Data processing agreement
This English text is for information. The Dutch version is legally authoritative. Verwerkersovereenkomst
In brief
- For clients who are controllers when we record their guests or talent.
- Processing only on your instructions; sub-processors include TransIP B.V. and FormSubmit for web mail.
- Archive 24 months, then delete unless extended — see terms.
- Questions: [email protected] — end-client privacy: privacy policy.
1. Parties
This agreement ("Agreement") is between:
- Controller ("Client"): the business customer supplying personal data about participants, guests, hosts or musicians for a job at Nelkenshift.
- Processor: Nelkenshift B.V., Govert Flinckstraat 142, 1073 CG Amsterdam, KvK 69985906, represented by Sven de Vries.
The Client determines purposes and means for those individuals; the Processor delivers studio services (vocal recording, band recording, mixing, mastering, podcast recording) and processes data only on instruction.
2. Definitions and order of precedence
GDPR terms have the same meaning. Commercial terms are in the terms and conditions and quote. If they conflict, this Agreement prevails for processing of individuals designated by the Client.
The Client warrants a legal basis (consent, employment, legitimate interest where permitted) and informs data subjects when required.
3. Subject matter and term
Processing covers identity, contact, voice recordings, optional image supplied by the Client, and technical session metadata. The term starts at quote acceptance and ends after return or deletion per article 9 of the terms (24 months archive unless extended in writing).
4. Client instructions
The Processor follows documented instructions: quote, email agreements, studio schedule and this Agreement. Instructions incompatible with the GDPR are refused with reasons.
Default: record as scheduled, store on secured systems, deliver agreed files, no publication on nelkenshift.click without written approval.
5. Confidentiality
Anyone processing data under the Processor’s authority is bound by confidentiality or statutory secrecy. Access is need-to-know within the team on about us.
6. Security measures
Article 32 GDPR: HTTPS, access control, strong authentication where available, physical measures in De Pijp, deletion after 24 months unless extension is requested in time. Up to 6 musicians at once in the live room limits unnecessary exposure.
After delivery to the Client’s systems, security there is the Client’s responsibility.
7. Sub-processors
The Client authorises:
- TransIP B.V., Vondellaan 47, 2332 AA Leiden, the Netherlands — hosting, email, backups;
- FormSubmit (United States) — only when individuals use the website form, not for raw multitrack archive.
We sign Article 28 terms with sub-processors. Changes are announced in advance; reasoned objection within 14 days is possible. Without an alternative, that route cannot be offered.
8. Data subject rights
Requests received by us are forwarded without undue delay to the Client. We help respond as far as technically feasible; excessive requests may be charged reasonably.
End clients read our privacy policy; for individuals supplied by the Client, the Client’s policy applies first.
9. Personal data breaches
The Processor notifies the Client without undue delay after discovering a breach under our responsibility, with information to support notification to the Dutch DPA and data subjects. We cooperate on investigation and mitigation.
10. DPIA and audit
We support a data protection impact assessment or prior consultation when our role requires it.
The Client may once per calendar year, by appointment, request an audit or independent report limited to processing under this Agreement, without unreasonably disrupting sessions and under confidentiality.
11. Transfers
Session files remain primarily in the EEA via TransIP B.V.. FormSubmit may trigger US processing for website enquiries; the Client acknowledges that for contact via nelkenshift.click.
12. Return and deletion
Final deliverables go to the Client. Raw data is erased after 24 months unless extension is agreed in writing. Earlier deletion on request, except where tax retention applies (invoices: 14 days payment term for business clients).
13. Liability and closing
Liability follows the terms and conditions unless mandatory law says otherwise. This Agreement may be accepted electronically by booking with reference to nelkenshift.click/data-processing-agreement.
Processor contact: [email protected] — legal notice.