Data Processing Agreement (DPA)

1. Definitions and Purpose

The purpose of this Agreement is to clarify the obligations of the Processor regarding the processing of personal data provided by the Controller, in compliance with the Japanese Act on the Protection of Personal Information (APPI) and the Telecommunications Business Act. This Agreement constitutes an integral part of the Terms and Conditions.

2. Scope and Categories of Processing

The data processed by the Processor includes the following:

• Data Subjects: Employees of the Controller, commissioned artists, and narrators.
• Data Categories: Names, email addresses, phone numbers, and audio data related to recording sessions (multitracks, stem files).
• Purpose: Execution of recording, mixing, mastering, and delivery processes.

3. Obligations of the Processor

The Processor shall process data only based on the written instructions of the Controller and shall not engage in processing that contradicts this Agreement or the Privacy Policy. The Processor ensures that all staff involved in processing are bound by strict confidentiality obligations.

4. Sub-processors

The Processor utilizes the following sub-processors essential for service delivery:

• XSERVER Inc. (Address: Grand Front Osaka Tower A 32F, 4-20 Ofuka-cho, Kita-ku, Osaka 530-0011) — Server hosting.
• FormSubmit (USA) — Processing of contact forms.

Data transfers to sub-processors are conducted in accordance with APPI regulations regarding the provision of personal data to third parties in foreign countries.

5. Security Measures

The Processor implements appropriate technical and organizational safety management measures to prevent the loss, destruction, falsification, or leakage of data. This includes access control, encryption, and regular system updates.

6. Incident Notification

Upon becoming aware of a personal data breach or a risk of leakage, the Processor shall notify the Controller without undue delay and strive to minimize potential damages.

7. Return and Erasure of Data

Upon termination of the contract or at the request of the Controller, the Processor shall return or erase the data. However, in accordance with business rules, archives are kept for a maximum of 12 months, after which they are permanently deleted. For more details, please refer to the retention provisions in the Terms and Conditions.

8. Audit and Jurisdiction

The Controller has the right to conduct audits, upon reasonable notice, to verify the Processor's compliance with this Agreement.

Any disputes regarding this Agreement shall be subject to the exclusive jurisdiction of the Yokohama District Court in the first instance. This Agreement is subject to the supervision of the Personal Information Protection Commission (PPC, Address: 3-3-1 Kasumigaseki, Chiyoda-ku, Tokyo 100-0013, https://www.ppc.go.jp).