Data processing agreement
Last updated: September 25, 2026
This agreement forms part of Labelmate's terms of use. It applies as soon as a label uses Labelmate, and governs the processing we carry out on its behalf, within the meaning of Article 28 GDPR.
1. The parties
The label using Labelmate is the controller. Labelmate's publisher, Tom Nsengiyumva (sole proprietor, enterprise number 1022.549.155, VAT BE 1022.549.155), is the processor.
2. What we do for the label
| Processing | Data | Duration |
|---|---|---|
| Keeping the label's computers in sync through the relay, or registering there a computer that asks for the AI key | Sealed copies of the label's database and of the files it holds, including the whole emails the documents Labelmate makes suggestions from came in, which we cannot read; a new computer's joining messages (its public keys, then the label's key sealed for it); identifiers, public keys and roles of the computers; IP addresses | While the label uses Labelmate, then one month at most; a joining message until it is read, and never handed out after thirty minutes |
| Having documents and emails read by the AI, if the label turns it on | The text of the documents and emails kept from the mailbox, with IBANs, card and social security numbers masked | The time of the reading; deleted by Anthropic within 30 days, save the exceptions in its policy (flagged misuse, legal duty) |
| Hosting the artist pages the label publishes, and carrying the questions asked on them | Sealed pages (statements, advances) and sealed questions, which we cannot read; page identifiers, sizes and dates; IP addresses of the browsers that open them | A page until the label takes it down, and at the latest with the sealed copies; a question until the label's app has fetched and kept it |
| Onboarding, and the Statements Managed service if the label orders it | What the label sends us or shows us: its distributors' reports, contracts, past statements and their spreadsheet, artists' balances (names, contract terms, amounts) | What it emails us arrives in our email (Google Workspace, Annex 1); kept for the time of onboarding or of the order, then deleted |
| Helping the label, at its request | What the label chooses to show us | The time of the request |
Data subjects: the label's artists and rights holders, its contacts and correspondents, the members of its team. Data: identity and contact details, contract terms, amounts and statements, the content of emails and documents. Labelmate needs no special-category data within the meaning of Article 9 GDPR, and the label must not knowingly give it any.
Six processing activities are not carried out on the label's behalf: we are their controller, and the privacy policy describes them. They are checking its license token when the app asks for the AI key (section 4), counting requests by IP address and by computer, for one minute, and the logs that protect the relay from abuse (section 3), checking for app updates, from version 0.1.2 (section 2), loading the titles' font from Adobe Fonts when the app opens (section 5), the feedback a person at the label chooses to send us from the app (section 6), and invoicing (section 5).
3. Our commitments
- Process the data only on the label's instructions (what the app does when the label uses it), and tell the label if an instruction seems to us to breach the GDPR.
- Make sure everyone authorized to process the data is bound by confidentiality.
- Apply the security measures described in Annex 2.
- Help the label answer requests to exercise rights, carry out an impact assessment where one is needed, and meet its security obligations.
- Make available the information needed to show compliance with this agreement, and allow audits under the conditions of section 7.
For an impact assessment of reading by the AI, the label finds what it needs in our note: https://getlabelmate.com/en/impact-assessment.
4. Sub-processors
The label authorizes us to use the sub-processors listed in Annex 1. We tell it at least thirty days before adding or replacing one; if it objects on reasonable data protection grounds, it may end the Service. We impose on each sub-processor protection obligations at least equivalent to those of this agreement.
5. Transfers outside the EEA
Anthropic processes texts in the United States, and Google, which hosts our email, may process outside the EEA what the label sends us by email. Cloudflare, which hosts the relay, keeps the relay's data in the European Union but handles the requests that reach it on its worldwide network and may process their logs (IP addresses) outside the EEA. These transfers rely on a mechanism the GDPR recognizes: an adequacy decision, including the EU-US Data Privacy Framework where the provider is certified, or the European Commission's Standard Contractual Clauses. For Cloudflare, Inc., it is the EU-US Data Privacy Framework, under which it is certified, and, should that certification lapse, the Standard Contractual Clauses, as its own data processing agreement provides (sections 6.2 and 6.4).
6. Data breaches
If we become aware of a personal data breach affecting the label, we tell it without undue delay, and no later than 48 hours after becoming aware of it, with what we know of its nature, its likely consequences and the measures taken.
7. Audits
Once a year and with thirty days' notice, the label may ask us for the information needed to check compliance with this agreement, or have an audit carried out at its own cost by an auditor bound by confidentiality. These limits do not apply after a data breach.
8. End of processing
The label's data stays on its computers: it has nothing to retrieve from us. What it entrusted to us for onboarding or Statements Managed is deleted as section 2 says. When it stops using Labelmate, we delete its sealed copies and artist pages from the relay no later than one month after its request, and confirm it in writing if it wishes.
9. Duration and liability
This agreement lasts as long as the label uses Labelmate. Each party's liability follows the terms of use and Article 82 GDPR.
10. Labels outside the European Union
This agreement applies to every label, wherever it is established, and we keep our commitments in the same way.
For a label established in the United States, we also act as its service provider within the meaning of the California Consumer Privacy Act (CCPA) and similar laws in other states: we process personal information only to provide Labelmate to the label, we do not sell or share it, we do not retain, use or disclose it for any other purpose or outside our direct relationship with the label, and we do not combine it with personal information from other sources, except as those laws allow.
If another country's law asks for specific commitments, write to us: we add them.
Annex 1: Sub-processors
| Sub-processor | Role | Location | Transfer mechanism |
|---|---|---|---|
| Cloudflare, Inc. | Hosting the relay: sealed copies, joining messages, artist pages and sealed questions, identifiers, public keys and roles of the computers, IP addresses | European Union (stored data); worldwide network (requests, logs) | EU-US Data Privacy Framework (Cloudflare is certified); otherwise the Standard Contractual Clauses, module three |
| Anthropic, PBC | Reading by the AI, if the label turns it on: the masked text of documents and emails, deleted by Anthropic within 30 days, save the exceptions in its policy (flagged misuse, legal duty) | United States | Standard Contractual Clauses, module three, with the UK and Swiss addenda (Anthropic's data processing addendum) |
| Our email (Google Workspace): what the label sends us by email, in particular when it asks us for help or sends us its files for onboarding or Statements Managed | In and outside the European Union | Google's data processing addendum: another recognized transfer solution where Google has adopted one, otherwise the Standard Contractual Clauses |
Annex 2: Security measures
- The label's database is encrypted on each computer (SQLCipher); its key, like the mailboxes' passwords and tokens, is kept in an encrypted vault on the computer, whose key is in the system's secure keychain.
- Copies sent to the relay are sealed on the computer, with keys that never leave it; we cannot read them.
- Artist pages are sealed on the label's computer (AES-256-GCM), under a key that travels only in the link; questions are sealed in the artist's browser.
- Every request to the relay is signed with the computer's key, time-stamped and single-use: an old, replayed or wrongly signed request is refused. The only exceptions: opening an artist's page and asking a question on it, where the link is the key, and a new computer's joining messages, authenticated with the invitation's secret.
- The AI key is handed only to the computers of a label whose license token, signed by Labelmate, is valid, or expired no more than fourteen days ago.
- The list of the label's computers is a signed chain; removing a computer changes the label's keys.
- Traffic goes over encrypted connections (TLS).
- Before any reading by the AI, IBANs, card numbers and social security numbers are masked.
- The app's logs hold no content: identifiers, counts and durations, never a subject, a name, an amount or a body of text.
- Backups are encrypted, with a fresh key for each file, and hold no password and no computer key.
- Only the publisher has access to the relay's database.