Data Processing Agreement

Last updated: the day SOUNDAR goes live

This Data Processing Agreement ("DPA") forms part of the SOUNDAR Terms of Service between:

• the Label, the customer that holds a SOUNDAR account ("Controller"); and
• Grégoire Michelin, entrepreneur individuel (micro-entreprise), SIRET 820 141 430 00034, 1 Rue du Bec Castel, 76790 Étretat, France, operating SOUNDAR ("SOUNDAR" or "Processor").

It applies whenever SOUNDAR processes personal data on the Label's behalf, as required by Article 28 of the EU General Data Protection Regulation 2016/679 ("GDPR"). Accepting the Terms of Service means accepting this DPA. A signed copy is available on request at privacy@soundar.app.

1. Scope and roles

1.1 When the Label uses SOUNDAR to contact artists, receive their demos, review them, share them with its team and reply to them, the Label is the controller and SOUNDAR is the processor of the personal data involved. Annex 1 describes this processing.

1.2 SOUNDAR acts as an independent controller, not as a processor, for:

• its own customer account data;
• website visitors and call bookings;
• the artist discovery data it collects from licensed sources to run the scouting radar.

That processing is covered by the SOUNDAR Privacy Policy, not by this DPA.

2. SOUNDAR's obligations

SOUNDAR will:

1. Instructions. Process personal data only on the Label's documented instructions. These consist of the Terms of Service, this DPA and the Label's use and settings of SOUNDAR. SOUNDAR will tell the Label immediately if it believes an instruction breaches the GDPR or other EU or Member State data protection law.
2. Confidentiality. Ensure that anyone authorised to process the personal data is bound by confidentiality.
3. Security. Implement the technical and organisational measures in Annex 2, which ensure a level of security appropriate to the risk (Article 32 GDPR).
4. Sub-processors. Respect the conditions in section 4.
5. Data subject requests. Help the Label, as far as possible and taking into account the nature of the processing, to respond to requests from people exercising their rights (access, rectification, erasure, restriction, portability, objection). If SOUNDAR receives such a request directly about the Label's processing, it will pass it to the Label without undue delay, except where SOUNDAR handles it as controller under section 1.2. An artist's request not to be contacted is always honoured immediately.
6. Other assistance. Help the Label meet its obligations under Articles 32 to 36 GDPR (security, breach notification, impact assessments, prior consultation), taking into account the information available to SOUNDAR.
7. Personal data breaches. Notify the Label without undue delay, and within 48 hours at the latest, after becoming aware of a personal data breach affecting the Label's data. The notice will include the information available at the time, completed as further information becomes available.
8. End of service. When the Label's account is closed, make the Label's data and demos available for export for 30 days, then delete them, unless EU or French law requires SOUNDAR to keep them. Backups are overwritten by the hosting provider within 30 days.
9. Audits. Make available all information needed to show compliance with Article 28 GDPR, and allow audits (see section 5).

3. The Label's obligations

The Label:

1. is responsible for having a lawful basis for its outreach to artists and for the instructions it gives SOUNDAR;
2. will use SOUNDAR in line with the Terms of Service, including the daily sending limits and artists' opt-outs;
3. will not modify invite templates in a way that removes the artist's option to decline;
4. will inform its team members invited by link that their comments and votes are processed through SOUNDAR.

4. Sub-processors

4.1 The Label gives SOUNDAR general authorisation to use the sub-processors listed in Annex 3.

4.2 SOUNDAR will tell the Label by email at least 30 days before adding or replacing a sub-processor. The Label may object on reasonable data protection grounds within that period. If the parties cannot agree on a solution, the Label may close its account. Any amounts paid in advance for the period after closure will then be refunded.

4.3 SOUNDAR imposes on each sub-processor, by contract, data protection obligations that are substantially the same as those in this DPA. SOUNDAR remains responsible to the Label for its sub-processors' performance.

5. Audits

5.1 On written request, SOUNDAR will provide the information reasonably needed to show compliance with this DPA, such as a description of its security measures and its sub-processor list.

5.2 If that information is not enough, the Label may carry out an audit, or have it carried out by an independent auditor bound by confidentiality:

• at most once per year (more often in case of a breach or a request from a supervisory authority);
• with at least 30 days' written notice;
• during business hours;
• at the Label's own cost;
• without access to other customers' data.

6. Transfers outside the European Union

SOUNDAR hosts personal data in the European Union (France). If a sub-processor processes personal data outside the EU/EEA, SOUNDAR ensures the transfer is covered by an adequacy decision (such as the EU–US Data Privacy Framework, for certified providers) or by the European Commission's Standard Contractual Clauses.

7. Liability, duration and law

7.1 Each party's liability under this DPA is subject to the limits in the Terms of Service, except where the GDPR does not allow them.

7.2 This DPA lasts as long as SOUNDAR processes personal data on the Label's behalf.

7.3 This DPA is governed by French law. The courts of Paris have exclusive jurisdiction.

7.4 If this DPA and the Terms of Service conflict on data protection, this DPA prevails.

---

Annex 1 — Details of the processing

Subject matter: providing the SOUNDAR service to the Label. This covers:

• sending demo requests to artists from the Label's own email address;
• receiving and storing the demos artists upload;
• review tools (notes, shortlist, team sharing, votes, comments);
• replies to artists.

Duration: the term of the Label's account, plus the 30-day export period after closure.

Nature and purpose: collection, storage, organisation, consultation, transmission (sending emails), sharing within the Label's team, and erasure, all for the Label's A&R activity: discovering and evaluating artists.

Categories of data subjects:

• artists contacted on the Label's behalf, or who send it demos;
• the Label's team members invited to review a shortlist by link.

Categories of personal data:

• Artists: name or artist name, professional contact email, the content of emails exchanged through SOUNDAR, demo audio files and track titles, messages written by the artist, the Label's notes, decisions and feedback about them, and opt-out status.
• Team members: name entered when reviewing, comments and votes.

Special categories of data: none intended. Labels and artists should not include sensitive data in messages or notes.

Annex 2 — Technical and organisational security measures

• Hosting: in the EU (France, Paris), at Scaleway SAS.
• Encryption: all traffic uses HTTPS (TLS).
• Passwords: stored only as one-way salted hashes.
• Gmail access keys: encrypted in the database with a master key stored separately from the database. SOUNDAR only requests Gmail permission to send (gmail.send). It cannot read the Label's mailbox.
• Access control: access to production data is limited to the operator of SOUNDAR. Each label sees only its own data. Team sharing uses private, unguessable links.
• Abuse protection: limits on login, sign-up and booking attempts, and a daily sending cap per label.
• Data minimisation and retention: automatic deletion per the Privacy Policy:
  • artists never contacted: after 6 months;
  • artists contacted without reply: after 12 months;
  • security logs: after 6 months;
  • closed accounts: 30 days after closure.
• Opt-outs: an opt-out record is kept so that artists who decline are not contacted again.
• Backups: made by the hosting provider and overwritten within 30 days.
• Updates: the operating system and dependencies receive security updates regularly.

Annex 3 — Authorised sub-processors

Soundcharts SAS (France) supplies music market data to SOUNDAR as an independent source for the scouting radar. It does not receive the Label's personal data and is not a sub-processor under this DPA.