Data processing agreement
This English text is for convenience. The Dutch version is legally authoritative. Verwerkersovereenkomst
In brief
- These clauses apply when your company has third parties recorded and you set the purpose.
- We follow written instructions; you remain the controller toward those people.
- Session files stay 12 months unless you ask us to delete sooner.
- Sub-processors: TransIP B.V. and, only if the web form is used, FormSubmit.
1. Parties and roles
This data processing agreement (the “Agreement”) is the arrangement referred to in Article 28 GDPR between you as controller (the “Client”) and Cijativojaconsulting B.V., Overtoom 141, 1054 HG Amsterdam, Chamber of Commerce 99300652, VAT NL851172726B01, director Maarten van Dijk (the “Processor”). The Dutch text is authoritative. Effective date: 1 October 2026.
The Agreement supplements the terms and conditions. On personal data of third parties, this text prevails if the two conflict. Company identity: legal notice. Privacy toward you as a contracting party: privacy policy.
2. When this Agreement applies
The Agreement applies when the Client hires Cijativojaconsulting to record people or edit their audio, while the Client determines the purposes and means of that processing. Typical cases: Podcast recording with the Client’s guests, Voice-over & dubbing for a video production, or Vocal recording by a hired singer who is not the paying client.
If you book as a natural person recording your own voice, you are not a controller for third parties and this Agreement does not apply: only the privacy policy does. Practical notes for makers: podcast rights and consent.
By accepting a quote that states third parties will be recorded, or by confirming in writing that this Agreement applies, the Client accepts these articles.
3. Subject matter, nature, purposes and people
The Processor handles personal data only to perform the booked studio or post-production work and to deliver the agreed files. Nature of the processing: recording, editing within the agreed revision rounds (2), storing for the archive period, and handing files to the Client.
| Item | Description |
|---|---|
| Data subjects | Voices, guests, voice-over talent or musicians the Client brings or invites |
| Data | Voice, image if the Client films, name, schedule, technical file metadata |
| Special-category data | Not intended. The Client instructs participants not to record medical or other special-category data unless that is the subject and a legal basis exists |
| Place | Studio at Overtoom 141, 1054 HG Amsterdam, plus storage at TransIP B.V. |
The Processor does not use this data for its own marketing, for training artificial intelligence, or for publication without the Client’s written instruction.
4. Instructions
The Processor acts only on the Client’s documented instructions, including transfers to a country outside the EEA, unless Union or Dutch law requires otherwise. In that last case the Processor says so, to the extent the law allows.
Instructions go by email to [email protected] or through the contact form. If an instruction appears to breach the GDPR, we say so without delay and do not carry it out until the Client amends it or confirms in writing that the Client accepts the risk, so far as the law allows.
The Client warrants that it has a legal basis toward the people recorded, that it informs them, and that anyone under 16 takes part only with the required consent of a legal guardian.
5. Confidentiality and security
People at the Processor who have access — the team led by Maarten van Dijk — are bound to confidentiality. Measures, sized for a compact studio with 3 rooms and 16 microphone preamps:
- HTTPS on the website;
- individual accounts and encrypted disks;
- a locked building outside sessions;
- file delivery through an agreed channel, not a public link without a password;
- deletion after the archive period, see article 10.
The Processor takes Article 32 GDPR into account: appropriate technical and organisational measures, not absolute infallibility. We do not publish a brand list of locks or software, because that list would itself become a risk.
6. Sub-processors
The Client hereby gives general written authorisation for the following sub-processors:
- TransIP B.V., Schipholweg 103, 2316 XC Leiden, Nederland — hosting, email and storage in the EEA (transip.nl);
- FormSubmit (formsubmit.co), United States — only if the Client uses the web form to send a brief. See article 7 of the privacy policy for the basis of that transfer.
If the Processor wants another sub-processor, it gives written notice. The Client may object with reasons within fourteen days. Without a timely objection the new party is treated as authorised. The Processor imposes duties on each sub-processor that are at least equivalent to this Agreement.
