How we look after your data.

Last updated 31 August 2026

Who we are

NumbersMatters is a trading name of Ujjawal Technologies and Creations Pvt. Ltd., a private limited company registered in India, with offices at D-34-A-1, Saraswati Marg, Bani Park, Jaipur, Rajasthan 302016, India. Where you engage us to process data on your behalf, we act as a data processor and you remain the controller.

Access to your systems

• Every person assigned to your account signs a confidentiality agreement before any access is granted.
• Access is given to named individuals only. We do not use shared accounts or a rotating pool of staff.
• We ask for the least access that lets the work happen - read-only where read-only is enough.
• We prefer that you create and own the accounts, so you can revoke them yourself at any moment without going through us.
• When someone rolls off your account, we tell you and ask you to remove their access. We also remove it from our side where we control it.
• We keep a written record of who has access to what, and we'll share it with you on request.

Where your data sits

Wherever possible, your data stays in your systems. We work inside your cloud accounts, your data warehouse and your tools rather than copying data onto ours. That is deliberate: it keeps you in control, keeps your data in whatever region you've chosen, and means there is no second copy to worry about.

Where a piece of work genuinely requires data to be processed on our infrastructure, we'll agree it with you in writing first, tell you where it will be held, and delete it when the work is finished.

Working practices

• Company-managed devices with full-disk encryption, screen lock and endpoint protection.
• Multi-factor authentication on every account that supports it.
• Credentials held in a password manager, never in spreadsheets, chat messages or code.
• No client data on personal devices, personal email or personal cloud storage.
• Code and configuration held in version control with reviewed changes.
• Security and confidentiality training for every person at induction.

Sub-processors

We use a small number of third-party services to run our own business - email and document storage, video calls, source control, and project management. We do not place client data into third-party services beyond those without telling you. If a piece of work would involve a new sub-processor, we'll name it and get your agreement first.

AI and language models

This matters more than it used to, so we'll be specific. We use AI tools in our work, and we apply three rules:

• We do not paste client data into consumer AI tools.
• Where AI is used on your data, it runs through business or enterprise agreements with training on your inputs disabled, or inside your own cloud account.
• If you would rather we used no AI on your data at all, say so and we'll work that way. It's your call, not ours.

Data protection law

We work with clients in India, the UK, the EU, the US, the Middle East and APAC, and we'll sign the paperwork your jurisdiction requires.

• UK and EU (UK GDPR / GDPR). We'll enter into a Data Processing Agreement including Standard Contractual Clauses covering transfer to India, and support you on data subject requests, breach notification and records of processing.
• India (DPDP Act 2023). We act as a Data Processor under the Act and will contract on that basis.
• United States. We'll sign your DPA and, where relevant to your sector, work to your specific requirements.

If something goes wrong

If we become aware of a security incident affecting your data, we will tell you without undue delay and in any case within 24 hours of becoming aware of it. We'll tell you what we know, what we don't yet know, what we're doing about it, and what we need from you. We will not wait until we have a complete picture before making contact.

Intellectual property

Everything we build for you - code, dashboards, pipelines, documentation, automations - belongs to you on payment. We don't hold your work hostage, and we don't reuse your data or your build for another client. On request at the end of an engagement, we'll hand over documentation and access and delete what we hold.

What we don't claim

Questions

Security questionnaires, DPAs and vendor assessments go to [email protected]. We turn them around quickly - usually within two working days.