Mixel PBXLegal & ComplianceSign in →

Data Processing Agreement

Data Processing Agreement

When a business customer uses Mixel PBX to handle the personal data of its own users, the customer is the controller and Mixel is the processor. We offer every business customer a data processing agreement (DPA) that meets Article 28 of the GDPR and the equivalent requirements of the revised Swiss FADP.

Effective 3 June 2026

What the DPA covers

Our DPA sets out, among other terms, that we will:

  • process personal data only on the customer’s documented instructions;
  • ensure that personnel authorised to process the data are bound by confidentiality;
  • implement appropriate technical and organisational security measures (Article 32), including tenant isolation, encryption in transit, access control and audit logging;
  • engage sub-processors only under a general written authorisation, with advance notice of changes and a right for the customer to object; flow equivalent obligations down to each sub-processor; and remain liable for their performance (our current list is published on the sub-processors page);
  • assist the customer with data-subject requests, security breach notification, and data protection impact assessments;
  • delete or return personal data at the end of the service, subject to any legal retention obligation;
  • make available the information needed to demonstrate compliance and allow for audits (accepting recognised third-party reports and on-cause audits);
  • apply a valid international transfer mechanism for any transfer outside Switzerland / the EEA — the EU Standard Contractual Clauses (2021) with the UK addendum where relevant, and the Swiss-US Data Privacy Framework / Swiss adaptations for Swiss data.

How the agreement is structured

The DPA is incorporated into, and read together with, the main services agreement between Mixel and the customer. Liability and term align with that agreement. The DPA references the published sub-processor list and the transfer mechanisms applicable to each.

Requesting a signed DPA

Business customers who need a counter-signed DPA for their records can request one from [email protected]. Please include your organisation’s legal name and the signing contact, and we will provide the agreement for signature.

Related

See also our Privacy Notice and sub-processor list.