Data Processing Agreement (DPA)

1. Definitions and Purpose

The purpose of this Agreement is to define the protection standards for personal data processed in connection with recording, mixing, and mastering services provided by the Processor to the Controller. This document complements the Privacy Policy of the studio.

2. Scope and Duration of Processing

Categories of processed data include the names of the Controller's representatives, contact information, and audio data provided during recording sessions (including the voices of subjects). The processing period extends for the duration of the service provision and the archive retention period defined in this Agreement.

3. Obligations of the Processor

The Processor shall process data only on the written instructions of the Controller and shall not use the data for purposes contrary to this Agreement or the Terms of Service. All staff involved in processing are bound by strict confidentiality obligations.

4. Use of Sub-processors

The Processor utilizes the following trusted third-party services (sub-processors) to facilitate data processing:

• XSERVER Inc. (Hosting provider: Grand Front Osaka Tower A 32F, 4-20 Ofuka-cho, Kita-ku, Osaka 530-0011)
• FormSubmit (Inquiry form processing: USA)

The Processor ensures that these sub-processors maintain data protection standards equivalent to those set forth in this Agreement.

5. Security Measures

In accordance with the APPI, the Processor implements technical and organizational safety management measures. These include strict access controls, encryption of sensitive files, and regular security reviews to prevent unauthorized access or leakage.

6. Incident Response

In the event of a security incident, such as a data breach or unauthorized access, the Processor shall promptly notify the Controller to minimize damage and investigate the cause. The Processor endeavors to provide notification within 24 hours of discovering the incident.

7. Data Return and Deletion

Upon termination of services or upon the Controller's request, the Processor shall return or securely delete the data. However, per business rules, the Processor retains session archives for a maximum of 12 months, after which they are permanently erased.

8. Audit and Governing Law

The Controller has the right to conduct audits to verify compliance with this Agreement, provided reasonable notice is given. This Agreement is governed by the laws of Japan, and the Tokyo District Court shall have exclusive jurisdiction in the first instance.

The supervisory authority is the Personal Information Protection Commission (PPC), located at 3-3-1 Kasumigaseki, Chiyoda-ku, Tokyo 100-0013 (https://www.ppc.go.jp).