Privacy policy
This English text is for convenience. The Dutch version is legally authoritative. Privacyverklaring
In brief
- We keep what we need to reply, schedule a session and deliver the work.
- No newsletter, no ad network and no sale of personal data.
- Working sessions are deleted 18 months after the last recording day, unless accounts must be kept longer.
- Voice and session files are not sent to systems that clone voices or train models.
- Questions or requests: [email protected] or 020 737 4821, during Tue–Fri 10–19, Sat 12–17.
1. Who processes this data
The controller is Culticlayer B.V., a private limited company (B.V.) at Bilderdijkstraat 112, 1053 KW Amsterdam (Oud-West), the Netherlands. Chamber of Commerce number 64084381. VAT identification number NL851421933B01. Issued capital €100. Day-to-day management: Lars Hendriks.
This page covers personal data that arrives through culticlayer.click, the enquiry form, email, telephone and studio appointments. Dutch law applies, together with Regulation (EU) 2016/679 and the Dutch GDPR Implementation Act. Dutch wording is the legal version; English is provided so you can read the same facts in another language.
Our size and activity do not require a data protection officer. Privacy questions go to [email protected] or 020 737 4821. Opening hours: Tuesday–Friday 10:00–19:00, Saturday 12:00–17:00. Closed Sunday and Monday. How to reach us: Tram 7 stops at Bilderdijkstraat; from the Bilderdijkstraat stop it is about a 3-minute walk to number 112. From Amsterdam Centraal, tram 7 towards Slotervaart takes roughly 12 minutes. By bike from Leidseplein it is about 8 minutes via Overtoom.
2. Who this text covers
Readers of the site, people who ask for a quote, and clients of Vocal recording, Live band recording, Mixing, Mastering or Talk and podcast recording fall under this page.
When a production company, label or publisher books time in which other people sing, speak or play, that organisation decides later use of those recordings. In that situation we act as processor. The contract for that role is the data processing agreement. Guests of that organisation should read its own privacy information; our contact page remains available for practical questions about the session itself.
3. The data we collect
Through the form. First and last name, email address, phone number (if you fill it in), requested service, preferred date and a short project description. Required fields are needed so we can answer; without a name and email we do not prepare a quote. FormSubmit forwards the message to our mailbox. That transfer is explained in article 7.
On booking and during the work. Billing details, artist or band name, schedule, email or phone exchanges, and references of a bank transfer. Published rates, such as €92 per hour of Vocal recording or €265 for a talk session of up to two hours, already include 21 % VAT. The invoice shows the client’s name, address and VAT number.
Recordings. Voice, musical performance and, if you send them, existing stems or session files count as personal data when a person can be recognised. We use them to deliver the booked service. Footage shot by your own team in the live room or the booths stays your responsibility.
Technical data. TransIP B.V. (Vondellaan 47, 2332 AA Leiden, the Netherlands) keeps connection logs (IP address, time, page requested, browser) to secure the site. The consent choice lives in local storage under cltc_consent_v1 and holds no name or email.
We do not ask for special-category data. If a session must move for health reasons, it is enough to say you cannot come; a medical certificate is not required.
4. Purposes, legal bases and retention
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Answering an enquiry and drafting a quote | Form and messages | Steps toward a contract that you start (Art. 6(1)(b)) | Three years after the last exchange |
| Booking, running and closing the session | Identity, contact details, project, diary | Carrying out the contract (Art. 6(1)(b)) | Five years after the relationship ends (limitation of contractual claims, Art. 3:307 Dutch Civil Code) |
| Holding working sessions and delivery files | Recordings, stems, mix and master files | Carrying out the contract (Art. 6(1)(b)) | 18 months after the last session day, then deletion, unless you ask in writing for a longer copy |
| Invoices and bookkeeping | Identity, invoice, payment, VAT | A duty in tax and company law (Art. 6(1)(c)) | Seven years (Art. 52 General State Taxes Act and Art. 2:10 Dutch Civil Code) |
| Handling a complaint or dispute | Correspondence and case files | Our interest in defending our position (Art. 6(1)(f)) | Length of the case plus appeal windows |
| Keeping the website safe | Connection logs at the host | Our interest in security and, where logging is required, a legal duty (Art. 6(1)(f) and (c)) | As short as the host needs for security, in practice at most twelve months |
| Remembering your tracker choice | Key cltc_consent_v1 in the browser | Cookie-consent duty in Dutch telecom law (Art. 11.7a Telecommunications Act) | 182 days |
Personal data is not sold or rented. We do not send marketing email. A deposit of 25 % and the cancellation window of 5 days (see the terms and conditions) produce payment and planning records only, not extra profiles. We reply within 3 working days.
