Data Processing Agreement (DPA)

The purpose of this Agreement is to ensure the protection of personal data processed in connection with recording, mixing, and mastering services provided by the Processor to the Controller. This Agreement supplements the Privacy Policy and clarifies legal responsibilities within B2B transactions.

Categories of processed data include the Controller's contact information, names of artists, and audio data (which may include biometric information) collected during recording sessions. The purpose of processing is limited to studio booking management, production of works, and delivery of final files.

The Processor shall process personal data only on the written instructions of the Controller. The Processor agrees to comply with this Agreement and the Japanese Act on the Protection of Personal Information (APPI) and shall not disclose data to third parties inappropriately. Access is restricted to authorized personnel only to maintain confidentiality.

The Processor utilizes the following sub-processors to the extent necessary to provide the services:

• Sakura Internet Inc. (Address: Grand Front Osaka Tower A 35F, 4-20 Ofuka-cho, Kita-ku, Osaka 530-0011): Data hosting and server management.
• FormSubmit (Located in USA): Data transfer from contact forms.

The Processor ensures that these sub-processors maintain data protection standards equivalent to those set out in this Agreement.

To prevent leakage, loss, or damage of data, the Processor implements the following measures:

• Access control (password management and physical entry restrictions to the studio).
• Encryption of stored data and secure backups.
• Confidentiality training for staff involved in processing (Saki Watanabe, Kenji Hashimoto, Daiki Yamamoto).

In the event of a data breach or unauthorized access, the Processor shall promptly notify the Controller and report the situation. Notification will occur within a reasonable timeframe after detection. If necessary, the Processor will assist in reporting the incident to the Personal Information Protection Commission (PPC).

Upon termination of services or upon the Controller's request, the Processor shall return or erase the data. However, according to the studio's business rules, session archives are retained for a maximum of 12 months, after which they are securely deleted. For detailed terms of use, please refer to the Terms and Conditions.

The Controller has the right to conduct audits to verify the Processor's compliance with this Agreement, provided reasonable notice is given. Any disputes regarding this Agreement shall be subject to the exclusive jurisdiction of the Fukuoka District Court in the first instance.

Supervisory Authority: Personal Information Protection Commission (PPC), 3-3-1 Kasumigaseki, Chiyoda-ku, Tokyo 100-0013, https://www.ppc.go.jp