Legal
Data Processing Addendum
Last updated 1 August 2026
This addendum applies where Numbers processes personal data on your behalf and forms part of the Terms of Use.
Roles
You act as controller of the personal data contained in your workspace. Numbers acts as processor and processes that data only on your documented instructions.
Sub-processors
We engage sub-processors for hosting, database services, payment processing, bank aggregation and email delivery. A current list is available on request, and we give notice before adding a new sub-processor.
Security measures
Encryption in transit and at rest, per-tenant row-level isolation, immutable audit logging, least-privilege administrative access and regular dependency scanning.
Assistance
We assist you with data-subject requests, impact assessments and regulator enquiries, and notify you of a personal-data breach without undue delay.
International transfers
Transfers outside your region rely on standard contractual clauses or another approved safeguard.
Deletion and return
On termination you may export your data. We delete or anonymise remaining personal data after the retention period stated in the Privacy Policy, subject to statutory bookkeeping obligations.
Audit
On reasonable notice, and no more than once a year, you may review our security documentation and certifications to verify compliance.
Questions about this document? Email legal@ledger.example.