Where we rely on a legitimate interest, we check that the aim is real, that the processing is needed and that your interests do not outweigh it. You can ask for a short account of that check and object to it.
5. Voice, image, minors and automation
Your voice and, if someone films you, your image form part of private life. We do not put a clip from your session on the site, a mood photo with a recognisable face, or a name in a portfolio, unless you agree in writing first. Footage shot by your own crew stays with you.
Client recordings are not used to train, test or improve an artificial-intelligence system, and we do not build a voice clone unless the person concerned gives specific written permission.
Anyone under 16 is booked by a legal guardian, who supplies contact and billing details. The site is not a service aimed at children; the form is meant for adults or for that guardian. Preparation notes, such as the vocal session checklist, are information only and do not replace adult supervision in the booth.
6. Who can see your data
Access is limited to the three people on the team, each within their role: Lars Hendriks (studio manager), Sophie Willems (recording) and Daan Prins (mix and master). These recipients may also see data, only for the job they have:
- TransIP B.V., Vondellaan 47, 2332 AA Leiden, the Netherlands, transip.nl — hosting of the site, email and storage, in data centres in the Netherlands;
- FormSubmit (formsubmit.co) — forwarding the enquiry form to our mailbox;
- the bookkeeper we use, under a duty of confidentiality, for invoice lines only;
- the bank that receives our transfers;
- a lawyer or court, if a dispute arises;
- public authorities that ask within the law.
Anyone who processes personal data for us is bound by a contract that meets Article 28 GDPR. Business clients who have third parties recorded should read the data processing agreement.
7. Transfers outside the European Union
Our own files sit with TransIP B.V. inside the Union. FormSubmit is run from the United States, so an enquiry typed into the form travels through that service. We have no indication that this provider holds EU-US Data Privacy Framework certification. The legal ground we use is Article 49(1)(b) GDPR: sending the project is a step you take toward a contract, and the transfer is needed for that step.
To keep the message inside the Union, write to [email protected] or call 020 737 4821 instead. The request is handled in the same way. Session files never go through FormSubmit.
8. Security
Measures we apply: HTTPS only on the site, individual accounts with strong passwords, encrypted workstation disks, the premises at Bilderdijkstraat 112 locked outside sessions, and deletion of working sessions after the archive period. The studio has 4 rooms, including a live room of 38 m² and 2 isolation booths; during a booking no second production listens in.
A breach that risks your rights is reported to the Dutch Data Protection Authority without undue delay and, as a rule, inside 72 hours (Article 33 GDPR). A high risk also means we write to you (Article 34). No path over the internet is completely safe; once data reaches us, the measures above apply.
9. Your rights
You may:
- see your data and information about how it is handled (Art. 15 GDPR);
- have inaccurate or incomplete records corrected (Art. 16);
- ask for deletion once the purpose has ended (Art. 17);
- ask us to restrict processing in the cases the Regulation lists (Art. 18);
- receive the data you supplied, in a structured, commonly used format (Art. 20);
- object where we rely on a legitimate interest (Art. 21);
- withdraw consent, without making earlier lawful processing unlawful (Art. 7(3)).
Send the request to [email protected] or by post to our address. We answer within one month; a complex case may add two months, and we will say so (Art. 12(3)). There is no fee. If identity is reasonably in doubt, we may ask for extra information.
A complaint may go to the Autoriteit Persoonsgegevens, Bezuidenhoutseweg 30, 2594 AV The Hague, autoriteitpersoonsgegevens.nl. Writing to us first usually settles the point faster.
10. Cookies and similar techniques
A cookie is a small file a site places on a device to remember a setting or measure use. Local storage in the browser falls under the same rules.
culticlayer.click sets nothing for analytics, advertising or social platforms. The only stored item is your consent choice in local storage (cltc_consent_v1) for 182 days. The banner groups five buckets — strictly necessary, functional, analytics, marketing and display preferences — and offers three equal actions: accept all, reject all and choose yourself. The four optional buckets are empty for now.
The control that reopens the banner lives on the cookie policy page. Keyboard use of that banner is described in the accessibility statement.
11. Links to other sites
We point to third-party services, including OpenStreetMap for the route to Bilderdijkstraat 112. Those services apply their own privacy rules; we are not responsible for how they work. Help with delivering files, such as stems for a mix, stays on our own pages.
12. Status and changes
This page describes our practice; it does not cut down rights the law already gives you. We may revise it when services or rules change. The new text appears here with its start date and replaces the older one. A material change is emailed to existing clients.
Start date: 1 October 2026. Last check: 1 October 2026. Company details: legal notice. Write to Culticlayer B.V., Bilderdijkstraat 112, 1053 KW Amsterdam — [email protected]. Studio since 2020.