GDPR Policy
This policy describes how MixCommerce supports compliance with the General Data Protection Regulation (EU) 2016/679 and the UK GDPR when organizations use MixStaff. It supplements our Privacy Policy.
1. Roles
The organization that uses MixStaff (the "Customer", usually an employer) is the controller of personal data about its people. It determines the purposes and means of processing, including whether to enable monitoring features, what to collect, who can access it, how long to retain it and the lawful basis relied on under Article 6. MixCommerce is a processor and handles that data only on the Customer's documented instructions, which are the agreement, the settings the Customer selects in MixStaff and any further written instructions.
MixStaff is a tool. It gives the Customer the means to take the actions that data protection law may require, but it does not decide on the Customer's behalf and it does not make the Customer compliant. Responsibility for lawful use rests with the Customer.
2. What the Customer decides
- The purposes of processing and the lawful basis, including any balancing test for legitimate interests.
- Whether a data protection impact assessment is needed, and consultation with employees or their representatives where required.
- Which optional features are enabled (activity measurement, application and website usage, screenshots, location) and for which teams.
- Retention periods, subject to statutory retention duties.
- Information given to its people under Articles 13 and 14.
- Responses to requests from individuals within the legal time limits.
- Notification of personal data breaches to authorities and individuals where required.
3. Tools MixStaff provides to the Customer
- A privacy centre for records of processing activities, lawful basis and purpose per activity, vendors and transfers, impact assessments and incidents.
- A workflow to receive and track requests for access, rectification, erasure, restriction, portability and objection, with deadlines and identity verification.
- Export of a person's data and erasure of monitoring data.
- Configurable retention with automatic deletion of expired data.
- Privacy notices with version tracking, shown to employees.
- Role based access, audit logging of access to monitoring data, and options to limit measurement to selected teams.
If you need a further feature to help meet your obligations, write to support@mixcommerce.co and we will consider it.
4. MixCommerce commitments as processor
- Process personal data only on the Customer's instructions, unless required by law.
- Ensure that people authorized to process the data are bound by confidentiality.
- Apply appropriate technical and organizational security measures under Article 32.
- Use sub-processors only with appropriate contractual terms, and make a list available on request.
- Assist the Customer, by appropriate measures, with requests from individuals, security, breach notification and impact assessments.
- Notify the Customer without undue delay after becoming aware of a personal data breach affecting its data.
- Delete or return personal data at the end of the services, at the Customer's choice, unless law requires storage.
- Make available the information needed to demonstrate compliance and allow reasonable audits.
5. Sub-processors and transfers
Providers that may process Customer data, depending on configuration, are listed in section 5 of the Privacy Policy. International transfers rely on adequacy decisions or Standard Contractual Clauses where required. A data processing agreement is available on request.
6. What MixStaff does not collect
MixStaff does not record keystroke content, passwords, clipboard contents, form values, audio or webcam images. Activity measurement uses counts and durations only.
7. Individuals
If you are an employee or other individual, please direct requests about your data to your employer. We will assist your employer as required. For data for which MixCommerce is the controller, write to support@mixcommerce.co.
8. Important notice
This page is general information and not legal advice. Customers should obtain their own advice on the lawfulness of their use of MixStaff.
Contact: support@mixcommerce.co