Sub-processors | MIXCONIX

Applies to: the SAP consulting, development and support services of MIXCONIX. Does not apply to: the Business Partner Validator application, which runs on SAP® Business Technology Platform and is covered by the Data Processing Agreement.

The German version of this document is the authoritative one.

1. Staffing

The consulting, development and support services are provided by MIXCONIX employees only. Subcontractors or freelancers are not used for these services.

2. Sub-processors

The following service providers may process personal data in the course of the services:

No.	Service provider (contracting party, seat)	Service / purpose	Data concerned	Place of processing	Legal basis and safeguards
1	Microsoft Ireland Operations Ltd., Dublin, Ireland	Microsoft 365: email, calendar, Office applications	Contact and communication data; content of project correspondence	EU (EU Data Boundary); support services possibly USA	Microsoft Products and Services DPA; standard contractual clauses (Implementing Decision (EU) 2021/914); EU-US Data Privacy Framework (Microsoft Corporation)
2	Atlassian Pty Ltd, Sydney, Australia	Jira and Confluence (Cloud): task and project documentation	Names and contact data of project participants; ticket content	Amazon Web Services data centres (EU/USA)	Atlassian Data Processing Addendum; standard contractual clauses (2021/914); EU-US Data Privacy Framework (Atlassian US, Inc.)
3	GitHub, Inc., San Francisco, USA	GitHub: source code management, code reviews	User IDs and commit metadata; source code	USA	GitHub Data Protection Agreement; EU-US Data Privacy Framework; standard contractual clauses (2021/914)
4	Dropbox International Unlimited Company, Dublin, Ireland	Dropbox: storage and exchange of project documents	Project documents, possibly with contact data of project participants	EU/USA	Dropbox Data Processing Agreement; standard contractual clauses (2021/914); EU-US Data Privacy Framework (Dropbox, Inc.)

3. Additional notes

Remote access: the VPN is operated by MIXCONIX itself; no third party is involved. Access to the controller’s systems takes place through the controller’s own infrastructure.
Generative AI: AI services are used only without personal data and without confidential information of the customer or controller. They do not process customer data and are therefore not sub-processors.
Other service providers without access to customer data (for example accounting, telecommunications, building security) are not sub-processors and are not listed.
Changes: MIXCONIX informs the customer in text form in advance of any intended addition or replacement of a sub-processor; the provisions of the data processing agreement apply.