Data processing agreement

1. Parties and application

This data processing agreement (DPA) governs processing of personal data by Noelpulse GmbH (Noelpulse), Stapelgasse 8, 1050 Wien, Austria — the processor — on behalf of a company, authority, or other organisation — the controller.

It applies to recording studio services in Vienna, including vocal recording, mixing, mastering, podcast production, and rehearsal recording, when the controller decides how recordings of people are used (guests, speakers, musicians).

The DPA supplements the main contract and our terms and conditions and privacy policy where they concern processing on the controller’s instructions. If they conflict, the data protection rules in this DPA prevail where they are more favourable to data subjects. The German version is legally authoritative.

2. Subject matter and term

The processor delivers the agreed services at the Vienna premises (3 rooms, live room about 42 m²). Processing personal data is necessary for that delivery and lasts for the cooperation period plus the 24-month archive period in section «Deletion», unless a longer written instruction or legal retention applies.

When the main contract ends, active processing stops; confidentiality and evidence duties continue.

3. Nature and purpose

Processing activities include: capturing and storing audio and metadata during sessions, technical editing (edit, mix, master), delivering export files to the controller, and project-related communication.

The purpose is exclusively the agreed production. Marketing, publication without instruction, training AI models on voice data, or disclosure to third parties for other purposes is prohibited without separate written instruction — consistent with our privacy policy.

4. Categories of data subjects and data

Data subjects may include vocalists, speakers, podcast guests, musicians, session players, and the controller’s contact persons.

Data categories may include voice and musical performance, artist names in project files, guest contact details if supplied, session notes without medical content, and technical metadata (tracks, formats, loudness).

We do not intentionally process special categories under Article 9 GDPR. The controller must ensure a legal basis for capture and transfer to us and inform data subjects where required.

5. Instructions

The processor processes data only on documented instructions from the controller, including services described in the main contract, provided they are lawful. Oral instructions must be confirmed in writing without delay (email is sufficient).

Additional technical directions (delivery formats, stems, revisions — up to 2 rounds where agreed) count as instructions under this DPA. If the processor considers an instruction unlawful, it informs the controller promptly.

6. Processor obligations

The processor shall in particular:

• treat personal data confidentially and grant access only to authorised team members in Vienna;
• implement appropriate technical and organisational measures under Article 32 GDPR;
• assist the controller with access and erasure requests where data is in our control;
• report personal data breaches without undue delay, within 24 hours of becoming aware, with available details;
• delete or return data after the engagement ends, subject to legal retention;
• provide information to demonstrate compliance on request.

Security details: privacy policy — security. Booking: contact, FAQ.

7. Sub-processors

The controller grants general authorisation for the following sub-processors where needed for the service:

• World4You Internet Services GmbH, Hafnerstraße 4, 8055 Graz, Österreich — website hosting and business email (typically not raw multitracks);
• FormSubmit — forwarding website contact enquiries only, not studio project files.

Further sub-processors (e.g. tax adviser) are engaged only after informing the controller, who may object within 14 days with reasons. We conclude Article 28(4) GDPR contracts with each sub-processor.

8. Transfers outside the EEA

Studio project data and recordings are processed in Vienna and stored on our systems or with World4You Internet Services GmbH within the EEA, unless another transfer method is explicitly agreed with the controller (encrypted media, secured cloud with a DPA).

FormSubmit may involve transfer to the United States when the website contact form is used; that typically does not cover session raw data you commission. See privacy policy — third countries.

9. Technical and organisational measures

Appropriate measures include: access control at the Margareten premises, locked storage for physical media, password-protected accounts, separate project folders per client, HTTPS for website data, regular system updates, and deletion after 24 months unless the controller orders a longer period in writing.

We provide a high-level summary of measures on request without compromising security.

10. Data subject rights

The processor assists the controller with suitable measures for access, rectification, erasure, and restriction requests where data is held by us. Requests sent directly to us are forwarded promptly to the controller when it is clear they decide.

General information for end clients appears in the privacy policy and guides.

11. Deletion and return

After the service ends and the 24-month archive period expires, we delete project files and backups containing personal recordings unless the controller requests a longer period or return on media in writing. Return uses industry-standard formats (e.g. WAV, stems); extra costs by prior agreement.

Invoice and contract records follow statutory retention and are stored separately. B2B payment term: 14 days — see terms.

12. Final provisions

Liability follows the main contract and GDPR. Privacy contact: [email protected], +43 1 546 78 90, managing director Lukas Berger.

Template status: 15 October 2026, effective 15 October 2026. Individual additions may be agreed in writing in the project contract. Related pages: legal notice, cookie policy, accessibility statement, disclaimer.