Data Processing Agreement (DPA)

1. Definitions and Parties

This Agreement is entered into between the Client (referred to as the "Data Controller") and Sticketzyra S.L. (referred to as the "Data Processor"), located at Calle de Colom, 42, 46004 Valencia, represented by its director Juan Cano Suárez, with a share capital of 3,000 €.

2. Subject Matter and Duration

The purpose of this agreement is to ensure that the processing of personal data carried out by Sticketzyra S.L. complies with Regulation (EU) 2016/679 (GDPR) and the Spanish Organic Law 3/2018 (LOPDGDD). This agreement takes effect upon the date of service engagement and remains valid throughout the business relationship, extending until the total deletion of data as specified in our Terms of Service.

3. Categories of Data and Subjects

Processing is strictly limited to the following:

• Data Subjects: Musicians, voice-over artists, podcasters, and administrative staff of the Client.
• Data Categories: Names, email addresses, phone numbers, and primarily, audio content (vocals and instruments) which may contain biometric data or implicit personal information.

4. Obligations of the Processor

Sticketzyra S.L. undertakes to process data strictly following the documented instructions of the Controller. We will not use the data for our own purposes nor transfer it to third parties without prior consent, except where necessary for the execution of the professional service.

5. Authorized Sub-processors

To provide the service, the Processor utilizes the following sub-processors:

The Client acknowledges and accepts that FormSubmit processes data in the USA under standard international transfer safeguards.

6. Security and Incident Notification

We implement reasonable technical and organizational measures to protect data against unauthorized access. In the event of a security breach, Sticketzyra S.L. will notify the Data Controller without undue delay after becoming aware of the incident.

7. Return, Erasure, and Audit

Upon completion of the service, the Processor will return or delete the personal data. According to our business rules, we maintain a session archive for 12 months to facilitate accidental recoveries; after this period, the data is permanently erased.

The Controller has the right to conduct reasonable audits regarding the compliance of this DPA upon prior notification.

8. Legislation and Jurisdiction

This agreement is governed by Spanish and European law, including the consolidated text of the General Law for the Defense of Consumers and Users (RDL 1/2007) and article 22.2 of Law 34/2002 (LSSI-CE). For any disputes, the parties submit to the jurisdiction of the courts and tribunals of the city of Valencia.

For claims related to data protection, you may contact the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, or via https://www.aepd.es.