Data processing agreement
This English text is for convenience only. The Dutch version is legally authoritative. Verwerkersovereenkomst
In brief
- This agreement applies only when we process personal data on the instructions of a business client.
- Data of website visitors who write to us themselves sit in the privacy policy, not here.
- Named subprocessors: TransIP B.V. in the Union and FormSubmit in the United States.
- We delete session files 24 months after the last recording unless you ask otherwise in writing.
1. Parties and place in the file
This data processing agreement belongs to the job between Magyaranzo B.V., Maasstraat 47, 1078 EP Amsterdam, the Netherlands (the processor) and the business client who commissions the work (the controller). Chamber of Commerce 77962751, VAT ID NL875024166B01. Contact at the processor: Noor Bakker, [email protected], 020 737 0418.
The agreement forms part of the terms and conditions. If there is a conflict about processing personal data on instructions, this text prevails over those terms. There is no separate signature block: by accepting the job, both parties accept this annex as well. Effective date 1 October 2026. The Dutch wording is authoritative; this English page is a translation for information.
2. Definitions
Words that are not defined here follow the terms and conditions. In addition:
- GDPR
- Regulation (EU) 2016/679, supplemented by the Dutch GDPR Implementation Act.
- Data subject
- The person the personal data relate to, for example a voice-over, musician or podcast guest whom the controller books.
- Personal data
- Data about an identified or identifiable natural person, including a recognisable voice.
- Processing
- Recording, editing, storing, exporting or deleting those data in order to perform the job.
- Sub-processor
- A third party that processes personal data on our instructions.
- Services
- The studio jobs the controller buys, such as Vocal and speech recording, Podcast recording or Band and live recording, as described on services.
3. When this agreement applies
We act as a processor when the controller asks us to process personal data of third parties in order to deliver the service. Typical cases: a production house books a narrator; a brand records guests for a series; a label sends stems of musicians who are not themselves the contracting party. The controller decides purposes and means. We process only what is needed to do that job.
Data we collect ourselves as a studio — your business contact, the invoice, our own site visitors — sit outside this agreement. Those are in the privacy policy. If you are unsure which role we have on a job, ask before the first session via contact.
4. Subject matter, nature, duration and categories
| Item | Content |
|---|---|
| Subject matter | Technical delivery of audio jobs in Amsterdam |
| Nature | Recording, editing, mixing or mastering; temporary storage; export in the agreed format |
| Purpose | Delivering the agreed service, not our own marketing |
| Categories of data subjects | Performers, guests, staff of the controller who sit in the session |
| Categories of data | Voice, name or artist name, schedule, and any script or brief the controller supplies |
| Special categories | Not requested; do not send them unless you instruct us in writing and you have a legal basis |
| Duration | The life of the job plus the archive period of 24 months, unless you set a shorter or longer period in writing |
Frequency: per booked session, not continuously in the background. Rates (including 21 percent VAT) sit on each service, for example Podcast recording from €105 per recording hour or Mixing from €185 per song; the price does not change the roles in this agreement. In the live room we work with at most 6 musicians at once.
5. Instructions from the controller
We process only within this agreement, the booking confirmation and your documented instructions. People under our authority do not process otherwise, except where a law forces us to. If we think an instruction conflicts with the GDPR, we say so at once.
You warrant that you have a legal basis to involve us, our team and the named subprocessors, and that performers and guests have been informed. You do not supply special-category data or data of children under 16 without marking that in writing beforehand. Revision rounds (2 in the standard booking) stay inside the same purpose: finishing delivery, not a new processing activity.
6. Our obligations
We make sure Noor Bakker, Tom Visser, Mila de Groot and any hired session help know that the files are confidential and that they are bound to secrecy. Access is limited to what the job needs.
Security follows Article 32 GDPR, scaled to studio files: encrypted work disks, named accounts, long unique passwords and a second login factor whenever the tool offers it, HTTPS on magyaranzo.click, premises locked outside sessions, separation of client folders. We do not claim an ISO certificate or a third-party penetration test. Measures may grow; a replacement is allowed if it is not weaker.
