Effective October 23, 2026 · Last updated October 23, 2026
1. Roles
The client owns its data and decides how it's used. numarket acts as the client's service provider and processor: it processes client data only to deliver the contracted services, on the client's behalf, as defined under applicable US state privacy laws (such as the California Consumer Privacy Act).
If a client's data includes individuals in the EU or UK, GDPR terms are available on request.
2. Instructions and purpose
We process client data only on the client's documented instructions and only to provide the services — never to sell it, and never to train models for anyone else.
3. Confidentiality
Everyone who can access client data is bound by written confidentiality obligations and receives access only as needed.
4. Security measures
A dedicated, encrypted database per client; encryption in transit and at rest; role-based access with multi-factor sign-in; read-only source connections wherever possible; audit logging of logins and changes; no client data on personal devices.
5. Subprocessors
Current subprocessors include Snowflake (data platform), cloud hosting, and data-connector providers. A current list is provided with the contract, and clients are notified before changes.
6. Incident notification
We notify the client without undue delay, and within 72 hours of confirming a security incident affecting its data, with what we know and what we're doing about it.
7. Assistance
We help clients respond to data-subject requests and regulatory inquiries related to the data we process for them.
8. Return and deletion
At the end of the engagement, the client receives, within 30 days, a full copy of their data in open formats, the structure, the cleaning logic, the application code, and the business definitions (data dictionary), or a transfer of the database account. We then delete our copies and confirm in writing, except where the law requires us to keep them.
9. Audits
Clients may request reasonable information to confirm compliance with the DPA.
10. Healthcare data
Where protected health information is involved, a Business Associate Agreement is signed and a HIPAA-eligible configuration is used.