Data processing agreement
This English text is for convenience. The Dutch version is legally authoritative.
In brief
- This agreement applies only when we process personal data on a business client’s instructions.
- Data from website visitors who contact us themselves sits in the privacy policy, not here.
- Named sub-processors: TransIP B.V. in the Union and FormSubmit in the United States.
- We delete session files 12 months after the last recording unless you ask otherwise in writing.
1. Parties and place in the file
This data processing agreement belongs with the job between Soapwoodcoreco B.V., Grote Bickersstraat 74, 1013 KS Amsterdam, the Netherlands (the processor) and the business client who places the order (the controller). Chamber of Commerce 80976101, VAT NL803193270B01. Contact at the processor: Maarten van der Berg, [email protected], 020-737 4821.
The agreement forms part of the terms and conditions. If they clash on processing personal data on instruction, this text prevails. There is no separate signature block: by accepting the job, both parties also accept this annex. Effective 1 October 2026. Last updated 1 October 2026. The Dutch version is authoritative; this English page is for information.
2. Definitions
Capitalised words that are not defined here follow the terms and conditions. In addition:
- GDPR
- Regulation (EU) 2016/679, supplemented by the Dutch GDPR Implementation Act.
- Data subject
- The person the personal data relate to, for example a voice-over, musician or podcast guest the controller books.
- Personal data
- Data about an identified or identifiable natural person, including a recognisable voice.
- Processing
- Recording, editing, storing, exporting or deleting that data in order to perform the job.
- Sub-processor
- A third party that processes personal data on our instruction.
- Services
- The studio jobs the controller buys, such as Vocal recording, Podcast recording or Band recording, as described on services.
3. When this agreement applies
We act as processor when the controller asks us to process personal data of third parties in order to deliver the service. Typical cases: a production house books a narrator; a brand records guests for a series; a label sends stems of musicians who are not themselves the contracting party. The controller decides purposes and means. We process only what is needed to do that job.
Data we collect ourselves as a studio — your business contact, the invoice, our own site visitors — sit outside this agreement. Those are in the privacy policy. If you are unsure which hat we wear on a job, ask before the first session via contact.
4. Subject, nature, duration and categories
| Item | Content |
|---|---|
| Subject | Technical performance of audio jobs in Amsterdam |
| Nature | Recording, editing, mixing or mastering; temporary storage; export in the agreed format |
| Purpose | Delivering the agreed service, not our own marketing |
| Categories of data subjects | Performers, guests, staff of the controller who sit in the session |
| Categories of data | Voice, name or artist name, schedule, any script or briefing the controller supplies |
| Special categories | Not requested; do not supply them unless you instruct that in writing and have a legal basis |
| Duration | The term of the job plus the archive period of 12 months, unless you set a shorter or longer period in writing |
Frequency: per booked session, not continuously in the background. Rates (including 21 percent VAT) sit per service, for example Podcast recording from €78 per recording hour or Mixing from €185 per track; the price does not change the roles in this agreement.
5. Instructions from the controller
We process only within this agreement, the job confirmation and your documented instructions. People under our authority do not process otherwise, except where a law forces us. If we think an instruction goes against the GDPR, we say so at once.
You warrant that you have a legal basis to involve us, our team and the named sub-processors, and that performers and guests have been informed. You do not supply special-category data or data of children under 16 without marking that in writing first. Revision rounds (2 in the standard deal) stay inside the same purpose: finishing delivery, not a new processing. How you deliver stems is in stems and file formats.
6. Our obligations
We make sure Maarten van der Berg, Sophie Dekker, Noah Jansen and any hired session help know the files are confidential and that they are bound to secrecy. Access is limited to what the job needs.
Security follows Article 32 GDPR, fitted to studio files: encrypted work disks, unique accounts, strong passwords, two-factor authentication where the service allows it, HTTPS on soapwoodcoreco.click, premises locked outside sessions, separation of client files. We claim no ISO certificate and no third-party penetration test. Measures may grow; a replacement is allowed if it is not weaker.
