MIXCONIX is an SAP partner.
Last updated: 15 May 2026 · Version 2.0
Controller: Mixconix SRL Applicable to: mixconix.com websites, marketing and sales interactions, customer and partner relationships, candidate / recruitment activities, and the Business Partner Validator (BPV) application offered via SAP Store Document version: 2.0 (SAP Store edition) Last updated: 15 May 2026 Aligned to: Regulation (EU) 2016/679 (GDPR); Romanian Law 190/2018; UK GDPR; Swiss FADP; Directive 2002/58/EC (ePrivacy) and Romanian Law 506/2004 (cookies); CJEU “Schrems II” jurisprudence and EDPB Recommendations 01/2020.
Controller (data controller for the purposes of GDPR): Mixconix SRL CUI: RO 31654250, ORC: J8 / 775 / 2013 Registered office: Str. Brândușelor 74, Green Centre, 3rd Floor, 500384 Brașov, Romania General contact: office@mixconix.com Privacy contact (preferred): office@mixconix.com, subject line “Privacy” Support: support@mixconix.com
Data Protection Officer (DPO). Where a DPO has been formally designated, the DPO is reachable at the privacy contact above. Where no DPO is appointed (the appointment of a DPO is not mandatory for Mixconix under Art. 37 GDPR given current processing volumes), privacy matters are handled by Mixconix’s Privacy Lead, who reports to the Managing Director.
Supervisory Authority. The Romanian supervisory authority is the Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (“ANSPDCP”), B‑dul G‑ral. Gheorghe Magheru 28‑30, Sector 1, București — https://www.dataprotection.ro.
This Privacy Policy describes how Mixconix, as Controller, processes personal data in the following contexts:
| Context | Mixconix’s role |
|---|---|
| Visitors to mixconix.com and related properties | Controller |
| Prospects, leads, and marketing recipients | Controller |
| Customers, customer contacts, and partners (CRM, contracts, support) | Controller |
| Candidates and applicants for jobs at Mixconix | Controller |
| Recipients of SAP Store Order Data shared with Mixconix when a customer subscribes to BPV via SAP Store | Controller for the limited purposes in Section 9 |
This Policy does not govern Mixconix’s processing of personal data on behalf of its customers when they Use the BPV application — that processing is governed by the Data Processing Agreement (DPA) between Mixconix and the customer, in which the customer is the Controller and Mixconix is the Processor. For BPV operational data flows, see the DPA and the SAP Store listing.
We process personal data only when we have a lawful basis under Art. 6 GDPR (and, where applicable, Art. 9 for special categories — although as noted in Section 3, we do not knowingly process such data). The lawful bases below correspond to the purposes we describe in this Policy.
| # | Purpose | Lawful Basis (Art. 6 GDPR) |
|---|---|---|
| A1 | Operate, secure, and ensure resilience of mixconix.com and related infrastructure | Legitimate interests (f) — securing systems, preventing fraud and abuse |
| A2 | Respond to inquiries; perform pre‑contractual steps; conduct and administer contracts; provide customer support | Contract (b) and legitimate interests (f); legal obligation (c) where applicable |
| A3 | Send newsletters about our activities, sector news, and product updates | Consent (a), revocable at any time |
| A4 | Marketing communications, surveys, promotions, and direct B2B outreach | Consent (a) where consent is required by ePrivacy / national law; otherwise legitimate interests (f) for B2B prospecting permitted under applicable law |
| A5 | Share data with third parties for commercial purposes (where applicable) | Consent (a) |
| A6 | Comply with legal, regulatory, accounting, tax, and anti‑money‑laundering obligations | Legal obligation (c) |
| A7 | Establish, exercise, or defend legal claims | Legitimate interests (f) |
| A8 | Receive SAP Store Order Data from SAP for provisioning, fulfilling, billing reconciliation, and supporting BPV subscriptions | Contract (b) with the customer; legitimate interests (f) in fulfilling the SAP Store transaction |
| A9 | Recruitment — process applications, conduct interviews, take hiring decisions, optionally retain in a talent pool | Contract / pre‑contractual steps (b); consent (a) for talent pool inclusion |
| A10 | Manage and monitor partner relationships (PartnerEdge program) and supplier relationships | Contract (b); legitimate interests (f) |
| A11 | Operational telemetry, application monitoring, and incident response for our internal IT | Legitimate interests (f) |
Where we rely on legitimate interests, we have performed a Legitimate Interests Assessment (LIA) and balanced our interests against the rights and freedoms of data subjects. You can request a summary of the LIA via the privacy contact.
