Data processing agreement

1. Parties and application

This data processing agreement (« DPA ») governs processing of personal data by Nohexevo GmbH, Lindengasse 14, 1070 Wien (« processor »), on behalf of business clients (« controller »), when the controller provides guest, speaker, musician or staff data for recording, mixing, mastering, podcast production or similar services.

The controller remains responsible under the GDPR. This DPA supplements the main contract (quote/terms) and prevails on data protection points. The privacy policy informs end users but does not replace this DPA.

2. Subject matter and term

Processing covers personal data the controller sends us or that arises during sessions at our Wien studio (e.g. voice, names, guest contact details, schedules).

The term matches the project contract plus archiving under « Deletion and return » — by default 12 months after the last service unless agreed otherwise in writing.

3. Types of data and data subjects

Data types: identity and contact details, communication content, voice and performance in audio form where applicable, session metadata, file-sharing credentials if supplied by the controller.

Data subjects: artists, speakers, podcast guests, band members and companions invited by the controller.

We do not intentionally process special categories under Article 9 GDPR; the controller informs guests and obtains consent where required.

4. Controller obligations

The controller ensures a legal basis for sharing data with us, informs data subjects and provides only data needed for the service. Instructions are in writing (email is enough) and must match the main contract.

The controller names a contact for privacy matters and notifies us of changes affecting processing.

5. Processor obligations

Nohexevo GmbH processes personal data only on documented instructions from the controller, including on transfers, unless EU or Austrian law requires processing — then we inform the controller beforehand where permitted.

We ensure confidentiality by persons authorised to process data, assist with data subject rights (Art. 28(3)(e) GDPR), and notify personal data breaches without undue delay. Contact: [email protected], 01 405 82 16.

We do not use recordings for AI training or publish audio without the controller's instruction and legal basis.

6. Sub-processors

The controller grants general authorisation for sub-processors needed to run our studio and website:

• World4You Internet Services GmbH, Hafnerstraße 47, 4020 Linz, Austria — hosting in Austria;
• FormSubmit (formsubmit.co) — when the controller uses the contact form; US transfer as described in the privacy policy on third-country transfers.

Further sub-processors (e.g. tax adviser) are bound under Article 28 GDPR. We notify the controller of changes; the controller may object for important reasons.

7. Technical and organisational measures

We implement appropriate measures including:

• Access limited to authorised team members (see about us); individual accounts and strong passwords.
• Encrypted transmission (HTTPS) and encryption on portable media where practical.
• Separate project folders per controller; no mixing with other clients without instruction.
• Locked premises outside sessions; live room with 2 iso booths and controlled access.
• Backups for recovery; deletion after the archive period ends.

We can document details in a schedule on request.

8. Deletion and return

After the service ends and the agreed archive period (default 12 months), we delete personal data and project files unless the controller requests a longer period or return in a specified format. Return uses agreed channels (e.g. secure download); the controller must cooperate in receiving files.

Statutory retention (e.g. invoices for seven years) remains; we then restrict processing to what the law requires.

9. Audits and evidence

The controller may request reasonable information on compliance. On-site inspections are by appointment during Tue–Sat 10–22, without disrupting sessions. We can provide sub-processor evidence where contracts allow.

10. Liability and final provisions

Liability follows the main contract and terms unless this DPA states otherwise. Governing law for business clients follows the terms; Austrian law applies together with the GDPR.

Changes require written form. Version 15 October 2026; responsible person: Markus Hartmann, Nohexevo GmbH — [email protected]. For consumers who are not controllers, only the privacy policy applies.