Data processing agreement (dpa) — Mixpanel

Cited by

Facts read from this source

• DPA roles Report an error

  “Customer is the “controller” and Mixpanel is the “processor” or “sub-processor” of Customer Content sent to and processed in the Application Service.”

• DPA law enforcement notice Report an error

  “Unless prohibited by law, Mixpanel shall promptly notify Customer of any requests from law enforcement for Personal Information and attempt to re-direct such requests to Customer”

• Audit rights Report an error

  “Upon written request from Customer, no more than once per calendar year, Mixpanel shall provide the following information and documentation to verify its compliance with Data Privacy Law and this DPA: (1) third-party certifications and audit reports on its security, privacy practices and architecture, and (2) written responses to industry standard written audit questionnaires.”

• No infrastructure access during audit Report an error

  “No access will be granted to any part of Mixpanel’s information technology systems, data hosting sites or centres, or its infrastructure during the course of the audit”

• List URL Report an error

  “Mixpanel’s current Subprocessors list is available at: https://mixpanel.com/legal/subprocessor-list (“Authorised Subprocessors”).”

• Notice period Report an error

  “At least thirty (30) days prior to the date on which any new Subprocessor shall commence Processing Personal Information, Mixpanel will update the list of Authorised Subprocessors to include the new Subprocessor.”

• Objection Report an error

  “Where Customer has reasonable grounds to object to Mixpanel’s appointment of a new Subprocessor, Customer may notify Mixpanel in writing by emailing compliance@mixpanel.com within thirty (30) calendar days of the update or receipt of the notice, whichever is later.”

• Locations Report an error

  “Mixpanel hosts Personal Information on our servers in the US by default or on our European servers, based on Customer’s selection and configuration of the Application Services, or if purchased by Customer, in India.”

• Dpf certification Report an error

  “Mixpanel relies on the EU-US Data Privacy Framework, UK Extension to the EU-US Data Privacy Framework, and the Swiss-US Data Privacy Framework (together, “DPF”) to transfer Personal Information from these jurisdictions to the United States.”

• Sccs dispute venue Report an error

  “Customer and Mixpanel agree to Option 1 of Clause 17, and that disputes will be resolved before the courts of Ireland”

• Retention post termination Report an error

  “Following termination or expiration of the Agreement and/or upon Customer’s written request, Mixpanel shall securely make Personal Information available to Customer for a period of 30 days, then destroy such Personal Information, unless retention is required by law.”

• Breach notification Report an error

  “Mixpanel shall notify Customers without undue delay if Mixpanel becomes aware of a breach of its security that has lead to any accidental, unauthorised or unlawful destruction, loss, alteration, disclosure of, or access to Personal Information”

• Data subject rights Report an error

  “Mixpanel shall promptly redirect all data subject rights requests from Data Subjects to Customer. Customer is solely responsible for responding to Data Subjects to fulfil these requests.”

• Pia assistance Report an error

  “Mixpanel provides Customers with product documentation and a data transfer information sheet to assist in Customer’s Privacy Impact Assessment obligations.”

• GDPR assistance Report an error

  “Mixpanel shall take reasonable steps at the Customer’s request to assist Customer in meeting Customer’s obligations under the GDPR. This includes Customer’s obligations to comply with Article 32 to 36 of the GDPR”

• CCPA Report an error

  “Mixpanel complies with, and assists Customers in their compliance with, the CCPA.”

• CCPA no sale Report an error

  “Mixpanel shall not “sell” or “share” Personal Information, as defined by the CCPA, unless expressly directed to by Customer.”

• HIPAA baa Report an error

  “If Customer is a “covered entity” or “business associate” as described in the Health Insurance Portability and Accountability Act of 1996, as amended and including the regulations promulgated thereunder (“HIPAA”), Customer must enter into a separate Business Associate Agreement with Mixpanel prior to sending Protected Health Information (“PHI”) to the Application Services.”

• Sensitive personal info Report an error

  “Sensitive Personal Information None, unless the Agreement specifically provides for the transfer and processing of such data.”

• Processing duration Report an error

  “Data will be stored, processed, and retained for the duration of an active Subscription Plan. Data will be deleted upon customer request for deletion, or within 90 days of Customer’s termination or expiration of the Agreement.”

• DPA last updated Report an error

  “Last Updated June 2, 2026”

• Notices contact Report an error

  “Notices to Mixpanel may be provided by emailing compliance@mixpanel.com.”

• Precedence Report an error

  “The order of precedence in case of any conflict, exclusively in relation to the processing of Personal Information under this DPA, will be, in order of priority: (i) the Order Form (ii) this DPA; (iii) the Agreement and any schedules or exhibits thereto”

• Default properties collected Report an error

  “Default settings of the Application Services collect end-user information including: Events City Region Country code Geo Source API endpoint API timestamp Time zone Time processed (UTC) User property update timestamp Browser Browser version Device Current URL”

• Scc supersedes audit Report an error

  “The Parties agree that any audit described in the Standard Contractual Clauses shall be performed pursuant to this provision.”

• Prior DPA versions Report an error

  “DPA Prior to June 2026 DPA Prior to September 2024 Prior CDPA addendum”

• Technical controls URL Report an error

  “Mixpanel employs a large number of technical controls to protect Customer Content, including those found at https://mixpanel.com/legal/tom.”

• SSO internal access Report an error

  “Mixpanel restricts access to the Application Services through the use of single sign on (“SSO”) and other role-based security measures.”

3 facts read from this page are not shown because they could not be confirmed on the page as captured.

Scores citing this record

• The Agency Developer Traffic, sources & campaign reports
• The Agency Developer Goals, events, funnels & e-commerce
• The Agency Developer Consent-free operation & data minimisation
• The Agency Developer Data access, export & self-hosting
• The Agency Developer Installation, integrations & performance
• The Agency Developer European sovereignty
• The Data Protection Officer Traffic, sources & campaign reports
• The Data Protection Officer Consent-free operation & data minimisation
• The Data Protection Officer Data access, export & self-hosting
• The Data Protection Officer Installation, integrations & performance
• The Data Protection Officer European sovereignty
• The E-Commerce Marketing Lead Traffic, sources & campaign reports
• The E-Commerce Marketing Lead Consent-free operation & data minimisation
• The E-Commerce Marketing Lead Data access, export & self-hosting
• The E-Commerce Marketing Lead European sovereignty
• The Growth Analyst Traffic, sources & campaign reports
• The Growth Analyst Consent-free operation & data minimisation
• The Growth Analyst Data access, export & self-hosting
• The Growth Analyst European sovereignty
• The Public-Sector Site Owner Traffic, sources & campaign reports
• The Public-Sector Site Owner Goals, events, funnels & e-commerce
• The Public-Sector Site Owner Data access, export & self-hosting
• The Public-Sector Site Owner Installation, integrations & performance
• The Public-Sector Site Owner European sovereignty
• The Skeptic Traffic, sources & campaign reports
• The Skeptic Consent-free operation & data minimisation
• The Skeptic Data access, export & self-hosting
• The Skeptic Installation, integrations & performance
• The Skeptic European sovereignty