Data Processing Agreement (DPA)

1. Definitions and Purpose

This Data Processing Agreement (hereinafter "DPA") is entered into between Frottoncoreio 合同会社 (Director: Yui Kobayashi, Capital: ¥1,000,000, Address: Nishiki 3-chome 12-8, 460-0003 Nagoya) and B2B clients utilizing the studio's services.

The purpose of this DPA is to ensure the protection of personal data processed during recording sessions, mixing, and mastering in accordance with the Japanese "Act on the Protection of Personal Information (APPI)" and the Telecommunications Business Act. This agreement supplements the Terms of Service.

2. Scope and Nature of Processing

The categories of data processed include:

• Contact Information: Name, email address (used for inquiries to [email protected]), and phone number (052-207-2657).
• Content Data: Recorded audio files, lyrics, musical scores, and podcast scripts.
• Payment Information: Billing addresses and payment details for B2B transactions.

Processing is limited to the provision of recording services, file delivery, and billing management. The processing period extends until the delivery of services and the expiration of the archive period (12 months) as defined in the business rules.

3. Obligations of the Processor

Frottoncoreio 合同会社 undertakes the following obligations:

1. To process data only in accordance with the written instructions of the Client.
2. To impose strict confidentiality obligations on all staff involved in processing (including Takeshi Yamada and Satoshi Yamamoto).
3. To implement appropriate technical and organizational measures to maintain the confidentiality, integrity, and availability of the data.

4. Use of Sub-processors

To provide efficient services, the following trusted sub-processors are utilized:

• Sakura Internet Inc. (Address: Grand Front Osaka Tower A 35F, 4-20 Ofuka-cho, Kita-ku, Osaka 530-0011): Used for data backup and hosting.
• FormSubmit (USA): Used for the transmission of data from the inquiry form.

These sub-processors are required to adhere to data protection standards equivalent to those in this DPA. For further details, please refer to the Privacy Policy.

5. Security Measures and Incident Notification

The studio implements physical access restrictions (studio entry/exit management) and digital protections (encryption and limited access permissions).

In the event of a security incident, such as a data breach or unauthorized access, Frottoncoreio will notify the Client promptly and without undue delay upon discovery, following the reporting procedures of the Personal Information Protection Commission (PPC).

6. Return and Deletion of Data

Upon termination of services or upon a legitimate request from the Client, Frottoncoreio will return or securely delete the processed data.

However, per studio business rules, session archives including backups are retained for a maximum of 12 months. Data exceeding this period is permanently deleted using non-recoverable methods. If early deletion is requested, please contact [email protected].

7. Audit Rights and Legal Compliance

The Client has the right to request an audit to verify compliance with this DPA, provided a reasonable notice period is given.

Any disputes regarding this agreement shall be subject to the exclusive jurisdiction of the Nagoya District Court. This DPA is subject to the supervision of the Personal Information Protection Commission (Address: 3-3-1 Kasumigaseki, Chiyoda-ku, Tokyo 100-0013).