| Category | Examples |
|---|---|
| Identification and professional data | Name, surname, employer, job title, role |
| Contact data | Business email, business phone, postal address |
| Commercial / contract data | Quotation history, contract terms, billing, payment status |
| Customer support data | Tickets, attachments, error reports, communication logs |
| Technical / usage data | IP address, device and browser identifiers, OS, referrer URL, pages viewed, click events, session metadata, error logs |
| Marketing preferences | Subscription status, click and open events, consent records |
| SAP Store Order Data (when applicable) | Customer entity name, billing reference, primary technical/business contact, edition, term, quantity, renewal status (shared by SAP with Mixconix — see Section 9) |
| Candidate / recruitment data | CV, application form, cover letter, interview notes, references where you provide them |
| Partner / supplier data | Partner contact, contract, performance and compliance records |
| Voluntary content | Any other information you submit via forms, email, phone, online meetings |
We do not knowingly process: special categories of personal data (Art. 9 GDPR); criminal conviction data (Art. 10); data of children under 16.
We obtain personal data from:
Our websites may be hosted by external infrastructure providers. Personal data inherent to web traffic (e.g., IP addresses, request metadata, contact form submissions, contract correspondence) may be processed on the host’s servers under a Data Processing Agreement (Art. 28 GDPR).
For fast and secure delivery we may use a Content Delivery Network (CDN) (e.g., Amazon CloudFront, Cloudflare). A CDN routes traffic between your browser and our origin via a distributed network and helps filter malicious traffic. CDN providers may set strictly necessary technical cookies.
Lawful basis: legitimate interests (Art. 6(1)(f)) in secure, fast, and reliable service provision; contract performance (Art. 6(1)(b)) where applicable.
International transfers. Where the hosting / CDN provider transfers data outside the EEA, we rely on SCCs supplemented by TIAs and additional technical measures (encryption, access controls).
We use cookies and similar tracking technologies (collectively, “cookies”). We use a Consent Management Platform (CMP) (e.g., OneTrust CookiePro, Cookiebot, or equivalent) to obtain, store, and manage your consent for non‑essential cookies.
| Cookie category | Lawful basis | Examples |
|---|---|---|
| Strictly necessary | Legitimate interests / legal obligation (no consent required) | Session cookie; CSRF token; load‑balancer cookie; CMP state |
| Preferences | Consent | Language; theme; remembered form fields |
| Analytics / statistics | Consent | Google Analytics 4; self‑hosted analytics |
| Marketing / advertising | Consent | Google Ads; LinkedIn Insight; Meta Pixel; conversion pixels |
You can manage your preferences in the cookie banner and in your browser. If you disable cookies, some website features may not function. Full details — including a complete list of cookies, their providers, purposes, and storage periods — are provided in our Cookie Policy (linked from the cookie banner and the website footer).
When you subscribe to BPV via SAP Store, SAP shares with us — as an independent controller of the marketplace — the minimum SAP Store Order Data necessary to provision, fulfill, bill‑reconcile, support, and renew your subscription. This is the only SAP Store Order Data we receive, and we process it as Controller for the limited purposes below.
| Element of SAP Store Order Data | Purpose for which we process it |
|---|---|
| Customer entity name and registered country | Identify the subscriber; tax handling |
| Order reference and edition / quantity | Provision the correct BPV Tenant; license control |
| Term, start date, renewal status | Lifecycle management; renewal notices |
| Primary business contact (name, email) | Account communications; commercial follow‑up |
| Primary technical contact (name, email) | Onboarding, support, security advisories |
| Billing reference (where SAP shares it) | Internal billing reconciliation |
We do not receive your end‑customers’ personal data via the SAP Store flow — your end‑customers’ data is processed inside BPV under the DPA, with you as Controller and Mixconix as Processor. See the DPA, Annex V, for the data‑flow boundary.
Retention. SAP Store Order Data is retained for the duration of the subscription plus the statutory retention period applicable to the underlying commercial transaction (typically 10 years for accounting/tax records under Romanian law).
Onward sharing. We share SAP Store Order Data only with our internal CRM, billing, and support tooling Sub‑processors (Annex A) under Art. 28 GDPR contracts.
We may use the following categories of tools — exact tools in use at any time are listed in Annex A and in the Cookie Policy. Each tool is enabled only on the lawful basis identified.
Our web and application servers automatically record technical data: browser type and version; operating system; referrer URL; hostname; time of request; IP address; HTTP status; URL paths. We rely on legitimate interests (Art. 6(1)(f)) for the technical operation, integrity, security, and optimization of our systems.
Logs are retained for up to 12 months (shorter where feasible). Security‑relevant logs may be retained longer where necessary for investigation and incident response.
