Dropbeats legal
Data Processing Addendum
Our standard processor commitments for customer-controlled personal data under GDPR Article 28 and Swiss data-protection law.
1. Application and roles
This DPA forms part of the agreement between the customer (“Controller”) and Tribe Music Group AG, operating Dropbeats (“Processor”), where Dropbeats processes personal data in Customer Data on the Controller’s behalf. Terms such as personal data, processing, controller and processor have the meanings given by applicable data-protection law.
2. Processing details
Processing lasts for the term of the Service and is performed to host, structure, analyse, secure, support and make Customer Data available as instructed through Dropbeats. Data subjects may include artists, composers, managers, employees, contractors, rights-holders, payees, counterparties and invited recipients. Data may include identity and contact details, catalogue identifiers, royalty and payment information, contract and ownership information, audience data, files, access records and other information submitted by the Controller.
3. Documented instructions
We process personal data only on documented instructions contained in the agreement, this DPA and the Controller’s use and configuration of the Service, unless law requires otherwise. We will inform the Controller if an instruction appears to infringe applicable data-protection law.
4. Confidentiality
Personnel authorised to process personal data are bound by confidentiality obligations and receive access only where required for their role.
5. Security
We maintain measures appropriate to the risk, which may include access control and least privilege, authentication, encryption in transit, tenant separation, logging and monitoring, backup and recovery controls, vulnerability and incident management, provider diligence and staff confidentiality.
6. Subprocessors
The Controller authorises the use of subprocessors necessary to provide the Service. We remain responsible for their performance to the extent required by law and impose data-protection obligations consistent with this DPA. We will make current subprocessor information available on request and provide reasonable notice of material additions where contractually required.
7. International transfers
Where personal data is transferred internationally and a recognised adequacy mechanism does not apply, the parties will rely on an appropriate safeguard, including applicable standard contractual clauses, together with supplementary measures where needed.
8. Assistance
Taking account of the nature of processing and information available to us, we will reasonably assist the Controller with data-subject requests, security assessments, data-protection impact assessments and consultations with authorities. The Controller remains responsible for responding to requests and for the lawfulness of its instructions and Customer Data.
9. Personal-data incidents
We will notify the Controller without undue delay after becoming aware of a confirmed personal-data breach affecting Customer Data and provide information reasonably available to support the Controller’s obligations. Notification is not an admission of fault or liability.
10. Return and deletion
At the end of the Service, we will delete or return personal data as required by the agreement and the Controller’s instructions, unless law requires retention. Limited copies may remain temporarily in protected backups until overwritten under ordinary backup cycles.
11. Information and audits
We will make information reasonably necessary to demonstrate compliance available to the Controller. Audits must be proportionate, protect other customers and confidential systems, and ordinarily begin with documentation or independent reports before an on-site review is considered.
12. Signed copy and contact
This page summarises our standard DPA. A signature-ready version, including any required transfer clauses and customer-specific details, is available by contacting hello@dropbeats.ai.