We do not sell the personal data, we do not use them for our own sales work and we do not train an AI model on them. Publishing a clip needs your written instruction and, where needed, the data subject's permission.
7. Your obligations
You keep appropriate measures on your side (transfer of stems, access to shared folders, briefing of guests). Help that goes beyond what this agreement asks as standard — an extra export, an on-site audit, a data-protection impact assessment — may be charged at a reasonable cost, which we name in advance. Invoices to you use the business term of 14 days; that concerns the job, not the retention of the files. A deposit of 30 percent follows the terms and conditions.
8. Sub-processors
You give general authorisation for the subprocessors below. We remain responsible for their work within the cap in the terms and conditions.
| Name | Role | Location |
|---|---|---|
| TransIP B.V. | Hosting of the site, mailbox and any digital delivery | Vondellaan 47, 2332 AA Leiden, Nederland (European Union) |
| FormSubmit | Forwarding the web form if you or your team use that channel | United States |
We announce a new or replacement subprocessor at least thirty days in advance by email. You may object in writing within ten working days. If we cannot deliver the service without that party, you may end that part of the job; any deposit of 30 percent for the cancelled, unused part we refund. With each subprocessor we have a written arrangement with essentially the same duties. Hosting stays with TransIP B.V. unless we announce otherwise.
9. Transfers outside the EEA
The main processing — recording, editing, storage — happens in Amsterdam, the Netherlands. TransIP B.V. is in the Union. FormSubmit operates from the United States. As far as we know, there is no published adequacy decision that covers that service. We use that path only if you or your team use the web form. If you do not want that transfer, send the brief and the files on another agreed channel to [email protected].
We do not attach Irish or UK standard contractual clauses as a schedule, because we have not locked those in as a standard module with FormSubmit. You decide whether that channel fits your risk assessment. A restricted transfer to a new country we announce as a subprocessor change.
10. Data-subject rights
If we receive a request from a data subject (access, erasure, restriction, portability), we forward it to you unless the law forces us to answer ourselves. You remain the point of contact. We assist insofar as the nature of the processing and the files we hold allow. Reasonable extra costs are yours, after we have said so.
Voice and image rights in the recording itself you settle with the performer; our privacy policy only describes what we ourselves publish, which is nothing without written permission. Practical export notes are in the stems guide.
11. Personal-data breaches
If we become aware of a personal-data breach (destruction, loss, alteration, disclosure or access, accidental or unlawful), we notify you without undue delay and in any event within 48 hours of becoming aware. We limit the effects where we can and we give you the facts you need for a notice to the Autoriteit Persoonsgegevens or to data subjects. The statutory 72-hour duty toward the supervisory authority stays with you as controller, unless the law says otherwise.
12. Audit and cooperation
We provide the information reasonably needed to check that we comply. That starts with a written questionnaire. An on-site review is possible, at your cost, in a scope agreed in advance, during our opening hours (Mon–Fri 10–20, Sat 11–17), with at least four weeks' notice unless a serious incident is already clear, and without blocking daily sessions. We assist with a data-protection impact assessment insofar as our knowledge allows. Both parties cooperate with a supervisory authority on request.
13. Liability
The liability cap in the terms and conditions also covers breaches of this agreement. For subprocessors we stand as if we had done their work ourselves, within that same cap. The same loss is not recovered twice. Mandatory consumer law stays out of scope: this agreement is meant for business jobs.
14. Term, deletion, governing law
This agreement runs with the job and ends when the job ends. Personal data on instructions we process only in that period, plus the archive period. Within thirty days after the end you may choose in writing: return or delete. We remove copies on our systems within sixty days of that choice, except what a law requires us to keep longer (for example invoice lines, seven years) and except backup copies, which leave on rotation, at the latest within twelve months. By default, without an extra request, we delete session files 24 months after the last recording.
Dutch law applies. The courts of Amsterdam have jurisdiction, without prejudice to a mandatory forum. Invalid clauses leave the rest in force. Contact: Magyaranzo B.V., Maasstraat 47, 1078 EP Amsterdam, [email protected]. More about the studio: about us. Questions that are not processing on instructions: FAQ or legal notice.