Roles
When a firm uses Number Geniuses, the firm is the controller (or business, where CCPA applies) of the personal information in its workspace, and Number Geniuses is the processor (service provider). We process that information only on the firm's documented instructions.
What we process and why
- Categories
- Contact details, matter descriptions, communication records, call recordings, staff account data.
- Purpose
- Providing the intake, communication and workflow features the firm configures.
- Duration
- For the term of the firm's subscription, plus a reasonable export window.
Subprocessors
We engage the subprocessors listed on our subprocessors page and notify firms of additions. Where a subprocessor touches personal information, we flow down equivalent obligations.
Security
- Encryption in transit and at rest; credentials are never stored in plaintext.
- Row-level access controls scoped to each firm.
- Least-privilege access for our own staff, with audit logging.
Assisting data subject requests
We help firms respond to access, correction, deletion and portability requests within statutory timelines. Firms can also exercise most controls directly inside the workspace.
Incident notification
If we become aware of unauthorized access to firm data, we notify the affected firm without undue delay and provide the information needed to meet the firm's own notification duties.