Data processing agreement

1. Parties and subject matter

This data processing agreement («DPA») supplements the service contract between

• Client («controller»): the organisation that books Mumbocetra services and provides personal data about guests, musicians, speakers or staff;
• Mumbocetra GmbH, Neubaugasse 40, 1070 Wien («processor» / «we»), VAT ATU62832297.

Subject matter is our processing of personal data solely to deliver recording studio services (recording, mixing, mastering, podcast production — see services) while the client remains controller.

2. Term and termination

This DPA lasts for the underlying service contract and ends when that contract ends, unless legal retention applies. Afterwards we delete or anonymise data within 24 months unless the client requests earlier deletion or a longer period is agreed (archiving in the terms).

3. Nature, purpose and categories

Nature of processing: collection, storage, organisation, monitoring, editing, transfer via download link, deletion.

Purpose: performing the booked studio or remote service, quality assurance (e.g. 2 revision rounds on mix/master), technical exports to the client.

Categories of data subjects: podcast guests, musicians, vocalists, speakers, hosts, the client’s technical staff.

Data categories: name, contact details, voice and performance, image or video the client brings, metadata on sessions and the client’s billing.

We do not intentionally process special-category data under Art. 9 GDPR; the client must not send it.

4. Client obligations

The client ensures a lawful basis (consent, contract, legitimate interest) and informs data subjects appropriately — e.g. guest releases (guide).

Instructions are sent in writing (email suffices) to [email protected]. If an instruction conflicts with law, we inform the client.

The client names a contact for privacy questions and notifies us of changes.

5. Processor obligations

We process only on documented instructions, including those in this DPA and the service contract. We assist with access and erasure requests where reasonable and lawful.

Persons authorised to process data are bound to confidentiality. General privacy practices: privacy policy.

6. Technical and organisational measures

We implement appropriate measures under Art. 32 GDPR, including:

• access control on studio systems and project folders for authorised staff only;
• encryption on media and HTTPS where available;
• separate project directories per job;
• physical security in Wien outside opening hours Tue–Fri 9–20, Sat 10–16;
• routine deletion after 24 months.

Details can be documented in an annex on request.

7. Sub-processors

The client grants general written authorisation for sub-processors that may process personal data on our behalf:

• World4You Internet Services GmbH, Hafenstraße 47–51, 4020 Linz, Austria — hosting;
• FormSubmit — contact form forwarding (USA; see privacy policy on third countries).

Further sub-processors are engaged only with prior notice or explicit consent where required. We impose Art. 28(4) GDPR terms on them.

8. Third-country transfers

Processing is primarily in Austria. Where FormSubmit or other helpers involve third countries, we use appropriate safeguards or the exceptions described in the privacy policy. The client may use direct email to avoid FormSubmit.

9. Assistance, breaches and audits

We assist with DPIAs and authority requests where our processing is involved. We notify the client without undue delay of personal data breaches likely to affect their data subjects, with Art. 33 GDPR information where available.

The client may audit our measures once per year by appointment, without disrupting studio operations and subject to confidentiality of other clients.

10. Return and deletion

After delivery we provide agreed export files. On written instruction we delete copies on our systems within a reasonable time unless statutory retention (e.g. seven years for invoices) applies. Backup media rotate on a normal cycle.

11. Liability and final provisions

Liability follows the service contract and terms and conditions unless this DPA states otherwise. Austrian law applies. Place of jurisdiction for businesses is Wien where permitted.

The DPA may be accepted by email with the order («DPA at mumbocetra.click/en/data-processing-agreement.html acknowledged»). Contact [email protected], 01 966 12 34. Effective 15 October 2026, updated 15 October 2026.