Data processing agreement

1. Parties and definitions

This data processing agreement (“Agreement”) is between:

• Controller: the client instructing Nitentxara to record material involving third parties’ personal data (for example podcast guests, voice talent or band members who are not party to the contract).
• Processor: Nitentxara B.V., Overtoom 551, 1054 LL Amsterdam, KvK 75205469, represented by Maarten van den Berg.

Terms from the General Data Protection Regulation (GDPR) have the same meaning. This Agreement supplements the commercial terms and conditions and service pages such as podcast and voice-over or vocal and rap recording.

2. Subject matter and term

The Processor processes personal data solely to deliver the studio and post-production services described in the order (recording, editing, mixing, mastering, file delivery). The term runs from the first session date until 12 months after the last delivery, unless the Controller requests earlier deletion in writing or a longer archive period is agreed in the contract.

3. Nature of processing and categories

Data subjects: guests, presenters, voice actors, musicians or others whose voice or image is captured.

Data categories: audio and video, names, contact details supplied by the Controller, scheduling information, riders or script excerpts.

Special categories: not intended; the Controller instructs the Processor not to collect sensitive data unless strictly necessary with an appropriate legal basis.

Processing operations: capture, storage, backup copying, technical editing (edit, mix, master), transfer via the agreed delivery channel, deletion after the retention period.

4. Instructions and confidentiality

The Processor follows only documented instructions from the Controller. Default workflow follows the quote and terms and conditions; diverging instructions must be in writing via [email protected]. If the Processor believes an instruction breaches the GDPR, it will say so promptly.

Persons authorised by the Processor are bound by confidentiality or statutory secrecy.

5. Security and sub-processors

The Processor implements appropriate technical and organisational measures, including team-only access, encrypted storage where feasible, physical access control during Mon–Fri 10–20, Sat 10–18, and incident procedures (notify the Controller within 72 hours).

Permitted sub-processors:

• TransIP B.V. — hosting and email in the EU/EEA;
• cloud or backup storage the Processor uses in the EU/EEA for session files, after written notice.

FormSubmit (US) is not used for session or guest data, only for the public contact form on nitentxara.digital. New sub-processors are announced at least 1 business day in advance; the Controller may object with reasons.

6. Data subject rights and audits

The Processor assists the Controller with data subject requests (access, rectification, erasure) within a reasonable time. Requests sent directly to the Processor are forwarded to the Controller unless the Processor must act by law.

The Processor provides information needed to demonstrate Article 28 GDPR compliance. On-site audits only by appointment, at most once per year, during business hours, subject to reasonable confidentiality.

7. Transfers, liability and termination

Transfers outside the EEA occur only on the Controller’s instruction and with appropriate safeguards (standard contractual clauses, adequacy decision or Article 49 GDPR).

When the order ends, the Processor deletes personal data or returns it to the Controller, except where legal retention applies (tax records, 7 years). The Processor can demonstrate deletion was carried out.

Liability follows the terms and conditions; this Agreement does not create guarantees beyond the law.

8. Contact and version

To activate this Agreement: contact, [email protected], 020 244 8916. Mention “data processing agreement” and your company name.

Version 15 October 2026, updated 15 October 2026. See also privacy policy and legal notice.