Data Processing Agreement (DPA)

1. Parties and Purpose

This Data Processing Agreement ("DPA") is entered into between the Client (the "Controller") and Banaedgezen Pty Ltd, represented by Director Daniel White, located at 412 Collins Street, Melbourne VIC 3000 (the "Processor").

The purpose of this agreement is to ensure that the processing of personal data and intellectual property provided by the Controller is conducted in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Scope of Processing

The Processor shall process data only for the purpose of providing mixing, mastering, and vocal tuning services. The categories of data include:

• Contact Data: Name, email, and phone number for communication.
• Content Data: Audio files, stems, lyrics, and project notes.
• Payment Data: Billing details for B2B invoicing.

The data subjects are the artists, producers, and representatives of the Client.

3. Obligations of the Processor

Banaedgezen Pty Ltd agrees to:

• Process data only on documented instructions from the Controller.
• Ensure that persons authorised to process the data have committed themselves to confidentiality.
• Assist the Controller in responding to requests from individuals exercising their rights under the Privacy Act 1988 (Cth), as further detailed in our Privacy Policy.

4. Sub-processors

The Processor engages the following third-party sub-processors to facilitate the service:

• Micron 21 Pty Ltd: Infrastructure and hosting provider located at Unit 2, 7 Eastspur Court, Kilsyth South VIC 3137.
• FormSubmit: Service provider for processing contact enquiries (data may be transferred to servers in the USA).

The Processor ensures that sub-processors are bound by data protection obligations no less stringent than those set out in this DPA.

5. Technical and Organisational Measures

The Processor implements appropriate technical measures to protect data against unauthorised access or loss. This includes encrypted storage for project files and secure access controls for the studio's internal network. All measures are designed to meet the standard of reasonable security as required by Australian law.

6. Data Breach Notification

In the event of a suspected or actual data breach, Banaedgezen Pty Ltd shall notify the Controller without undue delay. The Processor will provide sufficient information to allow the Controller to meet any notification obligations to the Office of the Australian Information Commissioner (OAIC).

7. Data Return and Deletion

Upon termination of the services or at the request of the Controller, the Processor shall delete or return all personal data. In accordance with our business rules, project files and stems are stored for a period of 6 months after final delivery to facilitate minor adjustments, after which they are permanently deleted from our systems unless otherwise agreed in writing.

Payment records are kept for the duration required by Australian tax law.

8. Audit and Compliance

The Processor shall make available to the Controller all information necessary to demonstrate compliance with the obligations laid down in this DPA. The Controller may conduct audits of the Processor's data handling practices upon reasonable prior notice.

9. Final Provisions

This DPA is subject to the laws of Victoria, Australia. Any disputes arising from this agreement shall be subject to the exclusive jurisdiction of the courts in Melbourne.

For enquiries regarding data processing, please contact:

Email: [email protected]
Phone: (03) 8265 9823

Updated 15 October 2026.

This agreement complements the Terms and Conditions regarding service delivery and intellectual property.