Data Processing Agreement (DPA)

1. Definitions and Purpose

This Agreement clarifies the standards by which the Processor handles personal data and confidential information provided by the Controller. The Processor shall process data solely based on the written instructions of the Controller for the performance of studio services (vocal recording, instrument recording, mixing, etc.). This Agreement is governed by the Act on the Protection of Personal Information (APPI) and the Telecommunications Business Act of Japan.

2. Scope of Processed Data

The data subject to processing includes:

• Data Subjects: Client employees, contracted artists, narrators, and third parties participating in recording sessions.
• Data Categories: Names, contact details, email addresses, and recorded audio data (multitracks, stems, and master files).
• Purpose of Processing: Session booking management, audio editing, mixing, mastering, and delivery in the specified formats.

3. Processor Obligations and Security

The Processor implements the following security measures:

• Access Control: Access to data is strictly limited to the assigned engineers (Mana Inoue, Kenji Ikeda) and the manager (Riku Ito).
• Technical Measures: Use of encrypted storage and maintenance of a secure network environment.
• Confidentiality: All staff involved in processing are bound by strict non-disclosure obligations.

For further details on our privacy standards, please refer to our Privacy Policy.

4. Sub-processors

The Processor entrusts the processing of data to the following third parties essential for service delivery:

• XSERVER Inc.: Web hosting and email server operations (Address: Grand Front Osaka Tower A 32F, 4-20 Ofuka-cho, Kita-ku, Osaka 530-0011).
• FormSubmit: Processing of data transmissions from contact forms and notifications (located in the USA).

The Processor ensures that these sub-processors meet appropriate data protection standards and remains responsible to the Controller for their compliance.

5. Data Retention and Deletion

The data lifecycle follows these specific rules:

• Archive Period: Session data is kept as a backup for a maximum of 12 months after final delivery.
• Deletion Process: Upon expiration of the retention period, or upon a legitimate deletion request from the Controller, the Processor shall erase the data in an irrecoverable manner.
• Return of Data: Upon termination of the contract, the Processor will return all held data in the requested format upon the Controller's demand.

Provisions regarding cancellations and refunds are governed by the Terms of Service.

6. Incident Response

In the event of a suspected data breach, loss, or unauthorized access, the Processor shall notify the Controller promptly (typically within 24 hours). The notification will include the type of data affected, the cause of the incident, and measures taken to prevent secondary damage. The Processor will coordinate appropriately if reporting to the Personal Information Protection Commission (PPC) is required.

7. Audit and Jurisdiction

The Controller has the right to conduct an audit to verify the Processor's compliance with this Agreement, provided reasonable prior notice is given.

Any disputes arising from this Agreement shall be subject to the exclusive jurisdiction of the Sapporo District Court in the first instance.

Supervisory Authority:
Personal Information Protection Commission (PPC)
3-3-1 Kasumigaseki, Chiyoda-ku, Tokyo 100-0013
https://www.ppc.go.jp