We use online conferencing tools (e.g., Microsoft Teams, Google Meet, Zoom, GoToMeeting) for meetings, webinars, demos, and trainings. Providers process metadata (IP, device info, time) and any content you exchange (chat, recordings — only with explicit notice and consent for recording).
Lawful basis: contract (Art. 6(1)(b)) or legitimate interests (Art. 6(1)(f)); consent (Art. 6(1)(a)) for recordings where required.
International transfers are covered by SCCs and supplementary measures where the provider processes data outside the EEA.
If you apply for a job at Mixconix, we process your application data (contact details, CV, cover letter, application form, interview notes, references you provide) for the purpose of evaluating your application and conducting the hiring process.
We maintain pages on platforms such as LinkedIn, Facebook, Instagram, and YouTube. When you visit our pages on these platforms, the platform may process your personal data under its own privacy policy. For certain processing activities (e.g., page insights), joint controller arrangements apply between Mixconix and the platform under Art. 26 GDPR.
You exercise rights against each platform directly through the platform’s tools, in addition to your rights against us.
Access to personal data is restricted to authorized personnel and contractors on a need‑to‑know basis, and to Processors providing services to Mixconix (hosting, analytics, marketing, CRM, recruitment, communications, accounting). All Processors are bound by Art. 28 GDPR data processing agreements and, where relevant, the SCCs.
A list of categories and named Processors is in Annex A.
We may also disclose personal data:
Where personal data is transferred outside the EEA (e.g., to processors operating from the UK, Switzerland, US, or other third countries), we ensure appropriate safeguards under Chapter V GDPR:
We prefer EU‑resident instances of vendor services where available (e.g., Microsoft 365 EU Data Boundary, Google EU regions, EU‑hosted CDN POPs). Where not feasible, we transparently disclose the transfer and the applicable safeguard.
A copy of the SCCs or IDTA covering a specific transfer is available on request, with redactions of commercially sensitive information.
In the context of our websites and CRM, we do not make decisions about you based solely on automated processing — including profiling — that produce legal or similarly significant effects on you within the meaning of Art. 22 GDPR.
For the BPV application, AI‑assisted matching, similarity, and anomaly detection are used as decision‑support for the customer’s human credit/master‑data/compliance teams. AI processing in BPV is described in the EULA (Section 10) and DPA (Section 4 and Annex II); the customer (as Controller) is responsible for ensuring human oversight of decisions informed by BPV outputs.
We employ technical and organizational measures appropriate to the risk, including:
For BPV specifically, additional measures are described in DPA Annex II.
We apply the principle of storage limitation (Art. 5(1)(e) GDPR). Illustrative retention periods are in Annex B. After expiry of the retention period, personal data is securely deleted or anonymized.
You have the following rights, subject to the conditions in GDPR:
Submit your request to office@mixconix.com (subject line: “Privacy — DSR”). We will respond without undue delay and within one month, extendable by two additional months for complex or numerous requests, in which case we will notify you of the extension and reasons within the first month.
We may need to verify your identity before fulfilling the request, in particular for access requests. If you submit on behalf of another person, we may require proof of authority.
We do not charge a fee for routine requests. We may charge a reasonable fee or refuse to act on manifestly unfounded or excessive requests (Art. 12(5) GDPR).
The detailed Data Subject Request workflow is in Annex C.
Some providers may process data in countries without an adequacy decision (e.g., the United States). Such jurisdictions may have laws permitting authorities to access personal data. We have assessed and continue to monitor these risks through TIAs and implement supplementary measures where appropriate. Where you have concerns about a specific transfer, contact us at office@mixconix.com.
Our websites and services — including BPV — are directed at business users only. We do not knowingly collect personal data from children under 16. If you believe we have collected data of a child, please contact us at office@mixconix.com and we will promptly delete it.
We may update this Policy to reflect legal, technical, or business developments. The current version is published on mixconix.com with an updated “Last updated” date. Material changes will be communicated by appropriate means (banner, email to subscribers/customers, or notice in the application).
For privacy questions, requests, or complaints:
To exercise your rights, see Section 21 and Annex C.
