and related consents) or as a processor providing services to Numonis. Additional information is available in KontoMatik's own Privacy Policy - https://www.kontomatik.com/privacy-policy.
3. DATA WE PROCESS AS PROCESSOR
When you use the Platform to manage your business, you may share personal data belonging to third parties – including your employees, customers and suppliers. Examples include employee payroll data (name, NIE/DNI, salary, Social Security number), customer invoicing data (name, Tax ID, address), and supplier information.
In respect of this data, you are the data controller and the Spanish Service Provider acts as your data processor. We process this data solely on your instructions and for the purposes of delivering the contracted services. Our obligations as processor – including security measures, sub-processor management, breach notification and data return or deletion – are set out in the DPA that forms part of your Services Agreement.
By sharing third-party personal data through the Platform, you confirm that you have a lawful basis for doing so under the GDPR.
4. NUMONIS AI AND DATA USE
The Platform includes Numonis AI, an AI-powered assistant that analyzes your business data to generate responses, summaries and financial insights. Numonis AI processes your data on your behalf to provide this service, within the scope of contracted services.
Where permitted by applicable law, Numonis may generate anonymised or aggregated datasets from information processed through the Platform. Numonis may also use data derived from Platform activity to train, validate and improve its AI models. Before any such use, data is irreversibly anonymized by removing any elements that could reasonably identify an individual, customer or organization, in accordance with the standards set out in Article 29 Working Party Opinion 05/2014 (WP216). Once anonymized, the data is no longer personal data and falls outside the scope of the GDPR and may subsequently be used by Numonis to maintain, analyse, validate, improve and develop the Numonis Platform, its services and artificial intelligence systems. Identifiable data is never used for model training.
The AI functionalities available through the Platform are intended to support users in operating the Platform and do not, by themselves, make decisions producing legal or similarly significant effects on individuals within the meaning of Article 22 GDPR.
5. WHO WE SHARE YOUR DATA WITH
We do not sell your data or share it with third parties for their own marketing purposes. We may share personal data in the following circumstances:
- Sub-processors: including Numonis Portugal, LDA (Platform operator), Anthropic Inc. and Mistral AI SAS (AI model providers for inference processing), AWS (EU-based cloud hosting provider), open banking integration provider, and invoicing software provider. All sub-processors are bound by data processing agreements. A full list is maintained in the DPA annexed to your Services Agreement.
- Public authorities: where required by law, including the Agencia Tributaria (AEAT), Seguridad Social (TGSS), SEPE, and other competent authorities in connection with the services we provide on your behalf.
- Professional body: where required by the rules governing our certified accountants.
- Group companies: data may be shared within the Numonis group for operational and administrative purposes, under appropriate data sharing arrangements.
Where data is transferred outside the European Economic Area (EEA) – including to US-based AI providers – we ensure that appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission. The DPA attached to the Services Agreement includes a list of platform data recipients located outside the EEA, along with the appropriate safeguard applied in each case.
For data processed through the Numonis website, your data may be transferred to Cal.com, Inc., USA. For more information, please see their privacy policy - https://cal.com/es/privacy.
6. COMMUNICATIONS AND MESSAGE ARCHIVING
Messages, instructions and communications sent through the Numonis Platform are archived as part of our service record, on the basis of our legitimate interest in maintaining an accurate record of service instructions and enabling dispute resolution.
Where calls or meetings are recorded for quality assurance purposes, you will be informed in advance. Recordings are not shared with third parties except where required by law.
7. COOKIES
Our website uses cookies. Full details are set out in Part II – Cookie Policy of this document. In summary, we use essential cookies (no consent required) and analytics cookies (consent required). You can manage your preferences at any time via the cookie banner on our website.
8. YOUR RIGHTS
Under the GDPR and LOPDGDD, you have the following rights in relation to your personal data:
- Access: to obtain confirmation of whether we process your personal data and to receive a copy.
- Rectification: to request correction of inaccurate or incomplete data.
- Erasure: to request deletion of your data where there is no longer a lawful basis for processing, subject to our legal retention obligations.
- Restriction of processing: to request that we limit how we use your data in certain circumstances.
- Data portability: to receive your data in a structured, commonly used, machine-readable format.
- Object: to object to processing based on legitimate interests.
- Withdraw consent: where processing is based on consent, to withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at privacy@numonis.com. We will respond within thirty (30) calendar days. In complex cases we may extend this by a further two months, in which case we will inform you.
You also have the right to lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD), at www.aepd.es.
9. SECURITY
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction or alteration. These include encryption in transit (TLS 1.2 or higher) and at rest (AES-256 or equivalent), role-based access controls, regular security reviews, and audit logging. Platform data is primarily hosted within the European Union. Certain service providers may process limited personal data outside the European Economic Area, subject to the appropriate safeguards described in this Privacy Policy and the applicable data protection documentation.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the AEPD within 72 hours of becoming aware. Where the breach is likely to result in a high risk to you, we will also notify you directly without undue delay.
