Technical and Organisational Measures

Applies to: the SAP consulting, development and support services of MIXCONIX, where we work by remote access in the customer’s systems. Does not apply to: the Business Partner Validator application, which runs on SAP® Business Technology Platform and is covered by the Data Processing Agreement.

The German version of this document is the authoritative one.

1. General

This document describes the technical and organisational measures that MIXCONIX.COM SRL (“MIXCONIX”) takes to protect personal data which it processes on behalf of its customers. Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing, the measures ensure a level of security appropriate to the risk within the meaning of Art. 32 GDPR.

Personal data of the customer or of the controller is, as a rule, processed in their systems by remote access. For these services MIXCONIX operates no data centres and no servers of its own for storing customer data.

2. Confidentiality

Art. 32(1)(b) GDPR.

2.1 Physical access control

• Office premises in Brașov with an electronic access system; employees enter only with a personal chip card.
• Intruder alarm system, armed outside working hours and connected to a security company with an intervention service.
• Access media, badges and devices are returned when employment ends.
• Mobile work only on company-owned, encrypted devices; screen content must be protected from being viewed by third parties; no use of public or third-party computers.

2.2 System access control

• Company-owned devices only; private devices are not permitted for processing customer data.
• Full-disk encryption on all notebooks.
• Personal, uniquely assigned user accounts; no shared or group accounts.
• Multi-factor authentication (MFA) for all cloud services in use.
• Password rules following BSI IT-Grundschutz ORP.4: at least 14 characters, no reuse across services, immediate change on suspicion of compromise. Lockout after five failed attempts where the system supports it.
• Automatic screen lock on inactivity.
• Remote access to internal resources only through a self-operated, encrypted VPN with key-based authentication.
• Access to the systems of the customer or controller only through the access they provide (for example VPN, personal SAP users) and in line with their security requirements.
• Firewall at the office internet gateway; protection against malware through the protection mechanisms of the operating system and prompt installation of security updates for the operating system and applications.

2.3 Data access control

• Authorisations are assigned on a need-to-know and least-privilege basis, per project.
• In the controller’s systems, authorisations are assigned by the controller or customer under their authorisation concept; MIXCONIX requests only the roles required for the engagement.
• Administrative rights in the cloud services are limited to named administrators.
• Authorisations are withdrawn without delay at the end of a project or when an employee leaves; the customer is notified so that the customer user IDs can be deactivated.
• No downloads or local copies of the controller’s productive data and no use of removable media, unless expressly instructed.
• Devices are securely erased before being passed on or disposed of.

2.4 Separation control

• Separate projects, spaces, repositories and folders per customer, each with its own authorisations.
• Separation of development, test and production systems according to the controller’s system landscape; source code is managed separately from test and production environments.
• Anonymised or pseudonymised test data is used where possible.

2.5 Pseudonymisation and encryption

Art. 32(1)(a) GDPR.

• Encryption of all storage media on end devices.
• Transport encryption (TLS) for email and cloud services; encrypted remote access through VPN.
• Encryption of data at rest by the cloud providers in use.
• Pseudonymisation or anonymisation of data for test and analysis purposes where possible.

3. Integrity

Art. 32(1)(b) GDPR.

3.1 Transfer control

• Electronic transmission only over encrypted channels (TLS, VPN).
• Personal customer data is transmitted only to authorised recipients at the customer or controller; no disclosure to third parties without instruction.
• Sub-processors are engaged only as set out in the list of sub-processors.
• No use of private email accounts or private cloud storage for business data.
• Entering personal data or confidential customer information into generative AI services is prohibited unless the customer has agreed to it beforehand in text form.
• Storage media containing customer data are not physically transported.

3.2 Input control

• Changes in the controller’s SAP systems are traceable through personal user IDs, change documents and the transport system.
• All source code changes are versioned (commit history, pull requests with review).
• Four-eyes principle for transports into production systems, according to the controller’s requirements.
• Ticket-based documentation of tasks and changes.
• Logs must not be deleted or altered without approval.

4. Availability and resilience

Art. 32(1)(b) and (c) GDPR.

• The controller’s data remains in the controller’s systems and is backed up by the controller.
• Project documents and source code are stored in redundantly operated cloud services with versioning and restore functions; business-relevant data is not stored only locally.
• Spare hardware is kept available; a workplace is restored within one working day.
• Redundant internet connection (fixed line and mobile network).
• Documented business continuity and disaster recovery plan with defined recovery objectives; reviewed annually.

5. Regular testing, assessment and evaluation

Art. 32(1)(d), Art. 25 GDPR.

5.1 Data protection and information security management

• Binding information security policy for all employees.
• These measures, the information security policy and the continuity plan are reviewed at least annually and when circumstances require.
• All employees are bound to confidentiality (Art. 28(3)(b), Art. 29, Art. 32(4) GDPR); the obligation continues after employment ends.
• Annual security training with written confirmation, covering data protection, phishing recognition and the handling of generative AI (AI literacy measures under Art. 4 of the EU AI Act).
• A record of processing activities is kept under Art. 30 GDPR.

5.2 Incident response management

• Security incidents are reported internally without delay to the contact for information security.
• The customer is notified of personal data breaches without undue delay, at the latest within 24 hours of MIXCONIX becoming aware, with the information required by Art. 33(3) GDPR.
• All security incidents and the measures taken are documented.

5.3 Data protection by default

Art. 25 GDPR.

• Data minimisation: access only to the data required for the engagement; processing in the controller’s system instead of creating copies.
• Secure software development that takes the OWASP Top 10 into account, with code reviews.

5.4 Order control

• Processing only on documented instructions of the customer, on the basis of a contract under Art. 28 GDPR.
• Consulting and development services are provided by MIXCONIX employees only; subcontractors are not used for them.
• Sub-processors are engaged only under a contract according to Art. 28 GDPR and, for transfers to third countries, with appropriate safeguards under Chapter V GDPR (adequacy decision or standard contractual clauses).
• Service providers are selected with regard to their level of security and recognised certifications (for example ISO/IEC 27001).
• Customer data is returned or deleted at the end of the engagement as instructed by the customer.