Boardmix Data Process Agreement

About Data Processing Agreement (DPA)

This Agreement forms part of the Terms & Conditions and Private Policy between the parties (the “Principal Agreement”) and reflects the parties’ agreement with respect to the processing of personal data in accordance with Article 28 of the General Data Protection Regulation (EU) 2016/679 ("GDPR").

Boardmix and its affiliated entities (“Boardmix”, “we”, “us”) process personal data through our website (the “Website”), desktop application, and mobile application (collectively referred to as the “Application” or “Product”). We are fully committed to protecting your personal information and comply strictly with the EU General Data Protection Regulation (GDPR) and other applicable data protection laws. This agreement outlines the legal basis for data processing, security measures in place, and third-party data sharing arrangements.

1. How We Process Your Personal Data

Data Processing Roles and Scope

Boardmix acts as a data controller for personal data you provide directly (e.g., during account registration). In certain cases—such as when we process data on behalf of enterprise clients—we may act as a data processor, in which case a separate data processing agreement will be established with the enterprise.

Data Types, Processing Purposes, and Legal Bases

Data Type	Purpose of Processing	Legal Basis
Account information (email, username)	Account creation, authentication, service notifications	Contractual necessity (GDPR Art. 6(1)(b))
Device information (IP, browser type)	Service security, product optimization (anonymized)	Legitimate interests (GDPR Art. 6(1)(f))
File content, activity logs, crash reports	Collaboration, version control, troubleshooting	Contractual necessity + Legitimate interests
Audio, video, and photo data	Enable features like voice input, scanning, camera use	Contractual necessity
Payment-related information	Subscription, billing, refunds, technical support	Contractual necessity
User support records	Inquiries, troubleshooting support	Contractual necessity
Location information	Suspicious login detection	Contractual necessity

2. Our Data Security Commitment

To safeguard your personal data, we implement the following measures:

Encrypted Transmission: All data is transmitted using TLS 1.3 encryption protocol.
Access Control: Internal access to data is strictly limited, logged, and subject to regular audits.

3. Data Recipients and Sub-processors

This appendix forms part of the DPA and describes processing activities carried out by the provider on behalf of Boardmix (as the processor).

Contracting Parties

Role	Name	Address	Contact	Related Activities	Signature and Date
Controller / Data Exporter	User Name	User Provided Address	User Provided Contact	Data transfers covered under this DPA	Automatically deemed signed upon product use
Processor / Data Importer	Boardmix	As set out in the Agreement	support@boardmix.com	Data transfers covered under this DPA	Automatically deemed signed upon DPA execution

4. Cross-border Data Transfers

You authorize Boardmix and its sub-processors to transfer your personal data across borders as necessary. When data is transferred internationally:

We rely on EU Standard Contractual Clauses (SCCs) as the legal mechanism;
We apply additional technical safeguards (e.g., encryption) for sensitive data.

5. Your Data Rights

You may exercise the following rights by contacting us:

Right	Our Commitment
Access your data	A downloadable copy provided within 15 business days
Correct inaccuracies	Updates made within 3 business days
Erase your data	Deleted within 30 days, including backups (unless legally required to retain)
Restrict processing	Processing paused until the dispute is resolved
Data portability	Data provided in a structured format (e.g., JSON/CSV)

Note: Rights take effect upon successful identity verification. Misuse may result in service limitations.

6. Data Retention and Deletion

Active accounts: Data retained for up to 180 days post-account deletion for fraud prevention and dispute resolution.
Account deactivation: Triggers automatic data deletion. Logs are retained for 6 months for audit purposes.
Legal obligations: Certain records (e.g., transaction history) may be retained longer where required by law.

7. Contact Us

If you have questions or complaints regarding data processing, please reach out to us at: support@boardmix.com

Additional Notes

This DPA supplements our Privacy Policy. In the event of any conflict, the terms of this DPA shall prevail.
We may periodically update this agreement. Significant changes will be communicated via website banner or email.
Continued use of our services signifies acceptance of the updated terms.

Shenzhen Pixso Technology Co.,Ltd

10th Floor, West Tower, Baidu International Building, No. 8 Haitian 1st Road, Binhai Community, Yuehai Street, Nanshan District, Shenzhen

2025.02.12