Data Processing Agreement (DPA)

1. Parties and Subject Matter

This Data Processing Agreement ("DPA") is entered into between the Client (the "Controller") and Yahasehonoperations Pty Ltd, represented by Director Benjamin Clarke, located at 114 Gawler Place, Adelaide SA 5000 (the "Processor"). This agreement ensures that the processing of personal and professional data is conducted in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs).

2. Nature and Purpose of Processing

The Processor handles data solely to provide recording, mixing, and mastering services. The categories of data include:

• Contact details of the Controller and their representatives.
• Audio recordings, stems, and project files (the "Materials").
• Metadata associated with recording sessions.

Processing is limited to the duration of the service provision and the archival period specified in our Terms and Conditions.

3. Obligations of the Processor

Yahasehonoperations Pty Ltd agrees to process data only on documented instructions from the Controller. We commit to ensuring that all staff involved in the processing are bound by confidentiality agreements. We will assist the Controller in meeting their obligations under the Privacy Act 1988 (Cth), including responding to requests from data subjects.

4. Sub-processors

The Processor engages the following third-party service providers to ensure technical delivery:

• Conetix Pty Ltd (142 Brisbane Street, Ipswich QLD 4305): Provides secure server hosting for project backups.
• FormSubmit: Facilitates the transmission of initial enquiries and booking requests.

All sub-processors are required to maintain security standards consistent with the Australian Privacy Principles.

5. Security and Incident Management

We implement technical and organisational measures to protect data against unauthorised access, loss, or destruction. In the event of a data breach, the Processor will notify the Controller without undue delay. Such notifications will be handled in accordance with the Notifiable Data Breaches (NDB) scheme under the Privacy Act 1988 (Cth).

6. Data Return and Deletion

Upon termination of the service or at the request of the Controller, the Processor will return or delete all personal data. Per our business rules, session archives are stored for 12 months to allow for client recovery. After this period, files are permanently erased unless a written extension is requested. Specific deletion procedures are detailed in our Privacy Policy.

7. Audit and Compliance

The Controller has the right to request reasonable evidence of compliance with this DPA. We maintain documentation of processing activities to ensure transparency and adherence to the Australian Consumer Law.

8. Governing Law and Jurisdiction

This agreement is governed by the laws of South Australia. Any disputes arising from this DPA shall be subject to the exclusive jurisdiction of the courts in Adelaide. For regulatory enquiries, the supervising authority is the Office of the Australian Information Commissioner (OAIC), GPO Box 5288, Sydney NSW 2001 (https://www.oaic.gov.au).