The table below lists categories and named providers Mixconix engages as Processors (Art. 28 GDPR). The list is updated upon material change.
| Category | Provider (illustrative — current vendor list confirmed at order) | Purpose | Data Categories | Legal Basis / Safeguards |
|---|---|---|---|---|
| Hosting / CDN | Amazon CloudFront (or Cloudflare, EU POPs preferred) | Website hosting, CDN, edge security | IP, technical / usage data | Art. 6(1)(f); Art. 28 DPA; SCCs where applicable |
| Email / collaboration | Microsoft 365 — Microsoft Ireland Operations Ltd. (EU Data Boundary) | Email, calendar, document collaboration, SMTP for BPV notifications | Contact data; correspondence; attachments | Art. 6(1)(b), 6(1)(f); Microsoft Online Services DPA |
| CRM | HubSpot Ireland Ltd. (EU region) | Lead and customer management, marketing automation | Identification, contact, interaction history | Art. 6(1)(b), 6(1)(f), 6(1)(a) for marketing |
| Forms | Typeform / HubSpot Forms | Form submissions | Identification, contact, content | Art. 6(1)(b), 6(1)(a), 6(1)(f); SCCs as applicable |
| Web analytics | Google Analytics 4 (Google Ireland Ltd.) | Site usage analytics | Pseudonymous IDs, usage | Consent; SCCs |
| Advertising | Google Ads, LinkedIn Insight Tag, Meta Pixel | Campaign measurement, audiences | Pseudonymous IDs, usage | Consent; joint‑controller arrangements (Art. 26) with Meta and LinkedIn |
| Tag management | Google Tag Manager | Tag deployment | IP (limited), tag metadata | Art. 6(1)(f); consent for tags it deploys |
| Embedded video | YouTube (Google Ireland Ltd.) | Embedded videos | Usage data when played | Consent; privacy‑enhanced mode where available |
| Consent management | OneTrust CookiePro (or Cookiebot, EU) | Cookie consent collection and storage | Consent preferences, IP, device | Art. 6(1)(c), 6(1)(f) |
| Workflow automation | Zapier / Make | Internal automations | Varies per workflow (minimized) | Art. 6(1)(f); consent where required; SCCs as applicable |
| Online meetings | Microsoft Teams; Google Meet; Zoom | Online meetings, webinars | Contact, metadata, content | Art. 6(1)(b), 6(1)(f); consent for recordings |
| Recruitment | LinkedIn Talent / ATS provider (EU‑hosted) | Candidate pipeline management | Candidate data | Art. 6(1)(b); consent for talent pool |
| Accounting / billing | EU‑based accounting and billing provider | Accounting, invoicing | Customer contact and billing | Art. 6(1)(b), 6(1)(c) |
| Observability | Sentry / Datadog (EU region) | Application monitoring | Pseudonymized telemetry | Art. 6(1)(f); Art. 28 DPA |
| Support ticketing | Atlassian Jira Service Management (or Zendesk) | Customer support | Contact, ticket content | Art. 6(1)(b), 6(1)(f); SCCs as applicable |
For SAP Store Order Data (Section 9): SAP SE shares with Mixconix the minimum order/customer information necessary for provisioning and support of BPV; the underlying flow is documented in DPA Annex V.
For the BPV application Sub‑processors: see DPA Annex III, which is authoritative for application‑level processing.
| Data Category | Retention Period | Rationale |
|---|---|---|
| Contracts and invoicing | 10 years | Statutory accounting / tax retention (Romania) |
| Customer support tickets | 3 years from closure | Limitation periods for claims |
| Marketing / newsletter | Until withdrawal of consent or 2 years of inactivity | Best practice; consent‑based |
| Server logs (web/app) | Up to 12 months; shorter where feasible | Security and troubleshooting |
| Security event logs | Up to 24 months | Security investigation and incident response |
| Cookie consent records | 2 years or per CMP defaults | Demonstrate consent (Art. 7 GDPR) |
| SAP Store Order Data | Term + statutory retention (typically 10 years) | Commercial / accounting |
| Recruitment data | 6 months after closure; longer with consent | Defense of claims; talent pool |
| Online meeting recordings | 6 months unless contractually required longer | Defined‑purpose retention |
| DSR request records | 5 years | Accountability (Art. 5(2)) |
Escalations: complaints about a DSR response can be lodged with ANSPDCP.
| Category | Purpose | Examples |
|---|---|---|
| Strictly necessary | Site availability, security, CMP state | Session cookie, CSRF, CMP consent‑state |
| Preferences | Remember user choices | Language, theme |
| Statistics | Anonymous / pseudonymous usage analytics | _ga, _gid (with anonymized IP) |
| Marketing | Personalized advertising and measurement | _fbp (Meta), li_* (LinkedIn), IDE (Google Ads) |
| Embedded content | Third‑party media playback | YouTube cookies (privacy‑enhanced mode if applicable) |
Detailed list — including each cookie’s provider, expiry, and storage scope — is in the Cookie Policy on the website, populated dynamically by the CMP.
This Annex describes the data flow specific to SAP Store, complementing Section 9 of this Policy and Annex V of the DPA.
End of Privacy Policy.
