MIXCONIX is an SAP partner.
Last updated: 15 May 2026 · Version 2.0
Application: Business Partner Validator (BPV) for Document and Compliance Reporting Provider / Processor: Mixconix SRL Distribution channel: SAP Store Hosting platform: SAP® Business Technology Platform (SAP® BTP) SAP partner track: SAP PartnerEdge — Build (Cloud) Document version: 2.0 (SAP Store edition) Last updated: 15 May 2026 Aligned to: Regulation (EU) 2016/679 (GDPR); EU Standard Contractual Clauses 2021/914; ICO IDTA (UK); Swiss FADP; SAP PartnerEdge Build Cloud Specific T&C Art. 10 (Data, Personal Data, Access to Data); SAP Trust Center materials applicable to SAP BTP.
This Data Processing Agreement (“DPA”) forms an integral part of the agreement between Mixconix SRL (CUI: RO 31654250, Str. Brândușelor 74, Green Centre, Brașov, Romania) (“Processor”, “Mixconix”) and the customer identified in the SAP Store order or Order Form (“Controller”, “Customer”), collectively the “Parties”.
It governs the Processing of Personal Data carried out by Mixconix on behalf of the Customer in connection with the Business Partner Validator (BPV) application, which is operated by Mixconix as a multi‑tenant SaaS application on SAP Business Technology Platform (SAP BTP) and distributed via SAP Store.
This DPA does not govern SAP’s own processing of Personal Data under SAP’s separate contractual relationships with the Customer (e.g., the Customer’s direct subscription to SAP BTP and SAP Store transactions). For those, SAP’s own data processing terms apply. See Section 2 and Annex V for the SAP Store / SAP BTP data‑flow boundary.
Capitalized terms not defined here have the meaning given in the underlying Terms and Conditions, the EULA, or the GDPR, as applicable.
For all Customer Content processed by BPV (master‑data validation, enrichment, compliance reporting), the Customer is the Controller and Mixconix is the Processor. Mixconix processes Customer Content only on the Customer’s documented instructions, which are given (a) through the configuration of BPV, (b) through the SAP Store order, and (c) through any written notices to Mixconix.
Where the transaction is concluded via SAP Store, SAP processes the SAP Store Order Data (identity of the Customer, order details, billing information) as an independent controller for marketplace operations, in accordance with SAP’s own privacy notices and Customer’s direct relationship with SAP. SAP shares with Mixconix only the minimum SAP Store Order Data necessary for provisioning, fulfillment, billing reconciliation, and support of BPV. Mixconix processes such information for those limited purposes consistent with the Mixconix Privacy Policy.
SAP SE and its Associated Companies, together with the underlying hyperscaler operating the applicable SAP BTP region, act as Mixconix’s Sub‑processors for the SAP BTP infrastructure and platform services on which BPV runs (compute, storage, identity, persistence). They process Customer Content solely on Mixconix’s instructions for the purpose of providing the platform layer. Their identity is listed in Annex III and is updated when the SAP BTP region changes.
The following external validation sources operate as independent controllers of the data they hold and return. Mixconix queries these sources on behalf of the Customer; the legal basis for the query is the Customer’s instruction in BPV and the Customer’s legitimate business interest. Mixconix is not responsible for the lawfulness of these sources’ own processing.
| Source | Operator | Role | Endpoint |
|---|---|---|---|
| VIES (EU VAT validation) | European Commission (DG TAXUD) | Independent controller / public registry | ec.europa.eu/taxation_customs/vies — SOAP |
| ANAF | Agenția Națională de Administrare Fiscală, Romania | Independent controller / governmental | webservicesp.anaf.ro/PlatitorTvaRest — REST |
| BRREG | Brønnøysund Register Centre, Norway | Independent controller / governmental | data.brreg.no/enhetsregisteret — REST |
| Peppol SMP / SML / Directory | OpenPeppol AISBL & EU EDelivery | Independent controller / network directory | edelivery.tech.ec.europa.eu, directory.peppol.eu |
| OpenIBAN | OpenIBAN.com (community service) | Independent controller (free public service) | openiban.com — REST |
| ELSTER / SAP Document and Reporting Compliance | German Federal Tax Authority | Independent controller / governmental | as configured for statutory reporting |
These sources are queried only with the minimum identifier required (VAT ID, IBAN, Peppol ID, organization number). Mixconix does not transmit Customer Content beyond what is strictly necessary for the validation.
In the event of conflict: (i) this DPA prevails over the underlying Terms and Conditions, EULA, and Order Form for matters of personal‑data protection; (ii) the SCCs prevail over this DPA to the extent of any conflict in the context of cross‑border transfers (SCCs Clause 5); (iii) SAP’s own data‑processing terms apply to the Customer’s direct relationship with SAP and are not modified by this DPA.
