Data processing agreement

1. Parties and roles

This agreement governs processing by Nocentcetra GmbH, Margaretenstraße 78, 1050 Wien, Austria (“processor”), on behalf of the customer named in the project contract (“controller”) when studio services involve personal data — for example voices in Vocal recording, Band recording sessions or Podcast recording guests.

The controller decides purposes and means; the processor acts only on documented instructions under Art. 28 GDPR.

2. Subject matter and term

Subject: delivery of studio services under the individual project agreement and terms and conditions, including recording, editing, Mixing, Mastering and agreed file handover.

Term: from the first processing on your behalf until return or deletion after project completion, at the latest after the agreed archive period of 18 months unless law requires longer retention.

3. Nature of processing

Collection, storage, organisation, critical listening for quality, technical editing (editing, mixing, mastering), transfer to the controller via agreed carriers (download link, physical media) and deletion after the retention period.

Processing takes place at our Margareten premises and on secured systems in the EEA. We do not use your data for our own marketing or for AI training.

4. Categories of data subjects and data

Data subjects: artists, musicians, speakers, podcast guests and companions you bring or name for the session.

Data: audio recordings (voice, instruments), names or contact details in metadata or track lists where applicable, project notes that may contain personal content.

We do not intentionally process special-category data under Art. 9 GDPR; if such content appears in recordings, the controller must provide the legal basis.

5. Controller instructions

Instructions are given in writing or text form (email, project sheet, confirmed quote). The processor will inform the controller if an instruction appears unlawful.

Default instructions include: perform the booked service, archive for 18 months, up to 2 revision rounds where covered in the terms, no public release without separate approval.

We aim to handle support questions within 2 business days where possible.

6. Processor obligations

• process only on documented instruction;
• ensure confidentiality of staff with access;
• implement appropriate technical and organisational measures (access control, encryption on portable media, secured networks);
• assist with data subject rights where our data is involved — we forward requests promptly;
• notify personal data breaches without undue delay once aware;
• delete or return data after the contract ends, subject to legal retention.

General security practices: privacy policy, security section.

7. Sub-processors

The controller grants general authorisation for sub-processors necessary to operate:

• World4You Internet Services GmbH — hosting in Austria;
• FormSubmit — if the controller uses our contact form for project instructions (possible third-country transfer — see privacy policy);
• IT maintenance and backup providers — only under Art. 28 GDPR contracts and within the EEA unless notified otherwise.

We inform the controller in advance of material changes; the controller may object on important data-protection grounds.

8. Third-country transfers

Primary processing and storage are in Austria or the EEA. Transfers outside the EEA occur only if the controller instructs them (for example a cloud upload) or if the controller uses FormSubmit. In the latter case the privacy policy applies; appropriate safeguards (standard contractual clauses, consent or Art. 49 GDPR) must be covered by the controller.

9. Audits

The controller may verify compliance during business hours (Monday–Friday 10:00–20:00, Saturday 10:00–16:00; closed Sunday. Evening sessions by appointment.) with reasonable notice — for example via questionnaire or review of organisational measures. Confidentiality of other clients’ projects remains protected.

We provide information needed to demonstrate compliance to supervisory authorities when requested.

10. Liability and precedence

Each party’s liability for data protection follows the GDPR and Austrian law. Studio fees (for example €138 for band hours) come from the quote and terms; this DPA focuses on privacy obligations.

If the terms and this DPA conflict, the privacy-specific rules in this document prevail.

11. Acceptance and contact

This agreement applies when both parties sign or when the controller confirms acceptance in writing (email is enough) before the first processing on their behalf.

Processor contact: Stefan Hofer, [email protected], 01 545 08 23. Company details: legal notice. Last updated: 15 October 2026.