Data Processing Agreement (DPA)

1. Definitions and Purpose

This Data Processing Agreement (hereinafter "DPA") is entered into between the Controller (the Client) and the Processor (Berungrid 合同会社). The purpose of this DPA is to ensure the appropriate protection of personal data processed in connection with recording, mixing, and mastering services, in accordance with the Japanese Act on the Protection of Personal Information (APPI) and other relevant legislation.

2. Scope and Nature of Processing

Processed data includes artist names, contact details, and audio recordings provided by the Client (which may contain biometric information). The purpose of processing is limited to session management, file delivery, and the provision of services as defined in the Terms of Service. The processing period extends through the service delivery and the archive period specified in Article 6 of this DPA.

3. Processor Obligations

Berungrid 合同会社 undertakes the following obligations:

• To process data only according to the written instructions of the Controller.
• To impose strict confidentiality obligations on all staff involved in data processing (Sota Inoue, Ren Kobayashi, Satoshi Mori, Haruto Yamamoto).
• To prohibit the use of data for purposes other than those specified or unauthorized disclosure to third parties.

4. Use of Sub-processors

To ensure efficient service delivery, Berungrid utilizes the following trusted sub-processors:

Sub-processors are bound by contracts with Berungrid that impose data protection obligations equivalent to or stricter than those in this DPA.

5. Security Measures and Notification

Berungrid implements technical and organizational security measures, including encryption, access controls, and physical studio security. In the event of a data breach or unauthorized access, Berungrid will promptly notify the Controller and follow reporting procedures to the Personal Information Protection Commission (PPC).

6. Data Return and Deletion

Upon completion of services or termination of the contract, Berungrid will return or delete data upon request. However, for backup and archival purposes, data is retained for a maximum of 12 months. After this period, data is permanently deleted using non-recoverable methods. This is consistent with the retention periods in the Privacy Policy.

7. Audit and Rights

The Controller has the right to request an audit to verify Berungrid's compliance with the obligations of this DPA, provided reasonable notice is given. Audits shall be conducted in a manner that does not disrupt the normal business operations of the studio.

8. Legal Compliance and Jurisdiction

This DPA is governed by and construed in accordance with the laws of Japan. Any disputes arising from this agreement shall be subject to the exclusive jurisdiction of the Yokohama District Court in the first instance.

Supervisory Authority:
Personal Information Protection Commission (PPC)
3-3-1 Kasumigaseki, Chiyoda-ku, Tokyo 100-0013
https://www.ppc.go.jp