Data processing agreement

1. Parties and purpose

This data processing agreement (“DPA”) governs processing of personal data by Mugwetkyro GmbH, Siebensterngasse 19, 1070 Wien (“processor”) on behalf of the client (“controller”) when the controller provides data about speakers, musicians, podcast guests or other participants for work in our recording studio.

Typical services: Vocals & Voice, Band Recording, Mixing, Mastering, Podcast & Post-production. The controller remains responsible for lawful collection and for informing data subjects. General terms are in our terms and conditions; website privacy is in the privacy policy.

2. Term and termination

This DPA lasts for the duration of the relevant studio or production contract and ends when that contract is fulfilled or terminated, at the latest when data are returned or deleted as set out below.

The controller may instruct us in writing to stop processing at any time unless retention is required by law. We may terminate the underlying service contract for material reasons under the terms; we will then help transfer data to the controller or a provider they name.

3. Data and data subjects

Data may include: names, contact details, artist names, scheduling and project information, audio or video containing voice or performance, export metadata and billing data relating to individuals.

Data subjects are musicians, voice talent, hosts, podcast guests, production staff and others you invite. We do not intentionally process special categories under Article 9 GDPR; if such content appears in recordings, the controller must ensure a legal basis.

4. Controller instructions

We process personal data only on documented instructions from the controller — initially the studio or production contract, supplemented by written email from an authorised person. Instructions may cover recording, editing, formats, loudness, file naming and delivery media.

If we believe an instruction is unlawful, we inform the controller without delay. Our statutory duties (for example retaining invoice data for tax purposes) remain unaffected.

5. Confidentiality

Anyone processing data on our behalf is bound by confidentiality or statutory secrecy. Managing director: Lukas Hörmann. Only team members who need data for the specific session receive access.

We train the team on secure handling of files, passwords and backups — without sharing personal details in unprotected channels.

6. Security measures

We implement appropriate measures under Article 32 GDPR, including:

• physical access control at our Wien premises (Siebensterngasse 19) outside booked sessions;
• encrypted disks on workstations and separate project folders per client;
• HTTPS for the website; FormSubmit only for enquiries, not bulk raw uploads;
• password protection and two-factor authentication where available for cloud and mail accounts;
• system updates and deletion of session files after 24 months unless the contract sets a longer period;
• up to 6 musicians at once in the live room — a controlled on-site environment.

Hosting: World4You Internet Services GmbH, Hafenstraße 35, 4020 Linz, Österreich. We provide a general description of measures on request.

7. Sub-processors

The controller gives general written authorisation for these sub-processors where needed to perform the contract:

• World4You Internet Services GmbH — website and mail hosting (Austria);
• FormSubmit — contact form content only (USA; see privacy — transfers);
• tax adviser — billing data where personal.

We inform the controller before appointing further sub-processors; they may object on material grounds within 14 days. Each sub-processor is bound by Article 28(3) GDPR terms.

8. Data subject rights

We assist the controller with suitable measures, where possible, for access, rectification, erasure, restriction and portability requests. Requests sent directly to us are forwarded promptly to the controller when we can identify the project.

Deadlines follow the controller’s obligations; we aim to forward within 2 business days.

9. Personal data breaches

We notify the controller without undue delay after becoming aware of a breach affecting data processed under this DPA. The notice includes, where available, the nature of the breach, categories involved, approximate numbers, likely consequences and measures taken.

Notification to authorities or data subjects is the controller’s duty unless law requires otherwise.

10. Deletion and return

After delivery or on the controller’s instruction, we delete personal data from active systems and backups within reasonable time — for multitrack and project files usually within 24 months of the last session unless the contract requires handover to the controller first.

Invoice and contract records may be kept up to seven years by law. On request we supply exports in agreed formats (see master formats); the controller arranges media and shipping.

11. Demonstration and audits

We provide information needed to demonstrate compliance and allow reasonable audits — mainly questionnaires and, where justified, inspection of studio IT by appointment in Wien.

Audits must not disproportionately disrupt operations; costs are borne by the controller unless we breached this DPA.

12. Liability and final provisions

Liability follows the studio contract, terms and conditions and GDPR rules. If any clause is invalid, the remainder stays in force.

Amendments require written form; the current text is on mugwetkyro.digital (updated 15 October 2026). The parties accept this DPA by signing the studio contract with reference to it or by separate written confirmation to [email protected].

Processor contact: Mugwetkyro GmbH, [email protected], +43 1 996 42 18. Legal notice: Legal notice. Cookies: Cookie policy.