We do not sell the personal data, we do not use them for our own acquisition and we do not train an AI model on them. Publishing a clip needs your written instruction plus, where needed, the data subject’s permission.
7. Your obligations
You keep appropriate measures on your side (transfer of stems, access to shared folders, briefing of guests). Help that goes beyond what this agreement asks as standard — extra export, an on-site audit, a data-protection impact assessment — can be charged at a reasonable cost, which we name in advance. Invoices to you have the business term of 14 days; that concerns the job, not the retention of the files. On music rights with guests: podcast music rights.
8. Sub-processors
You give general authorisation for the sub-processors below. We stay responsible for their work within the cap in the terms and conditions.
| Name | Role | Place |
|---|---|---|
| TransIP B.V. | Hosting of the site, mailbox and any digital delivery | Simon Carmiggeltstraat 6, 1011 DJ Amsterdam, Netherlands (European Union) |
| FormSubmit | Forwarding the web form if you or your team use that channel | United States |
We announce a new or replacement sub-processor at least thirty days in advance by email. You may object in writing within ten working days. If we cannot deliver the service without that party, you may end that part of the job; we refund any deposit of 30 percent for the cancelled, not-yet-performed part. With each sub-processor we conclude a written arrangement with the same duties in substance. Hosting stays with TransIP B.V. unless we announce otherwise.
9. Transfers outside the EEA
The main processing — recording, editing, storage — happens in Amsterdam, the Netherlands. TransIP B.V. is in the Union. FormSubmit is operated from the United States. To our knowledge there is no published adequacy decision that covers that service. We use that route only if you or your team use the web form. If you do not want that transfer, send briefing and files through another agreed channel to [email protected].
We do not attach standard contractual clauses as an annex, because we have not locked those in as a standard module with FormSubmit. You judge whether that channel fits your risk assessment. A limited transfer to a new country we announce as a change of sub-processor. More context: article 8 of the privacy policy.
10. Data-subject rights
If we receive a request from a data subject (access, erasure, restriction, portability), we forward it to you unless the law forces us to answer ourselves. You remain the contact point. We help as far as the nature of the processing and the files we hold allow. Reasonable extra costs are yours, after we announce them.
Voice rights and likeness on the recording itself you settle with the performer; our privacy policy only describes what we publish ourselves, namely nothing without written permission.
11. Personal-data breaches
If we discover a breach of personal data (destruction, loss, alteration, disclosure or access, accidental or unlawful), we tell you without undue delay and in any case within 48 hours after we become aware. We limit the effects where we can and we give you the facts you need for a notice to the Autoriteit Persoonsgegevens or to data subjects. The legal 72-hour duty toward the supervisor stays with you as controller, unless the law says otherwise.
12. Audit and assistance
We give the information reasonably needed to check that we comply. That starts with a written questionnaire. An on-site check is possible, at your cost, in a scope agreed in advance, during our opening hours (Tue–Fri 10–22, Sat 11–18), with at least four weeks’ notice, unless a clearly serious incident has already happened, and without blocking daily sessions. We help with a data-protection impact assessment as far as our knowledge allows. Both parties cooperate on a request from a supervisory authority. Physical barriers of the building are in the accessibility statement.
13. Term, deletion, law
This agreement runs with the job and ends when the job ends. Personal data on instruction we process only in that period, plus the archive period. Within thirty days after the end you may choose in writing: return or delete. We remove copies on our systems within sixty days after that choice, except what a law keeps longer (for example invoice lines, seven years) and except backup copies, which disappear on rotation, at the latest within twelve months. By default, without an extra request, we delete session files 12 months after the last recording.
Dutch law applies. The court in Amsterdam has jurisdiction, without prejudice to a mandatory venue. Invalid clauses leave the rest standing. Contact: Soapwoodcoreco B.V., Grote Bickersstraat 74, 1013 KS Amsterdam, [email protected]. More about the studio: about us. Questions that are not processing on instruction: FAQ or legal notice. Mastering on instruction: mastering.