Privacy Policy

Margixa is a cloud-based ERP platform for electronics merchants selling new and refurbished devices, operated by Margixa B.V., registered in the Netherlands (KvK 42101008 · VAT NL869729834B01), with its registered office at Westerstraat 10, Unit G7520 · 3016 DH Rotterdam · The Netherlands.

This policy covers both this website (margixa.com) and the Margixa platform (app.margixa.com). For questions about this policy or your data, contact us at support@margixa.com.

Margixa processes data in two distinct capacities, and the distinction matters:

• As a controller · for the data of our own customers (merchants) and their staff accounts, billing details, and website visitors.
• As a processor· for the business data our merchants manage inside Margixa (inventory, orders, suppliers, their end-customer records) and for marketplace buyer data processed on the merchant's behalf and instruction. Here the merchant is the controller and Margixa acts strictly under their instructions.

Margixa connects to sales channels (Amazon, Back Market, Refurbed, Shopify and others) on the merchant's behalf. We designed the platform to keep as little buyer data as possible:

• Order records mirrored into Margixa contain no buyer identity · only order identifiers, line items, quantities, amounts and order state.
• When a merchant fulfils an order, the buyer's name and delivery address are fetched from the marketplace on demand and used in memory to generate the shipping label. They are not written to our database or logs. The label PDF, which carries the address, is kept in a private storage bucket for 7 days and then deleted · our encrypted off-site copy follows within a day.
• Customer Care cases from Back Market and Refurbed are synced so the merchant can answer them in Margixa. We store the text of the messages and their attachments, not the buyer's name or e-mail address · those are fetched live when a case is opened.
• The buyer's delivery details are shared only with the shipping carrier the merchant has contracted (for example DHL Express or Sendcloud), solely to produce the label for that one shipment, at the merchant's instruction.
• Where a marketplace requires it (for example Amazon's Data Protection Policy), we comply with the marketplace's own data-handling requirements in addition to the GDPR.

We never sell personal data. We share data only with the service providers below, under data-processing agreements, and with the providers a merchant connects, at the merchant's instruction. We tell merchants by e-mail at least 30 days before a new subprocessor starts (see the Data Processing Agreement):

We may also disclose data where required by law or to protect our legal rights. Our infrastructure runs in EU regions; where a provider processes data outside the EEA, transfers are covered by the European Commission's Standard Contractual Clauses or an adequacy decision.

• Marketplace buyer data· the name and address used for a shipping label are not stored · the label PDF is deleted after 7 days (well within the strictest marketplace limit of 30 days) · Customer Care messages stay with their case for as long as the merchant's workspace exists.
• Merchant business data· retained for as long as the merchant's account is active. When the agreement ends, the workspace is kept for 90 days so the merchant can restart it or ask for an export, and is then deleted.
• Price requests · kept in our mailbox for as long as it takes to answer you and follow the conversation up · deleted whenever you ask.
• Backups · encrypted · daily copies are kept for 35 days and monthly copies for 400 days.
• Invoices and financial records · retained as required by EU and Dutch tax law (up to 10 years).

The Margixa platform (app.margixa.com) uses essential cookies only · they keep you signed in and the platform working. It runs no advertising cookies, no cross-site tracking and no third-party analytics.

This website (margixa.com) uses essential cookies, and asks before anything else. If you press Accepton the cookie banner, the Google Ads tag loads and sets cookies that tell us which of our ads brought you here (a click on an ad and, for example, a demo or price request that followed) and let us show our ads again to people who visited. Google Ireland Limited acts as an independent controller for that data under its own privacy policy. The same press loads the ChatGPT ads pixel of OpenAI, which does the same for our ads in ChatGPT, under OpenAI's own terms and privacy policy. The pixel also finds an e-mail address you type in a form here (the price request) and sends it to OpenAI hashed in your browser (scrambled one way, never readable as the address), so OpenAI can tell whether one of our ads brought you even when you come back later from another device. Google and Meta receive no such copy from us. The same press also loads the Meta pixel of Meta Platforms Ireland Limited, which does the same for our ads on Facebook and Instagram, under Meta's own terms and privacy policy. If you press Reject, or choose nothing, none of them loads and no advertising cookie is set.

Legal basis · your consent. You can change or withdraw it at any time under Cookie settings at the bottom of every page · withdrawing stops all three and removes the advertising cookies this site set. You can also delete or block cookies in your browser settings; blocking essential cookies may prevent signing in to the platform.

Security measures include encryption in transit (TLS) and at rest (AES-256), public-key sealing of marketplace credentials, per-tenant row-level isolation in the database, role-based access control, multi-factor authentication, audit logging and a documented incident-response plan. The full overview lives on our Security page.

If a personal-data breach occurs despite these measures, we notify the competent supervisory authority within 72 hours where required by the GDPR, inform affected merchants without undue delay, and honour the notification windows of the marketplaces involved.

Margixa makes no automated decisions that produce legal or similarly significant effects on individuals. Automation in the platform (such as repricing or stock synchronization) operates on products and orders under rules the merchant configures · not on people. The service is built for businesses and is not directed at children; we do not knowingly process children's data.

Under the GDPR you can request access, rectification, erasure, restriction, portability of your data, and you can object to processing based on legitimate interest. Where Margixa acts as a processor, we will route your request to the responsible merchant and assist them in answering it.

To exercise a right, email support@margixa.com. We respond within one month. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

When we change this policy we update the date at the top of this page. For material changes affecting merchants we tell them by e-mail at least 30 days in advance.