GDPR Compliance Policy – Mixymash

This policy explains how Mixymash (hereafter “Mixymash”, “we”, “our”) collects, uses, and protects your personal data in accordance with the European Union General Data Protection Regulation (GDPR). By accessing or using our services, you acknowledge that you have read and understood this policy.

Last Updated: April 03, 2026

1. What Personal Data We Collect

We collect the following types of personal data:

Email addresses: When you sign up for newsletters, create an account, or contact us, we store your email address to communicate with you.
Cookies and similar tracking technologies: We use first‑party cookies and third‑party analytics cookies to understand how visitors interact with our site, improve performance, and personalize content.
Analytics data: Tools such as Google Analytics and Matomo record IP addresses (anonymized where possible), device information, page views, and referral sources to generate usage statistics.

2. How We Use Your Personal Data

Our lawful purposes for processing personal data include:

Communication: Sending newsletters, updates, and customer support messages.
Website functionality: Maintaining session states, preferences, and security features.
Analytics and improvement: Analyzing traffic patterns to enhance user experience and site performance.

3. Legal Basis for Processing

We rely on the following legal bases:

Consent: For marketing emails and optional newsletter subscriptions. You can withdraw consent at any time by clicking the unsubscribe link.
Legitimate Interest: For the use of analytics cookies and for improving our services. We conduct a legitimate interest assessment to ensure that our interests do not override your rights.

4. How We Protect Your Data

We employ industry‑standard technical and organisational measures to safeguard your data:

SSL/TLS encryption: All data transmitted between your browser and our servers is encrypted using 2048‑bit RSA certificates.
Secure servers: Our hosting providers maintain ISO 27001‑certified data centres with 24/7 monitoring, firewalls, and intrusion detection systems.
Access controls: Only authorised staff with a legitimate need can access personal data, and all access is logged.
Data minimisation and retention: We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, and we delete it securely when it is no longer needed.

5. Your GDPR Rights

Under the GDPR, you have the following rights regarding your personal data. For each right, we provide a short icon and a concise explanation of what it means and how you can exercise it.

Right to Access
You may request a copy of the personal data we hold about you. We will provide you with a summary of the data, the purposes of processing, and the recipients of the data within 30 days.
Right to Rectification
If any personal data is inaccurate or incomplete, you can ask us to correct it. We will update the data promptly and inform you once the correction is complete.
Right to Erasure
You may request the deletion of your personal data, provided the request is lawful. We will delete the data or anonymise it, unless we are legally obliged to retain it.
Right to Restrict Processing
Under certain circumstances, you can ask us to suspend the processing of your data. We will continue to store the data but will not use it until the restriction is lifted.
Right to Data Portability
You can obtain your personal data in a structured, commonly used, and machine‑readable format. We will provide the data in a suitable format, such as CSV or JSON, within 30 days.
Right to Object
You can object to the processing of your data for direct marketing or profiling. Upon receiving your objection, we will stop processing unless we can demonstrate compelling legitimate grounds.
Right to Withdraw Consent
At any time, you may withdraw consent for the processing of your personal data. This will not affect the legality of any processing carried out before the withdrawal.

6. How to Exercise Your Rights

To exercise any of the rights listed above, please contact us at [email protected]. Include the following information in your request:

Your full name and contact details.
A clear statement of the right you wish to exercise.
Any additional information that will help us identify the data (e.g., email address used for account creation).

We will acknowledge receipt of your request within 5 business days and respond in full within 30 calendar days, as required by the GDPR. If your request is complex or requires further information, we may need up to 30 days to provide a comprehensive response.

7. Data Retention and Deletion

We retain personal data for no longer than necessary:

Email addresses: up to 5 years after the last interaction, unless you request deletion sooner.
Cookie and analytics data: anonymised logs are kept for up to 2 years to comply with legal obligations and to improve services.

When the retention period expires or when you request deletion, we securely erase or anonymise the data, ensuring it can no longer be identified.

8. Contact Us

If you have any questions about this policy, your personal data, or any of your GDPR rights, please email us at [email protected]. We are committed to providing you with timely and transparent support.