Corporate Transaction Data Disclosure

What it is

If Mixpanel is acquired, merged with another company, or sells its assets, your personal data may be transferred to the acquiring entity as part of that transaction.

Why it matters (compliance & governance perspective)

This provision authorizes transfer of personal data to third parties in corporate transaction contexts, potentially including during negotiations before a transaction is finalized, without requiring individual notice or consent at the time of transfer.

Consumer impact (what this means for users)

Personal data including identifiers, behavioral data, and contact information held by Mixpanel may be transferred to an acquiring company in a merger or asset sale; the policy does not commit to notifying individual users before such a transfer occurs or to obtaining consent.

Institutional analysis (Compliance & governance intelligence)

1) REGULATORY LANDSCAPE: Corporate transaction data transfers engage GDPR Article 6 (lawful basis for processing) and, in the context of data transfers to non-EEA acquirers, Chapter V of GDPR regarding international transfers. Under CCPA, a business combination is generally a disclosed use that may not require separate opt-in, but the successor entity's use of the data must be consistent with the original collection purpose or new notice and consent may be required. The FTC has historically scrutinized asset transfers in bankruptcy and acquisition contexts. 2) GOVERNANCE EXPOSURE: Low to medium. This is a standard provision in commercial privacy policies. However, the inclusion of 'negotiations' as a trigger for data disclosure is operationally notable, as it could authorize sharing of personal data with potential acquirers before any transaction is completed, subject to confidentiality agreements. 3) JURISDICTION FLAGS: EU and UK users' data transferred to a non-EEA acquirer would require an appropriate transfer mechanism. California residents should note that CCPA may require the successor business to honor opt-out requests made prior to the transaction. 4) CONTRACT AND VENDOR IMPLICATIONS: Due diligence teams in M&A transactions involving Mixpanel should assess the scope of personal data held by Mixpanel, applicable transfer restrictions, and the obligations of any successor entity under Mixpanel's existing DPAs with customers. 5) COMPLIANCE CONSIDERATIONS: Legal teams should confirm that data transfer agreements in any corporate transaction involving Mixpanel address GDPR Chapter V requirements for international transfers and CCPA service provider restrictions. Post-transaction integration plans should include privacy compliance assessment.

Applicable agencies

Provision details

Other risks in this policy

• Controller and Processor Dual-Role Structure high
• Third-Party Advertising and Analytics Vendor Sharing medium
• CCPA Opt-Out of Sale or Sharing of Personal Information medium
• EU-U.S. Data Privacy Framework Certification medium
• Data Retention Policy medium
• Data Subject Rights (Access, Correction, Deletion, Portability) medium