The Processor’s accountant and bank see at most the Client’s invoice data, not session audio of the Client’s guests, unless a dispute makes that necessary.
7. Transfers outside the EEA
Session files and the studio mailbox sit with TransIP B.V. in the Netherlands. A transfer to the United States happens only if the Client uses FormSubmit. That transfer then follows the send path the Client chose. Alternative: email [email protected] or call 020 737 0842.
The Processor does not make other transfers outside the EEA without a documented instruction and a mechanism Chapter V GDPR allows.
8. Help with data-subject rights
If the Processor receives a request from a guest, vocalist or other data subject, it forwards that request to the Client and waits for instruction, unless the law requires direct action. The Processor gives the Client the technical information reasonably needed for access, erasure or portability, so far as that information sits in our systems.
The Client remains the contact for data subjects. We do not publish a guest list and we do not answer publication questions on the Client’s behalf.
9. Personal-data breaches
The Processor reports a personal-data breach that it processes under this Agreement as soon as reasonably possible, and where feasible within 48 hours of discovery, to the Client at the email address we have on file. The notice covers the nature of the incident, the categories involved so far as known, likely consequences, and measures taken or proposed.
The Client decides whether to notify the Autoriteit Persoonsgegevens or the people concerned (Articles 33 and 34 GDPR). The Processor helps with facts it has, without filing a notice in the Client’s name unless the Client asks in writing or the law forces us to.
10. Retention, return and deletion
The Processor keeps working files and recordings for 12 months after the last session on the job, so revisions (2 rounds) and redelivery remain possible. We then delete the audio, unless a legal duty or a pending dispute requires a longer hold, or the Client asks in writing for a different period.
On the Client’s written request we redeliver the agreed files earlier or delete them earlier, after outstanding invoices for that job are paid — business payment term 14 days, see the terms and conditions. The Client’s own invoice data we keep for seven years.
Deletion means the files are gone from our active archive and cannot be restored with ordinary tools. Backups may still rotate for a short cycle; those copies then drop as well.
11. Demonstrating compliance and audits
The Processor lets the Client check compliance through a written explanation and — on a reasonable request, at most once every twelve months, with ten working days’ notice — by reviewing relevant measures at the studio on Overtoom 141. An audit takes place during Mon–Fri 10–19, Sat 11–17 (by appointment), without interrupting other clients’ sessions and without copies of their material.
The Client bears its own audit costs. We do not grant access to TransIP B.V. systems that the host does not itself give to end customers. We claim no certificates or quality marks.
12. Liability
Each party is liable toward data subjects under Article 82 GDPR for damage that flows from its own processing. Between the parties, the liability rules in the terms and conditions apply, including the published rates inclusive of 21 % VAT — for example €295 per Podcast recording episode or €118 per studio hour of Voice-over & dubbing.
The Processor is not liable for the Client’s instructions, for missing guest consent, or for publication the Client carries out after delivery.
13. Term, changes and ending
The Agreement runs from acceptance of the job until the archive period ends, or until earlier deletion on request. Clauses on confidentiality, liability and evidence survive as long as needed.
We publish changes on this page with a new date 1 October 2026. For live jobs we email the Client if a change is material. Ending the studio relationship stops new processing; existing files follow article 10.
14. Governing law and contact
This Agreement is governed by the law of the Netherlands. Disputes the parties do not settle between themselves go to the competent court in the district of Amsterdam, without prejudice to mandatory consumer law if that unexpectedly applies. No mediator is listed in this studio’s specification.
Processor contact: [email protected], 020 737 0842, Overtoom 141, 1054 HG Amsterdam. Hours: Monday–Friday 10:00–19:00, Saturday 11:00–17:00 (by appointment only). Closed on Sunday.. Host: TransIP B.V.. Tracker choice on the site: cookie policy. Questions about the studio itself: about or FAQ.