10. CHILDREN
The Numonis Platform and services are intended for use by businesses and professionals. We do not knowingly collect or process personal data relating to individuals under the age of 18. If you believe we have inadvertently collected such data, please contact us at privacy@numonis.com and we will delete it promptly.
11. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. Where changes are material, we will notify you via the Platform or by email at least thirty (30) days before the changes take effect. The date at the top of this page shows when it was last revised.
12. CONTACT
For any questions or requests relating to this Privacy Policy or the processing of your personal data:
Email: privacy@numonis.com
Website: numonis.com
For data protection matters relating to the professional services provided under your Services Agreement, please also refer to the DPA annexed to that Agreement.
PART II – COOKIE POLICY
This Cookie Policy explains what cookies Numonis uses on its website (numonis.com) and the platform (https://app.numonis.com/) and how you can manage your preferences. It forms part of our Privacy Policy (Part I) and should be read alongside it.
This policy applies to Numonis Portugal, LDA as operator of the Numonis website and platform and complies with Ley 34/2002 (LSSI) and the GDPR.
1. WHAT ARE COOKIES
Cookies are small text files placed on your device when you visit a website or platform, allowing it to recognize your device, remember preferences and collect usage information. They can be set by us or by third-party services we use. For more general information about cookies, see the following article.
Based on their purpose, the cookies used by Numonis may be divided into the following categories:
- Technical cookies (necessary): cookies required for browsing and for the proper functioning of the website or platform. Their use enables basic functions, such as access and secure browsing. The legal basis that allows the collection of data through these cookies is Numonis legitimate interest in managing the website or platform. No information collected through these cookies is shared with third parties. Please refer to the cookie table below for further details.
- Analytics cookies: these allow the monitoring and analysis of Users’ behaviour. The information collected through this type of cookie is used to measure website or platform activity and to create Users’ browsing profiles, in order to improve the website or platform and its services. The legal basis that allows the collection of this data through these cookies is the User’s consent. Please refer to the cookie table below for further details on these cookies.
- Preference cookies: these are cookies installed to personalise the User experience, that is, the way in which certain windows may or may not appear during the User’s browsing, in accordance with the consents and preferences that the User may express while browsing the website or platform, such as managing the User’s acceptance of this Cookie Policy. If applicable, this means that the cookie notice banner, including its corresponding acceptance or rejection options, will no longer appear for the User. As with analytics cookies, the legal basis that allows us to collect such User data through these preference cookies is the User’s consent.
- Advertising cookies: these allow the management of advertising spaces based on different criteria. These cookies track Users’ browsing habits in order to create a profile that enables the display of information that is most relevant or tailored to their identified tastes and preferences based on the User’s searches and browsing habits, including on websites not managed by Numonis. The legal basis that allows the collection of this data through these cookies is the User’s consent. Please refer to the cookie table below for further details on these cookies.
2. COOKIES WE USE
A) Website Cookies
In summary, we use the following cookies to track how our website is used so that it can optimize its performance.
| Cookie / Type | Purpose | Duration |
|---|---|---|
| Security token (technical) | Protects against cross-site request forgery (CSRF) | Session |
| Preference cookie (functional) | Remembers your language and display preferences | 12 months |
| _ga, _gid (analytics – Google Analytics) Third party | Tracks page visits and user behavior to help us improve the website. IP addresses are anonymized. | Up to 14 months (see Section 4 below) |
| cal.com cookies Third party | Powers our call scheduling tool. Governed by Cal.com’s own cookie policy. | Per Cal.com policy (see Section 4 below) |
Technical cookies don’t require consent. Functional & analytics cookies are placed only with your prior consent.
B) Platform Cookies
In summary, we use the following cookies to track how our platform is used so that it can optimize its performance.
| Cookie / Type | Purpose | Duration |
|---|---|---|
| PostHog (Technical) Third party | Tracks session replay and automatic click/event tracking | See PostHog policy (see section 4 below) |
| Sentry (Technical) Third party | Error and performance tracking | See Sentry policy (see section 4 below) |
| Kontomatik (Technical) Third party | Powers the bank-connection widge | See Kontomatik policy (see section 4 below) |
| Session_id (technical) | Maintains your login and secure session management, enables the Platform to function | 1 hour |
| refresh_token (technical) | Renews your login automatically without asking you to sign in again. | 30 days |
3. MANAGING YOUR PREFERENCES
When you first visit our website or platform, if applicable, a cookie banner will allow you to accept or decline non-essential cookies. You can change your preferences at any time via the “Cookie Settings” link in the footer of our website or platform.
You can also manage cookies directly through your browser settings. For example, you can follow these instructions:
Note that blocking essential cookies may affect website or platform functionality.
4. THIRD-PARTY PROVIDERS
Third-party cookies are governed by the relevant provider’s own policies:
– Google Analytics: policies.google.com/privacy
– Cal.com: cal.com/privacy
5. CHANGES TO THIS POLICY AND CONTACT
We may update this Cookie Policy from time to time. The date at the top of this page shows when it was last revised. Material changes will be communicated via our website or platform.
6. CONTACT
For any questions about our use of cookies, you can contact us at: privacy@numonis.com