This DPA applies for the term of the underlying Agreement and for any period during which Mixconix retains Customer Personal Data, including any limited retention permitted for legal, evidentiary, or backup purposes.
Mixconix processes Customer Personal Data to:
Prohibited uses (consistent with SAP PartnerEdge Build Cloud Specific T&C Art. 4(2)(c)): Mixconix shall not use Customer Content, SAP Materials, or any data derived from BPV to train, develop, fine‑tune, or enhance machine‑learning or artificial‑intelligence models, except where the Customer expressly instructs in writing and SAP authorizes such use.
Data Subjects:
Personal Data categories (as applicable to the BPV deployment):
Special categories of Personal Data (Art. 9 GDPR): None. BPV is not designed for special categories. Customer shall not submit such data.
Mixconix shall:
The Customer grants Mixconix a general authorization to engage the Sub‑processors listed in Annex III, including SAP SE (and its Associated Companies) and the underlying hyperscaler used by the applicable SAP BTP region.
Mixconix shall provide the Customer with at least 10 business days’ written notice before engaging a new Sub‑processor or replacing an existing one. The Customer may object on reasonable, data‑protection‑related grounds within that notice period. If the Parties cannot resolve the objection in good faith within 30 days, the Customer may terminate the affected portion of the Services and receive a pro‑rata refund of prepaid unused fees for the impacted functionality.
Mixconix shall impose data‑protection obligations on each Sub‑processor that are no less protective than those set out in this DPA, in particular regarding confidentiality, TOMs, and assistance with Data Subject rights. Mixconix remains liable to the Customer for the acts and omissions of its Sub‑processors.
BPV is provisioned by default in an EU region of SAP BTP (typically Frankfurt or Amsterdam). Customer Content is stored and primarily processed within the EEA.
Where Processing involves transfers of Personal Data outside the EEA/UK/Switzerland to a country without an adequacy decision, the Parties shall ensure appropriate safeguards under Chapter V GDPR. The SCCs (Module 2 Controller→Processor; Module 3 Processor→Sub‑processor) are incorporated into this DPA pursuant to Annex IV, together with the UK ICO IDTA and Swiss adaptations as applicable.
Mixconix has conducted, and shall periodically refresh, a TIA for transfers covered by Annex IV. The TIA considers the laws and practices of the destination country, government access regimes, and supplementary technical, organizational, and contractual measures.
Mixconix implements security measures appropriate to the risk as set out in Annex II (TOMs).
Certifications. Mixconix is certified under ISO 9001 (QMS) and ISO/IEC 27001 (ISMS). Mixconix relies on the platform‑level certifications maintained by SAP for SAP BTP (e.g., ISO/IEC 27001, ISO/IEC 27017, ISO/IEC 27018, SOC 1, SOC 2 Type II, BSI C5) for the hosting layer. Evidence of certification and current attestations are available on request and/or via the SAP Trust Center.
Clean core & tenant isolation. BPV is built on SAP “clean core” principles, uses shared XSUAA mode with strict tenant isolation, and applies role‑based access controls aligned with SAP BTP authorization.
Mixconix shall notify the Customer without undue delay and where feasible within 48 hours after becoming aware of a Personal Data Breach affecting Customer Personal Data.
The notification shall include, to the extent known:
Where not all information is available at the time of the initial notification, Mixconix shall provide updates as further information becomes available. Mixconix shall cooperate with the Customer in fulfilling any notification obligations to Supervisory Authorities and Data Subjects.
Upon reasonable prior written notice (no less than 30 days, except in case of a Personal Data Breach or where required by a Supervisory Authority) and no more than once per 12 months, the Customer (or an independent auditor mandated by the Customer and not a competitor of Mixconix) may conduct an audit limited to materials necessary to verify compliance with this DPA.
The Customer may satisfy its audit obligations by reviewing Mixconix’s then‑current ISO 27001 certification, SOC reports, and SAP BTP platform attestations available via the SAP Trust Center, before requesting any on‑site audit.
Audits shall be conducted during business hours, in a manner that minimizes disruption, and shall preserve confidentiality and the security of other customers’ data. The Customer bears its own audit costs unless a material breach is established, in which case Mixconix shall bear reasonable costs.
Mixconix maintains records of Processing activities carried out on behalf of the Customer as required by Article 30(2) GDPR and shall, upon reasonable request, provide assistance to the Customer in demonstrating compliance with Applicable Data Protection Law, in conducting Data Protection Impact Assessments (Article 35), and in any prior consultation with the Supervisory Authority (Article 36).
