Data processing agreement
This English text is for convenience. The Dutch version is legally authoritative. Verwerkersovereenkomst
In brief
- Applies when you are controller and we record or mix on your project.
- We process only on your instructions and our privacy policy where relevant.
- Sub-processors: TransIP B.V. for hosting; FormSubmit only for website contact, not session audio.
- We can attach this text to your quote or framework contract on request.
1. Parties
Controller (Client): the business customer instructing Nanigolixar B.V. and deciding why personal data of hosts, guests, voice talent or musicians is processed.
Processor: Nanigolixar B.V., Haarlemmerweg 247, 1051 LZ Amsterdam, trade register 83069435, represented by Linde van der Berg.
Agreement: this DPA forms part of the engagement under terms and conditions and the accepted quote for podcast recording, voice-over or band recording.
2. Subject and term
The Processor handles personal data only to deliver agreed studio and post services: scheduling, recording, editing, mix, mastering and file delivery. Processing runs from quote acceptance until 12 months after final delivery unless parties agree otherwise in writing.
3. Data and data subjects
Typical data: names, contact details, voice and music recordings, session notes, billing data the Client holds about performers. Data subjects: podcast guests, narrators, band members or other performers you send to the studio. No special-category data unless you instruct us in writing and we agree.
4. Instructions and confidentiality
The Processor follows documented Client instructions. New instructions outside the quote must be in writing. Staff are bound by confidentiality. Practical rights topics: session rights guide.
5. Security
Appropriate measures include HTTPS, access control, encryption where feasible, studio access by appointment Mon–Fri 09–23, Sat 10–20, Sun closed. The Processor notifies the Client without undue delay of incidents so you can notify authorities if needed.
6. Sub-processors
Approved sub-processors for IT and communication:
- TransIP B.V. — hosting and email in the Netherlands;
- FormSubmit — website contact forms only, not multitrack audio.
New sub-processors are announced at least thirty days ahead; the Client may object with reasons. Sub-processors sign Article 28 terms.
7. Transfers
Session files stay in the EEA on TransIP B.V. systems or local studio storage. FormSubmit may route contact forms via the US; that path does not carry raw session audio. Transfers outside the EEA only with your written instruction or appropriate safeguards.
8. Data subject requests
Forward requests to us at [email protected]; we assist within a reasonable time to correct, export or delete when your instruction requires. Primary response duty stays with you as controller.
9. Audits
On reasonable request we provide compliance information. On-site audits at most once per year during business hours by appointment; Client bears cost unless we are at fault.
10. Return and deletion
After the project we delete or return personal data per your choice within 12 months, except legal retention (tax records seven years). Backups are overwritten per retention in privacy policy retention section.
11. Liability and precedence
Liability follows the main contract and Dutch law. If this DPA conflicts with terms and conditions or the quote on personal data, this DPA prevails. Consumers are outside this DPA; see privacy policy.
Linde van der Berg, [email protected], 020 785 42 16. Version 15 October 2026.