Data Processing Agreement

The merchant decides why and how the personal data it manages in Margixa is processed, and is the controller. Margixa B.V. (KvK 42101008) processes that data on the merchant's behalf, and is the processor. This agreement is part of the Terms of Service, is accepted with them, and applies for as long as we process personal data for the merchant.

For the data of the merchant's own account, its billing and this website, Margixa is the controller · the Privacy Policy covers that.

The platform is not designed for special categories of personal data. If the merchant stores them, for example a medical note among HR documents, the merchant is responsible for having a legal basis · we protect them like all other data.

• Instructions.We process personal data only on the merchant's documented instructions: these terms, the settings the merchant chooses and the actions it takes in the platform. We tell the merchant if we believe an instruction breaks the GDPR. If EU or Dutch law requires other processing, we tell the merchant first, unless that law forbids it.
• Confidentiality. Everyone at Margixa who can access personal data is bound to confidentiality.
• Security. We take the technical and organisational measures described on our Security page and keep them up to date.
• Assistance. We help the merchant answer requests from data subjects and meet its obligations on security, breach notification, data protection impact assessments and prior consultation, as far as the nature of the processing and the information we have allow.
• Breaches. We notify the merchant of a personal data breach without undue delay after we become aware of it, with the information we have, and we keep the merchant updated.
• End of the agreement. We keep the data for 90 days so the merchant can restart the workspace or ask for an export. After that we delete it, unless the law requires us to keep it. Deleted data leaves our encrypted backups within 400 days.
• Audits.We make available the information needed to show that we meet this agreement. If that is not enough, the merchant, or an independent auditor bound to confidentiality, may audit us at the merchant's cost, with 30 days' notice and at most once a year, unless a breach calls for more.

• The merchant authorises us to use subprocessors. The current list is in section 5 of the Privacy Policy. We bind each one by contract to the same data protection obligations, and we remain responsible for them.
• We tell the merchant by e-mail at least 30 days before we add or replace a subprocessor. If the merchant objects on reasonable grounds and we find no solution, the merchant can cancel before the change applies.
• Marketplaces, carriers and accounting software that the merchant connects receive data on the merchant's instruction · they are the merchant's own providers, not our subprocessors.

Our infrastructure runs in EU regions. Where a subprocessor processes data outside the European Economic Area, the transfer is covered by an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework, or by the Commission's Standard Contractual Clauses.

The liability terms of the Terms of Service apply to this agreement. Where this agreement and the Terms of Service differ on the protection of personal data, this agreement prevails.

Questions about this agreement · support@margixa.com.