Data Processing Agreement

1. Roles

The customer is the controller (or the processor, when it handles data on behalf of its own clients, in which case MARS is its sub-processor). MARS is the processor and, for United States laws, a service provider.

2. Details of the processing

Subject matter and duration: providing ORBEAT while the Terms are in force and during the export and deletion period in section 10.

Nature: hosting, storing, organizing, transmitting and displaying data; generating documents; sending emails and signature requests; watermarking downloads; and, when the customer uses them, artificial intelligence features.

People: the customer’s writers, artists, producers and other collaborators; its contacts and leads; the recipients of its links; the signers of its documents; and its team’s users.

Data: names, contact details, roles, professional identifiers (IPI/CAE, ISNI, collective management organization), authorship, split and ownership data, signatures and their record, recipients’ listening and download activity and, only when the customer loads them in the private fields made for it, tax and identification data (for example social security or taxpayer numbers), which some laws treat as sensitive and whose access is restricted to the customer’s managers. No other sensitive data is intended to be processed.

3. Instructions

MARS handles the data only on the customer’s documented instructions: the Terms, this agreement and what the customer does with ORBEAT’s features and settings. If an instruction appears to break the law, MARS will tell the customer.

4. Staff confidentiality

The people MARS authorizes to handle the data are bound to keep it confidential and access only what they need.

5. Security

MARS keeps the technical and organizational measures in annex 1 and may improve them, without lowering the level of protection.

6. Sub-processors

The customer authorizes MARS to use the sub-processors in annex 2. MARS will give notice by email or inside ORBEAT at least 30 days before adding or changing one. The customer may object on reasonable data protection grounds; if we cannot find a solution, the customer may terminate the affected service.

MARS imposes on each sub-processor data protection obligations equivalent to those in this agreement and remains responsible for their compliance.

7. Requests from individuals

If a person writes to MARS to use their rights over customer content, MARS will pass the request to the customer without delay and within 5 business days at the latest, and will not answer it except to say whom to contact. ORBEAT offers tools to look up, correct, export and delete data, and MARS will reasonably help the customer.

8. Security incidents

If MARS confirms an incident affecting personal data in customer content, it will tell the customer without delay and no later than 72 hours after learning of it, with the information available (what happened, which data and people may be affected, what is being done), and will complete it as more becomes known.

9. Impact assessments

MARS will give the customer the reasonable information it needs for its impact assessments and consultations with authorities about ORBEAT.

10. Return and deletion

The customer may export its data while the service is in force and for 30 days after it ends. Then MARS deletes it, except for what remains in backups until they rotate, protected by this agreement, and what the law requires to be kept.

11. Audits

MARS will answer reasonable questionnaires and share a summary of its security measures. If that is not enough, the customer may audit once every 12 months, with 30 days’ notice, at its own cost, under confidentiality and without disrupting the service. A competent authority may audit when the law allows it.

12. International transfers

Data is stored in the United States. For transfers from the European Economic Area, the European Commission’s standard contractual clauses (Decision 2021/914) are incorporated, module 2 (controller to processor) and module 3 (processor to processor), with the United Kingdom addendum and the Swiss adjustments where they apply. Options: clause 7 (docking) is included; in clause 9(a), option 2 (general authorization) with the 30 days’ notice in section 6; the option in clause 11 is not used; the supervisory authority under clause 13 is that of the member state where the customer is established or, if it is not, that of its representative; clauses 17 and 18 are governed by the law of Ireland and its courts. The clauses’ annexes are completed by section 2 and annexes 1 and 2 of this agreement.

For Brazil, the standard contractual clauses approved by the ANPD are used where the law requires them. For Mexico, sending data to MARS as a processor is done under the law on the protection of personal data held by private parties.

13. United States laws

As a service provider, MARS does not sell or share the personal data in customer content; does not keep, use or disclose it outside its relationship with the customer or for any purpose other than providing ORBEAT; does not combine it with data from other sources except as the law allows; complies with the applicable privacy laws and will tell the customer if it can no longer do so. The customer may take reasonable steps to stop unauthorized use.

14. Liability, term and changes

Liability under this agreement follows the limits in the Terms of Service, except where the law does not allow it to be limited. This agreement lasts as long as MARS handles personal data in customer content.

MARS may update this agreement at any time; the version in force is the one published on this page. Where the law requires MARS to notify the customer or obtain its agreement (for example, before a new sub-processor under section 6, or for a change that lowers the protection of personal data), MARS will do so.

Annex 1. Security measures

Encryption in transit (TLS) and at rest. Row-level access rules on every database table, by company and role. Server keys on the server only, never in source code or in the browser.

Sign-in with a password kept only in irreversibly hashed form, or with a one-time code by email. Files in private storage, handed out through signed links that expire. Watermark keys kept apart, reachable by the server only.

Signing record with a SHA-256 seal. Database backup every night, with checks and alerts. Availability monitoring. Staff access limited to what is needed. Software dependencies kept up to date.

Annex 2. Sub-processors

Supabase: database, sign-in and file storage. United States (AWS us-east-1).

Netlify: website hosting, server functions and backups. United States.

Resend: email delivery. United States.

Anthropic: artificial intelligence features (Claude), only when used. United States.

Other artificial intelligence providers (for example OpenAI or Google) may be added under section 6, on the same conditions as Anthropic.

Contact

MARS Digital LLC · privacy@marsmusic.pro