Within 30 days after termination or expiry of the underlying Agreement (or such other period agreed in writing), Mixconix shall, at the Customer’s option, securely delete or return all Customer Personal Data and delete existing copies, unless retention is required by EU or Member State law. Backups are overwritten on the next scheduled cycle (typically within 35 days). Upon request, Mixconix shall provide a certificate of deletion signed by an authorized representative.
Mixconix ensures that persons authorized to Process Personal Data are subject to written confidentiality obligations at least as protective as those in the underlying Terms and Conditions and receive regular training on data protection and information security. Confidentiality obligations survive termination for at least 5 years, and indefinitely for trade secrets.
Liability under this DPA is governed by the limitations and exclusions of liability set out in the underlying Agreement, to the maximum extent permitted by Applicable Data Protection Law. Nothing in this DPA limits liability that cannot be limited under mandatory law, including Data Subjects’ rights under Article 82 GDPR.
Severability. If any provision of this DPA is held invalid, the remaining provisions remain in full force and effect.
Conflicts. In case of conflict between this DPA and the underlying Agreement, this DPA prevails for data‑protection matters. The SCCs (Annex IV) prevail over this DPA in the context of cross‑border transfers.
Governing Law and Jurisdiction. This DPA is governed by the laws of Romania. The competent courts are those of Brașov, Romania, save where the SCCs require a different forum for SCC‑related disputes.
Amendments. Amendments shall be in writing and signed by both Parties. SAP‑mandated changes to SAP PartnerEdge or SAP Trust Center materials may be implemented by Mixconix upon written notice to the Customer.
A. List of Parties
B. Description of Transfer
| Element | Detail |
|---|---|
| Categories of Data Subjects | Customer personnel; business partners’ contacts (suppliers, customers, contractors). |
| Categories of Personal Data | Identification/professional, contact, VAT, IBAN, address, technical/usage data, compliance reporting data. |
| Special categories | None. |
| Frequency of Transfer | Continuous, for the duration of the subscription. |
| Nature of Processing | SaaS provision on SAP BTP; validation; enrichment; compliance reporting; support; security operations. |
| Purpose of Processing | Operate BPV; validate master data; produce DRC‑aligned compliance reports. |
| Duration / Retention | Term of the Agreement + retention per Section 13. |
| Sub‑processor transfers | Per Annex III; covered by Module 3 SCCs where applicable. |
C. Competent Supervisory Authority The Supervisory Authority of the Controller’s main EU establishment. Where the Controller is established in Romania, the competent authority is the ANSPDCP (Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal).
| Domain | Measure |
|---|---|
| Access control | Role‑based access (RBAC) aligned with SAP BTP authorization (XSUAA); least privilege; MFA mandatory for administrative and privileged accounts; periodic access reviews. |
| Tenant isolation | Multi‑tenant SaaS with logical segregation of Customer data; no shared databases across tenants for Customer Content; clean‑core architecture. |
| Encryption | TLS 1.2+ in transit (cipher suites aligned with SAP BTP defaults). Encryption at rest provided by SAP HANA® Cloud / underlying SAP BTP services; secure key management via SAP BTP Credential Store. |
| Application security | Secure SDLC; mandatory code review; automated static and dependency scanning; vulnerability management with SLA‑bound remediation; SAP UI5 linter; manifest validation. |
| Operations | Documented change management; centralized logging and monitoring; alerting on security events; regular backups; periodic recovery testing. |
| Network security | SAP BTP network controls; egress restrictions; WAF/DoS protections (where applicable). |
| Supplier risk | DPAs with all Sub‑processors; SCCs for non‑EEA transfers; periodic vendor reviews; SAP Trust Center artefacts consulted for SAP BTP layer. |
| Business continuity | Documented incident response plan; disaster recovery plan; regular exercises; defined RTO/RPO per service tier. |
| Data minimization & retention | Configurable log and data retention aligned with Customer instructions; purge routines; pseudonymization in non‑production environments. |
| Personnel | Confidentiality agreements; pre‑employment checks per applicable law; mandatory security and privacy training at onboarding and annually. |
| Pseudonymization & anonymization | Production support access via pseudonymized identifiers where feasible; anonymized telemetry only for service improvement (no Customer Content reuse). |
| AI / LLM data masking | All inputs to LLMs (via SAP AI Core Orchestration) are masked using SAP DPI (Data Privacy Integration) prior to model invocation. Prompts and completions are not used for model training (per SAP Build Cloud Specific T&C Art. 4(2)(c)). AI usage transparency is logged via the BPV ai-transparency middleware. |
| External call minimization | Validation calls to external sources (VIES, ANAF, BRREG, Peppol, OpenIBAN, ELSTER/DRC) carry only the minimum identifier required; results are cached locally (typically 24h TTL) to reduce repeat exposure. |
The following Sub‑processors are engaged by Mixconix for the SAP Store edition of BPV. The list is updated upon material change with prior notice in accordance with Section 7.2.
