Data Processing Agreement (AVV).

Numi processes personal data on behalf of the Customer for the sole purpose of providing the Service: ingesting sales call recordings or transcripts (whether captured by Numi or imported from a Customer-connected integration), transcribing audio, generating AI coaching content, and presenting the results to the Customer's authorised users.

The processing continues for the duration of the Customer's subscription to the Service and ends in accordance with Section 9 (Return and deletion) below.

The categories of data subjects and the categories of personal data are described in Annex 1 to this DPA. The Customer warrants that it has a valid legal basis for the processing and has informed the relevant data subjects as required by Art. 13 and Art. 14 GDPR, including any obligation to obtain consent for the recording of communications under applicable national law.

Numi processes personal data only on documented instructions from the Customer, including with regard to transfers of personal data to a third country or an international organisation, unless required to do so by Union or Member State law. In the latter case, Numi will inform the Customer of that legal requirement before processing, unless prohibited by law.

The Customer's instructions are the configuration choices made in the Service (integrations connected, retention settings, exports, deletion requests) and any written instructions sent to privacy@numigtm.com. Numi will inform the Customer if, in its opinion, an instruction infringes the GDPR or other applicable data protection provisions.

Numi ensures that persons authorised to process the personal data have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality, including after the end of their engagement.

Numi has implemented appropriate technical and organisational measures ("TOMs") to ensure a level of security appropriate to the risk, as described in Annex 2. Numi reviews these measures regularly and may update them, provided the level of protection is not reduced.

The Customer hereby grants Numi general authorisation to engage sub-processors. The list of current sub-processors is maintained at numigtm.com/legal/subprocessors and is incorporated by reference into this DPA.

Numi will notify the Customer at least 30 days in advance of any addition or replacement of a sub-processor that processes content data, by updating the sub-processor page and (where the Customer has subscribed to notifications) by email. The Customer may object to the change on legitimate data-protection grounds within 30 days. If the objection cannot be resolved, the Customer may terminate the affected portion of the Service on a pro-rata basis.

Numi imposes data protection obligations on each sub-processor that are no less protective than those set out in this DPA, by means of a written contract under Art. 28(4) GDPR.

Taking into account the nature of the processing, Numi assists the Customer by appropriate technical and organisational measures, insofar as possible, for the fulfilment of the Customer's obligation to respond to requests from data subjects under Chapter III GDPR (rights of access, rectification, erasure, restriction, data portability, objection, and rights related to automated decision-making).

Self-service tools for export and deletion are available in the Customer's account at Settings → Data. For requests Numi cannot fulfil through these tools, the Customer may contact privacy@numigtm.com.

Numi assists the Customer in ensuring compliance with Art. 32 to 36 GDPR (security of processing, breach notification, data protection impact assessments, prior consultation), taking into account the nature of the processing and the information available to Numi.

Breach notification. Numi will notify the Customer without undue delay, and in any event within 72 hours, after becoming aware of a personal data breach affecting personal data processed under this DPA. The notification will include the information set out in Art. 33(3) GDPR to the extent then available.

On termination of the Service, the Customer may, within 30 days, retrieve all personal data via the export tools in Settings → Data. After that 30-day window, Numi will delete all personal data processed on the Customer's behalf and ensure that the deletion propagates to all active backups within a further 30 days (60 days total from termination), unless Union or Member State law requires storage of certain data.

Data retained under legal obligation (e.g., billing invoices under German tax law, salted-hash deletion records to detect repeat fraud) is identified in the Privacy Policy and is the minimum required by law.

Numi makes available to the Customer all information necessary to demonstrate compliance with the obligations laid down in Art. 28 GDPR and this DPA, and allows for and contributes to audits, including inspections, conducted by the Customer or another auditor mandated by the Customer.

In the first instance, Numi will satisfy such audit requests by providing the most recent sub-processor list, the TOMs annex, and any third-party certifications or attestations held by Numi or its sub-processors (e.g., ISO 27001, SOC 2 Type II). On-site audits may be conducted no more than once per calendar year, with reasonable advance notice (at least 30 days), during business hours, and subject to confidentiality undertakings. The Customer bears its own and Numi's reasonable costs of any audit beyond the documentation review unless the audit reveals a material breach by Numi.

Numi processes personal data primarily within the European Economic Area (Hetzner Cloud, Frankfurt). Where personal data is transferred to a third country (in particular the United States), Numi relies on appropriate safeguards under Art. 46 GDPR, in particular the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), supplemented by the technical and organisational measures in Annex 2.

The list of current sub-processors at numigtm.com/legal/subprocessors identifies each transfer and the safeguard applied.

Liability under this DPA is governed by the Customer's main service agreement with Numi (or, where none is in place, by the Numi Terms of Service in effect at the time the parties signed this DPA). In the event of conflict between this DPA and the main service agreement, this DPA prevails in respect of the processing of personal data.

This DPA takes effect on the latest signature date below and remains in force for the duration of the Customer's use of the Service.

This DPA is governed by the laws of the Federal Republic of Germany, excluding conflict-of-laws principles. The exclusive venue for disputes arising out of or in connection with this DPA is, to the extent permitted by law, the courts of the Customer's registered seat within the European Union, or otherwise the courts competent for Numi's registered seat in Germany.