Data processing agreement (DPA)

This data processing agreement (DPA) applies between the firm (the Treuhand office or SME) that uses numi ("Firm") and Weise GmbH, Kriens ("numi"). It is part of the terms of use.

The Firm is the controller of the Customer data. numi is a processor under Art. 9 FADP and processes Customer data only on the Firm's instructions. The Firm gives its instructions by using numi (uploading files, reconciling, approving bookings and pushing them to Bexio) or in writing by email. If numi considers an instruction to breach data protection law, numi tells the Firm.

numi does not process Customer data for its own purposes. The only exception is the audit log described in the section "What remains after deletion". Everyone at numi with access to Customer data is bound to confidentiality.

For the Firm, numi matches bank transactions and QR-bills against open Bexio documents, prepares bookings and, once approved, pushes them to the Firm's Bexio account. To do this, numi stores the uploaded files and the data read from them.

This DPA applies for as long as the Firm uses numi, and afterwards until numi has deleted the Customer data.

numi processes the following Customer data:

• Bank transactions from camt files: amounts, dates, IBANs, counterparty names, references and remittance texts.
• QR-bills and receipts: creditors and debtors with name, address and IBAN, amounts and references.
• Bexio data: open invoices and bills with document number, amounts, dates and contact names, and the mandate's Bexio access token.
• Results of processing: matches, exceptions, AI proposals, prepared and pushed bookings.

The data subjects are the Firm's clients, their customers, suppliers and other counterparties named in this data, and the Firm's staff who use numi.

numi protects Customer data with these measures:

• Isolation by firm and mandate: every query runs with the signed-in person's permissions. Row-level security rules in the database and in file storage only grant access to members of the firm that owns a mandate.
• Bexio access tokens in Vault: the tokens are stored encrypted in Supabase Vault in Zurich. Only the server can read them, to push to Bexio. They never reach the browser or an Agent.
• Minimised AI context: the AI receives only an extract of an exception, without IBANs, addresses or account numbers and never the bank files themselves. It only chooses among candidates numi has computed and never calculates amounts.
• Audit log: every push and every significant action is logged with its time and the person who acted. The log can only be appended to, never changed or deleted.
• Storage in Switzerland: the database, files and access tokens are stored in Zurich. The application runs in Frankfurt, where data is held in memory only while it is processed.
• Approval and access: no booking reaches Bexio without a person's approval. Agents (MCP clients) can never push to Bexio, and their access can be revoked at any time. All connections are encrypted (HTTPS).

The Firm authorises numi to use the following subprocessors. It is the same list as in the privacy policy. numi binds them by contract to at least equivalent data protection.

Supabase

Supabase, Inc., USA Database, file storage, sign-in (authentication) and Vault for access keys Location: Zurich, Switzerland (region eu-central-2) Transfer basis: Stored in Switzerland. For any access by the US provider: standard contractual clauses

Vercel

Vercel Inc., USA Running the application (compute), Web Analytics, Speed Insights and AI Gateway (routing AI requests) Location: Frankfurt, Germany (region fra1) Transfer basis: EU, recognised as adequate (Annex 1 DPO). For the US provider: Swiss-U.S. Data Privacy Framework and standard contractual clauses

Anthropic

Anthropic, PBC, USA AI inference through the Vercel AI Gateway, with no retention of requests (zero data retention) Location: USA Transfer basis: Swiss-U.S. Data Privacy Framework and standard contractual clauses

Bexio is not a subprocessor: the Firm instructs numi to push bookings to the Firm's own Bexio account.

numi announces changes to this list to the Firm's owner by email at least 30 days in advance. The Firm may object within that period by writing to legal@numi.fi. If the parties don't agree, the Firm may terminate the agreement. The changed list is a new version of this DPA, which the owner accepts in numi.

For bank transactions that numi cannot match itself, numi asks an AI model from Anthropic for a proposal. The request goes through the Vercel AI Gateway, and inference runs outside Switzerland, in the USA.

The model receives only the minimised extract: amount, date, counterparty name, remittance text and the candidates with document number and amount, without IBANs, addresses or account numbers. Requests are not retained (zero data retention) and not used for training. The transfer to the USA is based on the Swiss-U.S. Data Privacy Framework and standard contractual clauses.

When a data subject asks for access to, correction, release or deletion of their data, numi helps the Firm as far as the Firm cannot handle the request itself in numi. If a data subject contacts numi directly, numi forwards the request to the Firm.

If numi becomes aware of a data security breach affecting Customer data, numi notifies the Firm by email without undue delay. The notice describes what happened, which data is affected and what numi is doing about it. numi helps the Firm with its report to the FDPIC and with informing the data subjects.

The contact for data security breaches is privacy@numi.fi. The Firm also reports any breach it notices there.

After the agreement ends, numi deletes the Firm's Customer data within 90 days. The Firm requests deletion by email to privacy@numi.fi. During the beta, numi deletes the data by hand and confirms the deletion by email.

Deletion covers bank transactions, documents, uploaded files, matches, AI proposals, prepared bookings and the Bexio access token.

After deletion, numi keeps the following for 10 years:

• the name of the firm and of each mandate,
• IDs of the firm, mandates, files and bookings,
• statuses and counts (for example "pushed" or the number of imported transactions),
• timestamps,
• the people who acted (as user IDs).

This information is in the audit log and in the archived firm and mandate records. It proves what numi processed for the Firm and pushed to Bexio, and when. numi is itself the controller for this record. Entries written since 7 November 2026 contain no amounts, file names, counterparties or Bexio responses. Older entries may contain such details; they remain unchanged, because the log cannot be altered.

The Firm's owner accepts this DPA in numi on the Firm's behalf and thereby confirms that they may act for the Firm. numi records which version was accepted, by whom and when. The acceptance covers every member of the Firm.

When this DPA changes, numi announces the new version 30 days in advance by email from legal@numi.fi. Until the owner has accepted it, numi processes no Customer data for the Firm.

This DPA exists in German and English. The German version is binding.