Data processing agreement
The studio's commitments when it records people on behalf of a business client.
Key points
- Applies when a business client (agency, producer, company) asks us to record third parties.
- The client is the controller; the studio is the processor (Article 28 GDPR).
- We act only on the client's written instructions.
- Data breach: notification to the client within 48 hours.
- End of assignment: deletion of data no later than 12 months after delivery, or earlier on request.
§01Purpose and parties
This agreement forms part of the contract between the business client ("the controller") and Bentstarshift SASU, 27 Rue des Amidonniers, 31000 Toulouse, France, RCS Toulouse 928 417 369 ("the processor"). It applies when the studio processes third parties' personal data on the client's behalf: dubbing or voice-over actors, podcast guests, people filmed, session musicians hired by the client.
It is drawn up in accordance with Article 28 of Regulation (EU) 2016/679 (GDPR). Acceptance of the quote constitutes acceptance of this agreement.
Back to contents§02Description of the processing
| Nature | Audio and video recording, editing, storage and delivery of files |
|---|---|
| Purpose | Delivering the service ordered by the client |
| Data | Voice, image, first and last name, contact details, information contained in the script |
| Data subjects | Actors, speakers, guests and musicians designated by the client |
| Duration | Duration of the service, then archiving for at most 12 months after delivery |
§03Studio obligations
The studio undertakes to:
- process the data only on the client's documented instructions, and inform the client if an instruction appears to infringe the law;
- ensure the confidentiality of the data and that authorised persons are bound by confidentiality;
- never use the recordings for its own purposes, to train an artificial intelligence system or to create a synthetic voice;
- help the client respond to data subjects' requests to exercise their rights;
- help the client meet its obligations regarding security, breach notification and, where relevant, impact assessment;
- make available to the client the information needed to demonstrate compliance with this agreement.
§04Client obligations
The client, as controller, informs the people recorded about the processing of their data, has a legal basis for it, obtains their permissions for exploitation (performers' rights, image rights) and documents its instructions in writing.
Back to contents§05Sub-processors
The client authorises the following sub-processors:
- o2switch SAS (France), e-mail hosting;
- the file transfer service agreed with the client for delivery.
The studio informs the client of any intended change; the client has 15 days to object. Each sub-processor is bound by the same obligations as the studio.
Back to contents§06Security
The studio implements appropriate technical and organisational measures (Article 32 GDPR): access to sessions limited to the team, two-factor authentication, double backup on encrypted drives kept in separate places, time-limited delivery links, secure deletion.
Back to contents§07Data breaches
The studio notifies the client of any personal data breach within 48 hours of becoming aware of it, with the information listed in Article 33(3) GDPR, so that the client can notify the supervisory authority within 72 hours.
Back to contents§08Location and transfers
Data is stored in France. No transfer outside the European Union is made for this processing without the client's written instruction and appropriate safeguards under Chapter V GDPR.
Back to contents§09End of the service
At the end of the service, the studio delivers the files to the client and then keeps the session for at most 12 months for any revisions. On the client's written request, it deletes the data earlier and confirms this in writing. No copy is kept beyond that, save where required by law.
Back to contents§10Audit and liability
The client may, at its own expense and with 15 days' notice, check compliance with this agreement by questionnaire or by visiting the studio during opening hours. Each party is liable for the breaches attributable to it, under Article 82 GDPR. This agreement is governed by French law; the Toulouse Commercial Court (Tribunal de commerce de Toulouse) has jurisdiction.
Back to contents