> ## Knowledge Base Index
> Fetch the complete knowledge base index at: https://help.hoxtonmix.com/sitemap.xml
> Use this file to discover available pages before exploring further.
> Pure-Markdown content can be obtained by appending a '.md' suffix to the content URLs listed in the sitemap (without the trailing slash).

# GDPR & Security Compliance

> ⚡ **Quick Answer:** The Hoxton Mix is fully compliant with UK GDPR, DPA 2018, and DUAA 2025. All data is hosted in London (AWS), encrypted with AES-256 at rest and TLS 1.2+ in transit, and certified under **Cyber Essentials Plus**.

---

# Official Policies

* [Privacy Policy](https://help.hoxtonmix.com/en/article/privacy-policy-4bp798/) (includes full sub-processor list)
* [Cookie Policy](https://help.hoxtonmix.com/en/article/cookie-policy-1kp06gn/)

---

# Compliance Status

**Status:** Fully Compliant

### Hosting & Encryption

* **Data location:** London, UK (AWS Region: eu-west-2)
* **Encryption in transit:** TLS 1.2+
* **Encryption at rest:** AES-256
* **Certification:** Cyber Essentials Plus (audited annually)

### Security Measures

* **Physical security:** CCTV, biometric/fob access controls
* **AI safety:** OpenAI used for OCR with **Zero Data Retention** — your mail content is never used to train models

---

# Sub-Processors & Partners

Key infrastructure partners: **AWS** (hosting), **Chargebee/Stripe/PayPal/GoCardless** (payments), **Twilio** (SMS/VoIP), **Crisp** (chat), **Mailgun** (email).

Full list in our [Privacy Policy](https://help.hoxtonmix.com/en/article/privacy-policy-4bp798/).

> ⚠️ **Note:** Postal carriers (Royal Mail, DHL, FedEx) act as independent Data Controllers once mail enters their network.

---

# Data Retention & Deletion

* **Mail scans:** Deleted after 30 days (or sooner if you choose)
* **KYC/AML documents:** Retained for **5 years** after the business relationship ends (legally required under Money Laundering Regulations — overrides GDPR Right to Erasure)

---

# Mail Processing Errors

Physical mail handling occasionally produces a misdirected item, usually through a mechanical fault such as a double-feed. See [Misdirected mail and your data](https://help.hoxtonmix.com/en/article/misdirected-mail-and-your-data-how-we-handle-processing-errors-1vur311/) for how we log, assess and correct these, and when a breach is notifiable to the ICO.

---

# Contact

* **Data Protection Officer:** dpo@hoxtonmix.com
* **Registered Office:** 66 Paul Street, London EC2A 4NA

---

**[Contact DPO →](mailto:dpo@hoxtonmix.com)**