Data processing agreement

Art. 1 Subject matter and scope

This data processing agreement (DPA) governs, under Art. 28 GDPR, the processing of personal data that business clients hand over to us in the course of a studio job. Typical cases are podcast productions with guests, voice recordings with external voice talent, interviews, audiobook or e-learning projects and recordings that a label or agency commissions on behalf of others.

The DPA supplements the main contract under our terms and conditions; on data protection matters it prevails. For data we process for our own purposes, such as your invoicing details, we remain the controller; our privacy policy covers this.

Art. 2 Parties and roles

The controller is the client who places the order and decides on the purposes and means of the processing. The processor is Klangnest Tonstudio GmbH, Burggasse 95, 1070 Vienna, FN 548213 w, Commercial Court of Vienna, represented by its managing director Lukas Steinbauer. Each party names a contact for data protection questions; on our side this is the management, reachable at [email protected].

Art. 3 Duration

The DPA applies from signature for the term of the main contract and beyond it for as long as we store data from the job, at most until the end of the 12-month archive period after completion of the job (see article 11). Ordinary termination is excluded while jobs are in progress; both parties retain the right to terminate for good cause.

Art. 4 Nature and purpose of the processing

We process the data entrusted to us solely to provide the commissioned studio services: recording, editing, mixing, mastering, creating alternative versions, bringing in remote guests over an audio link, delivering files via download links and archiving for re-deliveries. Processing takes place in our rooms in Vienna and on systems of our sub-processors in Austria; a transfer to a third country occurs only through FormSubmit under article 8.

Art. 5 Categories of data and data subjects

Depending on the job, the following data and groups of people may be involved:

Special categories of data may occur in conversation content, for example about health or beliefs. As controller, you ensure that a legal basis and the necessary consents of the contributors are in place.

Art. 6 Obligations of the processor

We undertake

• to process data only on documented instructions and to inform you without delay if we consider an instruction unlawful;
• to bind everyone involved in the processing, currently the three members of the studio team, to confidentiality;
• to maintain and regularly review the technical and organisational measures under article 9;
• to engage sub-processors only under the rules in article 8;
• to assist you with requests from data subjects and with your obligations regarding data security, notifications and impact assessments;
• to delete or return data after completion of the job under article 11;
• to make available to you all information needed to demonstrate compliance with this DPA.

Art. 7 Instructions

You give instructions in writing; e-mail is sufficient. Verbal instructions given during a session are confirmed by us afterwards by e-mail. The main contract and this DPA count as the initial instruction. Instructions that go beyond the agreed scope, such as longer storage or additional recipients, are agreed separately; any additional effort may be charged.

Art. 8 Sub-processors

You consent to the use of the following sub-processors:

• World4You Internet Services GmbH, Hafenstraße 35, 4020 Linz, Austria: hosting of the website and operation of our e-mail mailboxes, through which files, dates and revision requests are exchanged.
• FormSubmit (formsubmit.co), USA: transmission of messages from the contact form to our mailbox. The transfer to the USA is safeguarded by standard contractual clauses. Personal data of your contributors reaches FormSubmit only if you enter it in the form yourself.

If we intend to engage a further sub-processor or replace one, we inform you in advance by e-mail. You may object within 14 days for a substantial data protection reason; if no amicable solution is found, either party may terminate the job concerned. Contractual obligations corresponding to those of this DPA are in place with each sub-processor.

Art. 9 Technical and organisational measures

We take the following measures in particular:

• Physical access: studio and control room are locked; access only for the team and accompanied guests.
• System and data access: workstations and storage are password-protected; access to project data only for the people working on the job.
• Transfer: website and e-mail over TLS; delivery via download links that cannot be found publicly, with a password and expiry date on request.
• Availability: regular backups of project data on separate media; restoration is tested.
• Separation: each job has its own project folder; data of different clients is not mixed.
• Deletion: documented deletion after the archive period or on instruction.

We adapt these measures to the state of the art without lowering the level of protection.

Art. 10 Assistance and notifications

If data subjects approach us with requests for access, rectification, erasure or objection, we forward the request to you without delay and assist you in answering it. We do not answer such requests ourselves unless you instruct us to.

We notify you of any personal data breach, such as the loss of a storage medium or unauthorised access to project data, without undue delay after becoming aware of it, with all details you need for your own notification duties towards the data protection authority and the people affected.

Art. 11 Deletion and return

After completion of the job we keep raw recordings, project data and masters for 12 months so that re-deliveries and corrections remain possible. After that we delete all personal data entrusted to us or generated by us, including backup copies, and confirm the deletion in writing on request. On your instruction we delete the data earlier or return it in a common format. Documents we must keep under statutory retention obligations, such as invoices for 7 years, are exempt from deletion.

Art. 12 Evidence and audits

On request we provide all information you need to demonstrate compliance with your obligations, such as a description of our measures or the list of sub-processors. After reasonable notice, usually 14 days, you may check compliance with this DPA on our premises during opening hours, or have it checked, without unduly disrupting studio operations. Audits beyond one per year, or without a specific reason, may be charged on a time basis.

Art. 13 Liability

For loss arising from a breach of this DPA, the parties are liable under the rules of the GDPR and the main contract. We are liable to you only where we have failed to meet our obligations as processor or have acted against your lawful instructions. You indemnify us against claims based on there being no adequate legal basis or consent for the data entrusted to us. The limitations of liability in article 10 of the terms also apply to this DPA, unless data protection law provides otherwise.

Art. 14 Conclusion and form

We conclude this DPA on request. Write to us at [email protected] or use the contact page; within one working day you receive a copy with your company details, the reference to the job and the agreed deletion periods. After you have signed it, we return a copy countersigned by us as a PDF. Amendments must be made in writing; e-mail is sufficient. Austrian law applies; the place of jurisdiction is Vienna.