Data Processing Agreement

Annex I — Description of Processing Activities

Annex II — Technical and Organisational Measures (TOMs)

• Access control: Role-based access; least privilege; MFA for privileged accounts.
• Data protection: Encryption in transit (TLS); encryption at rest where platform-supported; secure key management.
• Application security: Secure SDLC; code review; dependency scanning; vulnerability and patch management.
• Operations: Change management; logging and monitoring; alerting; regular backups and recovery testing.
• Network security: Segmentation; firewalling; WAF/DoS protections where applicable.
• Supplier risk: DPAs with Sub-processors; SCCs for transfers; periodic vendor reviews.
• Business continuity: Documented incident response; disaster recovery plans; regular exercises.
• Data minimization & retention: Log retention and data purging aligned with Controller instructions.
• Employee measures: Confidentiality agreements; security and privacy training; onboarding/offboarding controls.

Annex III — Authorised Sub-processors

The following Sub-processors are engaged by MIXCONIX.COM SRL for Mixconix Services, or may be engaged depending on deployment model and region. Mixconix provides advance notice of changes; Controller may object on reasonable grounds within the notice period.

The current list of Sub-processors is available upon request from office@mixconix.com and is maintained as a living document.

Annex IV — Cross-Border Transfers and Standard Contractual Clauses (SCCs)

A. Incorporation and Scope

SCCs Incorporated. Where required by GDPR Article 46, the Parties agree that the European Commission's Standard Contractual Clauses of 4 June 2021 (Commission Implementing Decision (EU) 2021/914) are incorporated by reference as follows:

• Module 2 (Controller → Processor) for transfers from Controller (data exporter) in EEA/UK/CH to Processor (data importer) in third countries without adequacy decisions.
• Module 3 (Processor → Sub-processor) for onward transfers from Processor (exporter) to Sub-processor (importer) in such third countries.

Annex Mapping. DPA's Annex I serves as SCC Annex I (Description of transfer); Annex II serves as SCC Annex II (TOMs); Annex III serves as SCC Annex III (Sub-processor list).

Precedence. In case of conflict between this DPA and the SCCs, the SCCs prevail to the extent of the conflict (SCCs, Clause 5).

B. Parties and Roles

• Data exporter (Module 2): The Controller identified in Annex I.
• Data importer (Module 2): MIXCONIX.COM SRL (Processor).
• Data exporter (Module 3): MIXCONIX.COM SRL (Processor).
• Data importer (Module 3): The Sub-processor identified in Annex III.

C. Docking Clause (SCCs, Clause 7)

The Parties enable Clause 7 (Docking): additional controllers/processors may accede to the SCCs by executing an adherence document referencing this DPA and Annexes.

D. Description of Transfer (SCCs, Annex I(A)–(C))

Elements required by SCCs Annex I(A)–(C) are set out in DPA Annex I by reference, including: exporter/importer identities and contacts, categories of data subjects and data, frequency, nature and purpose of processing, processing duration and retention, and competent supervisory authority.

E. Technical and Organisational Measures (SCCs, Annex II)

The importer implements TOMs described in DPA Annex II (encryption in transit (TLS 1.2+), encryption at rest where platform-supported, key management, access control/MFA, logging & monitoring, secure development, BCM/backup, third-party due diligence, privacy by design). For Module 3, each Sub-processor must implement TOMs not less protective than Annex II.

F. Sub-processor Authorisation (SCCs, Clause 9)

1. General authorisation applies. Current Sub-processors are listed in Annex III.
2. The importer will notify exporter of intended Sub-processor changes (additions/replacements) at least 10 business days before engagement via standard notice channel (email to contact in Annex I).
3. Exporter may object on reasonable data-protection grounds; Parties will discuss in good faith. If unresolved within reasonable period, exporter may suspend/terminate affected processing (without penalty) and receive prorated refund for prepaid unused fees for impacted functionality.

G. Local Laws & Government Access Requests (SCCs, Clauses 14–15)

1. Transfer Impact Assessment (TIA). The importer has assessed, to best knowledge and experience, destination country laws relevant to Clause 14. The importer will re-assess periodically or upon material change.
2. Transparency & Challenge. If the importer receives legally binding public authority requests for personal data:
   • It will notify the exporter without undue delay (unless legally prohibited) and seek to lift any prohibition.
   • It will review request legality and challenge where reasonable.
   • It will disclose only minimum strictly required data and keep records.
   • It will provide aggregate transparency reporting where permitted (request counts).
3. Supplementary Measures. The importer maintains encryption in transit, access controls, data minimisation, and logging, and will apply additional case-by-case measures where needed to maintain essentially equivalent protection.

H. Data Subject Rights & Redress (SCCs, Clauses 10–12)

The importer will assist the exporter in handling data-subject requests and complaints per SCCs and GDPR. Third-party beneficiary rights under SCCs are upheld; copies of SCCs may be provided to data subjects on request with commercially sensitive information redacted.

I. Supervisory Authority, Governing Law & Forum (SCCs, Clauses 13, 17–18)

1. Supervisory Authority (Clause 13). The competent authority is the authority of the exporter's main EU establishment; where exporter is established in Romania, the competent authority is ANSPDCP (Romanian Supervisory Authority).
2. Governing Law (Clause 17). The Parties select the laws of Romania (an EU Member State allowing third-party beneficiary rights).
3. Jurisdiction (Clause 18). Disputes shall be brought before Romania courts; the courts of Brașov have jurisdiction where appropriate and permitted.

J. UK and Switzerland Add-ons

1. United Kingdom. For transfers subject to UK GDPR, the Parties incorporate the ICO International Data Transfer Addendum (IDTA) Addendum to the EU SCCs (version B.1.0 or latest).
   • Part 1 Tables: (i) Parties & contacts per DPA Annex I; (ii) Selected SCCs: EU 2021/914, Module 2 and/or 3; (iii) Appendix information: DPA Annexes I–III; (iv) Mandatory Clauses per ICO template.
   • Governing law & courts (UK): England and Wales.
2. Switzerland. For transfers subject to Swiss FADP, the Parties incorporate the SCCs with adaptations: references to "EU GDPR" include the Swiss FADP; references to "competent supervisory authority" include the Swiss FDPIC; jurisdiction is Switzerland per Clause 18.

K. Return/Deletion & Termination

Upon SCCs-governed processing termination, the importer will delete or return personal data at exporter's choice within 30 days, unless legally required. Backups are overwritten on next scheduled cycle.

L. Copies and Access to SCCs

The Parties will make current SCC copies (including this Annex and referenced Annexes I–III) available to supervisory authorities upon request. Data subjects may receive copies on request, with confidential information redactions.

M. Conflicts

If DPA terms (including other annexes) conflict with incorporated SCCs, the SCCs control. If UK Addendum or Swiss adaptations conflict with SCCs, the local addendum/adaptation controls for the respective transfer.