Deployment topology note. Two deployment models exist and they affect who contracts SAP and the commercial Sub‑processors:
| # | Provider | Service | Role | Region | Data Categories | DPA Executed | Transfer Mechanism | Notes |
|---|---|---|---|---|---|---|---|---|
| 1 | SAP SE (and Associated Companies) | SAP BTP platform — Cloud Foundry runtime, XSUAA, Destination Service, Connectivity, HTML5 App Repo, App Logging, Job Scheduler, SAP HANA Cloud (persistence), SAP CAP / MTX multi‑tenancy, SAP Build Work Zone (where applicable) | Sub‑processor (Processor) — Model A; contracted by Customer under Model B | EU — Frankfurt (eu10) by default (confirm at Order Form) | Technical/usage logs, metadata, application content as configured by Controller | Yes — per SAP service terms / SAP DPA | N/A within EEA; SCCs if non‑EEA region selected | Under Model B, SAP is contracted directly by the Customer; this row does not apply to Mixconix’s chain. |
| 2 | SAP SE — SAP AI Core / Generative AI Hub with SAP DPI (Data Privacy Integration) masking | LLM‑backed similarity / matching / anomaly detection (address similarity, name match). Models accessed via SAP Orchestration: Anthropic Claude, OpenAI GPT‑4o, Google Gemini — all under SAP’s commercial terms with the model providers; inputs masked by SAP DPI before invocation; prompts and completions not used for training (per SAP Build Cloud Specific T&C Art. 4(2)(c)) | Sub‑processor (Processor) | EU — SAP AI Core EU | Masked / pseudonymized fields submitted as prompt; metadata | Yes — per SAP service terms / SAP DPA | N/A within EEA | LLM provider chain is governed by SAP under SAP’s terms with Anthropic / OpenAI / Google; Mixconix does not contract those providers directly. |
| 3 | Hyperscaler operating the SAP BTP region — AWS EMEA SARL / Microsoft Ireland Operations Ltd. / Google Cloud EMEA Ltd., as designated by SAP for the chosen region | Physical hosting (data center, network, storage) | Sub‑processor of SAP (not directly of Mixconix) | EU | Encrypted storage and network handling of all SAP BTP data | N/A — handled by SAP’s contractual chain | SAP’s SCCs apply if region outside EEA | Identity of the hyperscaler depends on the SAP BTP region SAP designates. |
| # | Provider | Service | Role | Region | Data Categories | DPA Executed | Transfer Mechanism | Notes |
|---|---|---|---|---|---|---|---|---|
| 4 | OpenIBAN (openiban.com) | IBAN validation (REST) | Sub‑processor where invoked by Mixconix on Controller’s behalf (server‑side call) | EU (confirm) | IBAN, derived bank code, response metadata | To be executed (DPA) | SCCs if transfers outside EEA | If the Controller integrates OpenIBAN directly from its front‑end without routing through Mixconix, OpenIBAN is not a Mixconix Sub‑processor. |
| 5 | Geoapify GmbH (Germany) — or alternatively Google Cloud — Google Maps Platform (per tenant configuration) | Address validation / geocoding via REST | Sub‑processor — enabled only on Controller instruction | Geoapify: EU; Google Maps Platform: EU/Global (confirm) | Address string; geocoding output (lat/long); request metadata | Geoapify: to be executed (DPA). Google: Google DPT in place (linked in Order Form) | Geoapify: SCCs if non‑EEA. Google: SCCs for non‑EEA processing | Disabled by default; enable only with the Controller’s explicit instruction. |
| # | Provider | Service | Role | Region | Data Categories | DPA Executed | Transfer Mechanism | Notes |
|---|---|---|---|---|---|---|---|---|
| 6 | Support / ticketing system — e.g., Atlassian Jira Service Management or Zendesk (confirm in Order Form) | Customer support and incident handling | Sub‑processor (if used) | (confirm) | Contact info; ticket content; attachments | To be executed (DPA) | SCCs if non‑EEA | Used for support‑only communications; not part of the runtime data path. |
| 7 | Mixconix observability provider — e.g., Sentry or Datadog (EU region) | Application monitoring, error tracking | Sub‑processor | EU | Pseudonymized / anonymized telemetry; no Customer Content | To be executed (DPA) | N/A within EEA | Stack traces are scrubbed before transmission where feasible. |
| 8 | Microsoft Ireland Operations Ltd. — Exchange Online / Microsoft 365 (smtp.office365.com) |
Outbound transactional email (job‑error alerts, support correspondence) | Sub‑processor | EU | Recipient address, subject, message body (operational only — no Customer Content beyond job/error identifiers) | Yes — Microsoft Online Services DPA / EU Data Boundary | N/A within EEA | Configured via env vars NOTIFY_SMTP_HOST, etc. |
