Data processing agreement

1. Parties and application

This data processing agreement (DPA) governs processing of personal data by Nomadisedexa GmbH, Lerchenfelder Straße 45, 1070 Wien (processor), on behalf of the client (controller), when Nomadisedexa studio services involve third parties’ personal data — for example podcast guests, voice talent, band members or audiobook narrators.

It supplements the main contract (quote, order confirmation) and our terms and conditions. For data protection, this DPA prevails over conflicting general terms. Background: privacy policy.

2. Subject matter and term

Subject matter is recording studio work in Wien — recording, editing, mixing, mastering, delivery — including storage and transmission of related personal data. Typical services: Vocals & voice-over, Band recording, Mixing, Mastering, Podcast & dialogue.

Processing starts when you commission us and ends with deletion or return after the job and the agreed archive period (by default 12 months after the last session unless agreed otherwise). Enquiries via contact.

3. Nature of data and data subjects

Data processed includes in particular:

• voice and music recordings that may identify individuals;
• names, contact details and roles of artists, speakers or crew you provide;
• project metadata (titles, take lists, file names);
• project correspondence.

Data subjects are usually guests or artists you invite — not anonymous website visitors. Special-category data is processed only on documented instruction and where the controller has a legal basis.

4. Processor obligations

The processor processes personal data only on documented instructions from the controller, including on transfers, unless EU or member-state law requires otherwise. Instructions may be given in writing, by email or via the agreed project folder.

We ensure persons authorised to process data are bound by confidentiality, implement appropriate technical and organisational measures, assist with data-subject rights, report breaches and maintain records of processing where required.

We do not use client recordings for advertising, public portfolios or AI training. Any publication needs separate written consent.

5. Controller obligations

The controller ensures a legal basis for processing and for inviting data subjects to the studio (consent, contract, legitimate interest). They inform data subjects where required and provide only data needed for the service.

They instruct us on deletion, return or delivery format (e.g. stems per our stems guide). People under 16 may participate only with guardian consent.

6. Sub-processors

The controller grants general written authorisation to engage further processors. We notify planned changes; the controller may object on important data-protection grounds.

We currently use in particular:

• World4You Internet Services GmbH, Hafenstraße 35, 4020 Linz, Österreich, hosting, email and storage — data centres in Austria or the EU;
• FormSubmit only for the public website contact form (USA), not for session files.

Other sub-processors (e.g. accountant) are engaged with Art. 28 contracts. Transfers: privacy policy.

7. Security measures

Appropriate measures under Art. 32 GDPR include HTTPS for the website, access control on studio systems, encrypted workstations, separate project drives, secured premises in Wien, backup rotation and deletion after 12 months in archive. Recording uses up to 96 kHz sample rate unless agreed otherwise.

A detailed list is available on request as an annex.

8. Data-subject rights and breach support

The processor assists the controller with suitable measures for access, erasure, rectification, restriction, portability and objection where processing is affected. We forward requests promptly.

If a personal data breach occurs, we notify the controller without undue delay, within 24 hours of becoming aware, with information needed for regulatory notification.

9. Deletion and return

After completion and the archive period we delete personal data on our systems unless the controller requests earlier deletion or longer retention in writing and a legal basis exists. Return uses agreed file formats (see master formats).

Statutory retention for invoices (up to seven years) remains; storage is limited to billing data.

10. Audits

The controller may verify compliance through reasonable information and, where justified, inspections or audits — by appointment and without disrupting active sessions. We can provide available evidence such as host certifications.

11. Liability and final provisions

Liability follows the main contract and terms unless the GDPR requires otherwise. Governing law and jurisdiction for business clients follow the terms, subject to mandatory data-protection rules.

Amendments require written form. Version date: 15 October 2026. To accept, email company name, VAT ID and signatory to [email protected]. Questions: +43 1 526 48 92.