Data processing agreement
This English text is for convenience. The Dutch version is legally authoritative. Verwerkersovereenkomst
In brief
- Applies when you are the client and we process performers or guests on your instructions.
- We process only on your documented instructions and our studio agreements.
- Sub-processors such as TransIP B.V. are contractually bound; US transfers only when needed.
- After the project we delete or return data within 24 months unless agreed otherwise.
1. Parties and definitions
Controller (client): the business customer that decides why and how personal data are used in a recording, mix or master project.
Processor: Peonscale B.V., Van Ostadestraat 184, 1073 TS Amsterdam, trade register 87793067, represented by Maarten de Vries.
Agreement: this document, the terms and conditions, the quote/confirmation and any schedules. A signed schedule prevails over this template if they conflict.
GDPR terms (EU 2016/679) have the meaning given in that regulation.
2. Subject matter and duration
The processor processes personal data only to deliver studio services ordered by the controller: vocal recording, band recording, mixing, mastering, podcast recording or combinations.
Processing runs from acceptance of the order until return or deletion under clause 12, and in any event no longer than needed for delivery plus 24 months archiving unless extended in writing.
3. Nature and purpose
Purposes: technical recording, editing, mix/master, audio export, internal quality checks, and project-related communication and billing.
The processor does not run its own marketing on controller data and does not sell recordings to third parties.
4. Categories of data subjects and data
Data subjects: artists, speakers, guests, session musicians and the controller’s contacts supplied by the controller.
Categories: name, contact details, voice and music recordings, optional photo or video if supplied by the controller, and project metadata (tempo, titles in file names).
No special-category data unless the controller explicitly supplies it with a documented legal basis.
5. Controller instructions
The processor processes data only on documented instructions from the controller, including order confirmation, email and reasonable oral directions during sessions. The processor will inform the controller if an instruction appears incompatible with the GDPR.
Standard rates: services (e.g. €109 per hour vocal recording incl. 21% VAT). B2B payment term: 14 days where applicable.
6. Processor obligations
- Confidentiality for all staff with access.
- Appropriate technical and organisational measures (see clause 8).
- Assistance with data-subject requests where the processor can identify the data.
- Notification of personal data breaches to the controller without undue delay.
- No sub-processor without authorisation under clause 7.
Direct client relationships: privacy policy.
7. Sub-processors
The controller gives general written authorisation for sub-processors required to deliver the service:
- TransIP B.V. — hosting, email, storage within the EU/EEA;
- FormSubmit — only when the controller uses the web form for communication (United States).
The processor informs about sub-processor changes; the controller may object within 14 days with reasons. If no alternative exists, the processor may discontinue the affected service.
8. Transfers outside the EEA
Primary storage is in the Netherlands/Europe. Transfers to the United States via FormSubmit occur only when the controller chooses that channel; appropriate safeguards (e.g. EU standard contractual clauses) apply. Alternative: [email protected] or 020 737 4826.
9. Security
Measures include access restriction, strong authentication where available, encrypted storage on studio systems where supported, physical locking outside Mon–Fri 10–19, Sat 11–17, and procedures for secure deletion of media.
The controller supplies source files via agreed channels (cloud link, drive); see delivering stems in the guides.
10. Personal data breaches
The processor informs the controller without undue delay after discovering a breach affecting the controller’s data, with available details on nature, impact and measures taken. The controller remains responsible for notifying the Dutch DPA and data subjects when required.
11. Assistance and audits
The processor reasonably assists with DPIAs and prior consultation when the controller needs it. Audit rights: at most once per year on business days, with 30 days’ notice, without unduly disrupting studio operations; other clients’ confidential information remains protected.
12. Return, deletion and archive
After completion the processor delivers agreed exports to the controller. Working copies are deleted within 24 months unless the controller requests a written extension or legal retention applies (invoices: 7 years).
On request the processor destroys data and confirms in writing, except what it must keep by law.
13. Liability and governing law
Liability between the parties follows the terms and conditions and Dutch law. This agreement does not replace data subjects’ rights under the GDPR.
Questions or execution: contact — [email protected]. Version 16 October 2026.