| Provider | Service | Role | Notes |
|---|---|---|---|
| European Commission — VIES | EU VAT number validation (SOAP) | Independent Controller / public registry | Accessed transiently with only the VAT ID; no persistent storage by Mixconix beyond cache (24h TTL). |
| ANAF (Romania) | RO VAT / CUI validation (REST) | Independent Controller / governmental | Public free service; accessed transiently. |
| BRREG (Norway) | NO organization number validation (REST) | Independent Controller / governmental | Public free service; non‑EEA jurisdiction but governmental public registry, no transfer of additional Personal Data. |
| Peppol SMP / SML / Directory (OpenPeppol AISBL & EU EDelivery) | Peppol participant lookup | Independent Controller / network directory | Only the Peppol participant ID is queried. |
| ELSTER / DRC (German Federal Tax Authority) | DRC‑related compliance reporting endpoints | Independent Controller / governmental | Configured per tenant; accessed under the Controller’s legal obligations. |
BPV_S4H_DEST using API_BUSINESS_PARTNER and ZBPV_BILLING_SRV — the Customer is the controller (or processor under its own arrangements) of its own backend; Mixconix accesses it only on Controller instruction.The Parties enable Clause 7: additional Controllers/Processors may accede to the SCCs by signing an adherence document referencing this DPA.
As set out in DPA Annex I.
As set out in DPA Annex II. Sub‑processors implement TOMs not less protective than DPA Annex II.
Option 2 — General written authorisation. Sub‑processors listed in DPA Annex III are authorized. Mixconix shall give 10 business days’ notice of changes; the Customer may object on data‑protection grounds (Section 7.2).
Mixconix shall assist the Customer in responding to Data Subject requests and complaints in accordance with the SCCs and GDPR. Third‑party beneficiary rights under the SCCs are upheld. Copies of the SCCs may be provided to Data Subjects on request, with redactions of commercially sensitive information.
Upon termination, Mixconix shall delete or return the Personal Data at the Customer’s choice within 30 days, unless retention is legally required. Backups are overwritten on the next scheduled cycle.
The Parties shall make current copies of the executed SCCs (and DPA Annexes I–III) available to Supervisory Authorities and to Data Subjects upon request, with redactions of commercially sensitive information.
If any term of this DPA conflicts with the SCCs as incorporated, the SCCs control. UK Addendum and Swiss adaptations control for their respective transfers.
This Annex describes the data flows and roles specific to the SAP Store distribution channel and to BPV’s operation on SAP BTP.
At order placement and during the subscription lifecycle, SAP shares with Mixconix the minimum SAP Store Order Data necessary for provisioning, fulfillment, billing reconciliation, support, and renewal of BPV (e.g., Customer entity name, billing reference, primary technical/business contacts, edition/quantity, subscription term).
BPV runs on SAP BTP. SAP operates the platform layer (compute, persistence, identity, networking). The Customer has — or will have — a direct contractual relationship with SAP for the SAP BTP subaccount used by BPV (whether provisioned by the Customer or by Mixconix on the Customer’s behalf as part of the SAP Store offering). SAP’s own terms and SAP’s data‑processing terms apply to that SAP BTP relationship.
For the avoidance of doubt, with respect to Customer Content processed inside BPV, SAP acts as Mixconix’s Sub‑processor in operating the SAP BTP infrastructure (Section 2.3 and Annex III, entry 1).
The Customer may rely on the SAP Trust Center for SAP BTP’s platform‑level certifications, audit reports, sub‑processor information, and data‑residency commitments. Mixconix shall not duplicate or alter SAP’s representations; it shall instead inherit and reference them.
SAP may receive operational telemetry from BPV running on SAP BTP (usage measurements, error events, platform metrics). Such telemetry is processed by SAP for platform operations, security, and partner billing under SAP PartnerEdge. Mixconix shall ensure that telemetry transmitted to SAP does not include Customer Content unless strictly necessary for diagnostics and authorized by the Customer.
End of Data Processing Agreement.