> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.hoxtonmix.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# Data Processing Agreement (DPA) & GDPR Compliance

> ⚡ **Quick Answer:** You can view, download, and countersign the DPA from the [Customer Portal](https://account.hoxtonmix.com/) under **Settings → Business → Business Documents → GDPR Compliance**.

---

# Accessing the DPA

1. Log in to the [Customer Portal](https://account.hoxtonmix.com/)
2. Go to **Settings** → **Business** → **Business Documents**
3. Navigate to **GDPR Compliance – Data Processing Agreement**
4. From here you can **view**, **download the PDF**, or **upload a countersigned copy** for your records

> 💡 **Tip:** The version in the portal is the current and authoritative version of the agreement.

---

# Signing the DPA

We provide a **pre-executed DPA**, already signed by The Hoxton Mix Ltd.

If you need a countersigned copy for internal records:

1. Download the DPA from the portal
2. Review **Schedule 1** (nature of processing, mail handling, identity verification)
3. Go to **Page 7** and complete: **“Signed for and on behalf of THE CUSTOMER (Controller)”**
4. Save for your compliance files

You do **not** need to return the signed document unless you have a specific objection to a sub-processor or are requested to by a regulator.

> ⚠️ **Important:** Continued use of the service constitutes acceptance of the DPA.

---

# Roles Under the DPA

| Role | Scope |
|---|---|
| **Processor** | Customer content: physical and digital mail handling, scanning, forwarding, destruction |
| **Controller** | Service data: account management, billing, identity verification, AML compliance |

Third-party postal carriers (Royal Mail, DHL, FedEx) act as **independent Data Controllers** once mail enters their networks.

---

# Sub-Processors

We use a limited number of trusted sub-processors (e.g., **AWS**, **Crisp**) under a general authorisation model in line with UK GDPR. A live list is maintained in our [Privacy Policy](https://help.hoxtonmix.com/en/article/privacy-policy-4bp798/).

---

# International Data Transfers

Where data is transferred outside the UK, we rely on:

* The **UK Extension to the EU–US Data Privacy Framework (UK Data Bridge)**
* The **UK International Data Transfer Agreement (IDTA)** or approved Standard Contractual Clauses

---

# Security & Certifications

* **Encryption in transit:** TLS 1.2+
* **Encryption at rest:** AES-256
* **Physical security:** Controlled access, CCTV, secure mail handling
* **Certification:** Valid **Cyber Essentials Plus** — [verify here](https://registry.blockmarktech.com/certificates/af0f0105-1863-4e02-a5d5-f2548d77bc2a1)

---

# Common Questions

**Do I need to sign and return the DPA?**
No. It’s pre-executed. You only need to countersign if required for your internal records.

**Where can I find the sub-processor list?**
In our [Privacy Policy](https://help.hoxtonmix.com/en/article/privacy-policy-4bp798/).

**Who do I contact about data protection?**
Email **dpo@hoxtonmix.com**.

---

**[Log in to your portal →](https://www.account.hoxtonmix.com/)**