Data processing agreement

1. Parties and roles

Controller (Client): the business customer placing an order with Nobodyluno GmbH, company register FN 525382 w, "Client".

Processor: Nobodyluno GmbH, limited liability company (GmbH), Lerchenfelder Straße 14, 1080 Wien, UID ATU67188759, "Nobodyluno" or "Processor". Contact: [email protected], 01 890 4523, managing director Lukas Gruber.

The Client determines purposes and means for personal data of artists, guests, hosts or other participants the Client brings to the studio. Processor handles that data only on documented instructions, in addition to terms and conditions and — for Processor’s own client contact — the privacy policy.

2. Subject matter and term

This agreement covers studio services such as vocal recording, mixing, mastering, podcast production and music production as set out in the quote. It runs from acceptance until return or deletion after the archive period (default 24 months, see terms and conditions), unless extended in writing.

3. Nature of processing

Processor captures audio, edits and delivers files, schedules sessions, keeps project copies to perform the service and supports quality checks for the Client. Processing takes place in Vienna and on approved sub-processor systems. No use for Processor’s own marketing or AI training, as stated in the privacy policy.

4. Categories of data and data subjects

Data subjects: artists, guests and staff introduced by the Client. The Client ensures a valid legal basis and informs data subjects — for example via vocal prep guide or the Client’s own release forms.

5. Instructions

Processor processes only on documented instructions from the Client (quote, email, session brief). If instructions appear incompatible with the GDPR, Processor informs the Client. Processor may refuse clearly unlawful processing.

6. Processor obligations

• Confidentiality for all staff involved.
• Appropriate technical and organisational measures (access control, HTTPS, backups, physical security of the Josefstadt premises).
• Assistance with data subject requests where Processor holds the data; referral to the Client where appropriate.
• Notification of personal data breaches to the Client without undue delay, with information for Arts. 33 and 34 GDPR.
• After completion: return or deletion per the Client’s choice, subject to legal retention (e.g. invoices for seven years).

7. Sub-processors

The Client gives general written authorisation to use:

• World4You Internet Services GmbH, hosting and storage;
• FormSubmit, form forwarding (US — see privacy policy);
• accountant and bank, limited to administration.

Processor informs the Client of intended changes to sub-processors; the Client may object within 14 days for important reasons. Sub-processors are bound to equivalent Article 28 obligations.

8. Transfers

Processing is primarily within the EEA. Transfer via FormSubmit to the US may occur when data subjects use the contact form; alternative is direct email to [email protected]. Processor applies the safeguards described in the privacy policy and additional measures where needed.

9. Audits

The Client may once per calendar year, by appointment and reasonable notice, request evidence or an audit by an independent third party under confidentiality. Costs are borne by the Client unless serious breach by Processor is proven.

10. Liability

Liability between the parties follows terms and conditions and mandatory law. Processor is liable for damage from breach of this agreement or the GDPR to the extent provided in Art. 82 GDPR.

11. Final provisions

Austrian law applies. For business parties, courts in Vienna apply where permitted. The text on https://nobodyluno.click is a model; the signed copy in the quote file prevails. Request a PDF via contact. Model version: 15 October 2026.

The German version of this agreement is authoritative; this English text is for information.