Data Processing Agreement (DPA)
Updated 15 October 2026
This Data Processing Agreement ("DPA") forms a binding part of the service engagement between Bambochezone Pty Ltd and its business clients. It defines the rights and obligations of both parties regarding the processing of personal and professional data.
- Bambochezone Pty Ltd acts as the Processor; the Client acts as the Controller.
- We process only the audio files and contact details necessary to deliver mixing and mastering services.
- Data is stored for 12 months after project completion before deletion.
- We use trusted infrastructure provided by Micron 21 Pty Ltd and FormSubmit for communication.
1. Definitions and Scope
This DPA is governed by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs). "Personal Data" refers to any information relating to an identified or identifiable natural person, including contact details and metadata associated with audio stems. "Processing" refers to any operation performed on such data, including storage, mixing, and mastering.
2. Subject Matter and Duration
The subject of this processing is the provision of professional audio engineering services. The duration of processing corresponds to the length of the service contract and the subsequent storage period defined in our Terms and Conditions.
3. Categories of Data and Subjects
The Processor handles the following categories:
- Data Subjects: Client representatives, artists, and session musicians.
- Data Types: Names, email addresses, phone numbers, and audio recordings (stems, masters) provided by the Client.
4. Obligations of the Processor
Bambochezone Pty Ltd agrees to:
- Process data only on documented instructions from the Client.
- Ensure that personnel authorised to process the data have committed themselves to confidentiality.
- Assist the Controller in responding to requests from data subjects regarding their rights under the Privacy Act 1988 (Cth).
5. Sub-processors
To provide the services, the Processor engages the following sub-processors:
- Micron 21 Pty Ltd (Unit 2, 7 Eastspur Court, Kilsyth South VIC 3137): Hosting and data storage infrastructure.
- FormSubmit (USA): Processing of initial contact enquiries and application forms.
The Processor ensures that sub-processors provide sufficient guarantees to implement appropriate technical and organisational measures in accordance with APP 8.
6. Technical and Organisational Security
Bambochezone Pty Ltd implements security measures including encrypted data transmission, secure access controls for the 22m² control room environment, and regular backups of project files to prevent accidental loss or unauthorised access.
7. Incident Notification
In the event of a data breach, the Processor shall notify the Client without undue delay after becoming aware of the incident. We will cooperate fully with the Client and the Office of the Australian Information Commissioner (OAIC) to mitigate the effects of the breach.
8. Data Return and Deletion
Upon termination of services, the Processor will return or delete all Personal Data. In accordance with our business rules, project files are stored for 12 months to facilitate potential revisions or re-delivery before being permanently erased, unless otherwise agreed in writing.
9. Audit and Compliance
The Processor shall make available to the Client all information necessary to demonstrate compliance with the obligations laid down in this DPA and allow for and contribute to audits conducted by the Client or another auditor mandated by the Client.
10. Governing Law and Jurisdiction
This DPA is governed by the laws of Western Australia. Any disputes arising from this agreement shall be subject to the exclusive jurisdiction of the courts in Perth. For further enquiries, contact Grace Nguyen at [email protected] or (08) 6489 5424.
Complaints may also be directed to the OAIC: GPO Box 5288, Sydney NSW 2001, https://www.oaic.gov.au.