Data processing agreement
This English text is for convenience. The Dutch version is legally authoritative. Verwerkersovereenkomst
In brief
- This text applies when a business has third parties recorded or finished with us.
- You remain the controller; Culticlayer is the processor for those third parties.
- We keep working sessions 18 months, then delete or return them.
- The hosting sub-processor is TransIP B.V. in Leiden; FormSubmit sees only our own form.
- Dutch law, establishment in Amsterdam; questions via [email protected].
1. Parties and roles
This data processing agreement (Article 28 GDPR) sits with the terms and conditions of Culticlayer B.V., Bilderdijkstraat 112, 1053 KW Amsterdam, Chamber of Commerce 64084381, VAT NL851421933B01, represented by Lars Hendriks (the processor or Culticlayer).
The other party is the business client that accepts a written order or confirmed quote in which personal data of people other than the client itself will be processed (the controller). The payment term between businesses is 21 days, as in the terms. This page is the default set; a signed annex may tighten a point, not weaken one where the GDPR is mandatory.
The Dutch version is authoritative. English is an informative translation.
2. When this agreement applies
It applies when the client engages us to process personal data of third parties, for example:
- guests or presenters during Talk and podcast recording;
- singers, session players or voice-over talent during Vocal recording;
- a full line-up in the live room during Live band recording;
- recognisable voices in files we receive for Mixing or Mastering.
If an artist or podcaster books for themselves, we are the controller towards that person. Then the privacy policy applies, not this processor role. The studio has 4 rooms; the client makes sure the people who come along know that recording will take place.
3. Subject, nature, purpose and duration
Subject. Technical recording, editing, mix or master, plus temporary storage of the working sessions until delivery.
Nature and purpose. Capturing sound, editing and exporting in the formats the order confirms. No publication by Culticlayer, no marketing list, no training of a model.
Duration. From the confirmed booking until deletion or return after the archive period of 18 months after the last session day, or earlier on written request, plus the period the law requires for our own accounts (invoices: seven years).
Prices of the underlying service, for example €72 per hour of talk or €175 per mix track (including 21 % VAT), appear on the quote. They do not change the processor duties.
4. Categories of data subjects and data
| Data subjects | Data |
|---|---|
| Guests, voices and musicians the client brings or delivers | Voice, optionally a name or artist name, monitoring notes, file names |
| The client’s contact people | Name, email, phone, schedule — we process those as controller for the client relationship; see the privacy policy |
| Minors | Only if the client confirms that a legal guardian consents; the floor in our house rules is 16 years |
Special categories (health, political opinion, religion) do not belong in the briefing. If such content is unavoidable in the conversation, the client remains responsible for the legal basis towards those guests. We do not ask for it and we do not index it.
5. Instructions
We process only on the controller’s documented instructions, plus what the GDPR and Dutch law require. If we doubt whether an instruction is lawful, we say so before we carry it out. Publication, sending stems to a third-party label, or an extra revision round beyond the 2 rounds already set happens only after a clear order. A spoken wish in the control room is confirmed by email if it changes the processing.
6. Confidentiality
Access to session files is limited to Lars Hendriks, Sophie Willems and Daan Prins, each for their own craft. They are bound to secrecy. We do not play a take for others, put a clip on a showreel or name a guest on the site without the controller’s written consent (and, where needed, the guest’s). Working sessions do not sit in a public folder.
7. Security
In line with Article 32 GDPR we apply appropriate technical and organisational measures: HTTPS for the site, individual accounts, strong passwords, encrypted workstation disks, premises locked outside Tue–Fri 10–19, Sat 12–17, and deletion after the archive period. The live room (38 m²) and the 2 booths are reserved for that session during a booking; we do not let a second production listen in. A residual risk remains on any path over the internet; the client chooses how stems are delivered. Practical formats are in delivering stems for mix.
8. Sub-processors
The client gives general written authorisation for the following sub-processors, insofar as they take part in this processing:
- TransIP B.V., Vondellaan 47, 2332 AA Leiden, the Netherlands, transip.nl — hosting and storage in the Netherlands;
- our accountant — only the client’s invoice lines, not guest audio.
FormSubmit processes messages from our own contact form, in which the client types contact details. That is not sub-processing of guest recordings. If we appoint a new sub-processor that does see guest data, we say so in advance. An objection within fourteen days is taken seriously; without a reasonable alternative the order may stop without extra studio hire for hours not yet run.
9. Transfers outside the EEA
Guest recordings and working sessions stay with TransIP B.V. in the Union. We do not send those files to FormSubmit or to a US platform unless the client chooses that channel and instructs us in writing. If the client chooses a transfer service outside the EEA, that choice is an instruction of the controller, who must provide a valid transfer ground.
10. Assistance
We help the controller with data-subject requests (access, erasure, restriction), with a data-protection impact assessment if the nature of the production requires one, and with contact with the Dutch Data Protection Authority. We reply to the client within 3 working days so that the client can meet the statutory one-month period. Requests from a guest are forwarded to the client, unless the law requires us to act ourselves.
11. Breaches
If we discover a personal-data breach covered by this agreement, we warn the controller without undue delay, and in any event within 48 hours after we established the breach. We give the nature of the incident, the categories involved, the likely consequences and the measures already taken. The client decides whether a notification to the Autoriteit Persoonsgegevens or to the guests is needed. Our own duties as a studio remain, see article 8 of the privacy policy.
12. Return, deletion and audits
At the end of the order we deliver the agreed files and delete the working sessions after 18 months, or earlier on request, except what we must keep by law (invoice records). On written request we confirm the deletion. The client may, with reasonable notice and at most once every twelve months, ask for a written explanation of our measures or — if that explanation is not enough — an on-site audit during Tue–Fri 10–19, Sat 12–17, without disturbing other people’s sessions. The client bears the cost of an external auditor, unless the audit shows a serious shortcoming we should have prevented.
13. Liability, law and closing
Each party remains liable for its own GDPR role. We are not liable for instructions of the client that turn out to be unlawful, nor for publication the client carries out. Dutch law applies. Disputes about this processor role belong before the competent court in Amsterdam, without prejudice to mandatory law.
Effective date: 1 October 2026. Last checked: 1 October 2026. Questions: [email protected] or contact. See also legal notice. A deposit of 25 % and free cancellation up to 5 days ahead sit in the terms; those rules do not change these processor duties.