Data processing agreement
This English version is for information only. The Dutch version is legally authoritative. Verwerkersovereenkomst
In brief
- This text applies when a business has third parties recorded or post-produced with us.
- You remain the controller; Sipopojexadvisory is the processor for those third parties.
- We keep working sessions for 12 months, then delete or return them.
- The hosting sub-processor is TransIP B.V. in Leiden; FormSubmit sees only our own form.
- Dutch law, establishment Amsterdam; questions via [email protected].
1. Parties and roles
This data processing agreement (Article 28 GDPR) sits with the terms and conditions of Sipopojexadvisory B.V., Ruyschstraat 14, 1091 BR Amsterdam, Chamber of Commerce 98812623, VAT NL876127285B01, represented by Maarten van Dijk (the processor or Sipopojexadvisory).
The other party is the business client that accepts a written order or confirmed quote in which personal data of people other than the client itself are processed (the controller). The payment period between businesses is 14 days, as in the terms. This page is the standard set; a signed annex may tighten a point, not weaken one where the GDPR is mandatory.
The Dutch version is authoritative. English is an informative translation.
2. When this agreement applies
It applies when the client engages us to process personal data of third parties, for example:
- guests or presenters during Podcast recording;
- singers, session musicians or voice-over talent during Vocal recording;
- identifiable voices in files we receive for Mixing or Mastering;
- participants in a rehearsal in the Rehearsal room, if the client has that session recorded.
If an artist or podcaster books for themselves, we are the controller towards that person. Then the privacy policy applies, not this processor role. The studio has 3 rooms and allows at most 5 musicians per rehearsal; the client makes sure those people know a recording is being made. See also session files and rights.
3. Subject, nature, purpose and duration
Subject. Technical recording, editing, mix, master or rehearsal support, plus temporary storage of working sessions until delivery.
Nature and purpose. Sound capture, processing and export in the formats the order confirms. No publication by Sipopojexadvisory, no marketing list, no training of a model.
Duration. From the confirmed booking until deletion or return after the archive period of 12 months after the last session day, or earlier on written request, plus the period the law requires for our own accounts (invoices: seven years).
Prices of the underlying service, for example €88 per podcast hour or €195 per mix track (including 21 % VAT), appear in the quote. They do not change the processor duties.
4. Categories of data subjects and data
| Data subjects | Data |
|---|---|
| Guests, voices and musicians the client brings or supplies | Voice, possibly a name or artist name, monitoring notes, file names |
| The client’s contact people | Name, email, phone, schedule — we process those as controller of the client relationship; see the privacy policy |
| Minors | Only if the client confirms that a legal representative consents; our house rule lower limit is 16 years |
Special categories (health, political views, religion) do not belong in the briefing. If such content is unavoidable in the conversation, the client remains responsible for the legal basis towards those guests. We do not ask for it and we do not index it.
5. Instructions
We process only on the controller’s documented instructions, plus what the GDPR and Dutch law require. If we doubt whether an instruction is lawful, we say so before we carry it out. Publication, sending stems to a third-party label, or an extra revision round above the 2 rounds already included happens only after a clear order. A spoken wish in the control room we confirm by email if it changes the processing.
6. Confidentiality
Access to session files is limited to Maarten van Dijk, Sophie Bakker and Jeroen Visser, each for their own craft. They are bound to confidentiality. We do not play a take for others, put a fragment on a showreel or name a guest on the site without written consent from the controller (and, where needed, from the guest). Working sessions do not sit in a public folder.
7. Security
In line with Article 32 GDPR we apply appropriate technical and organisational measures: HTTPS for the site, individual accounts, strong passwords, encrypted work disks, premises locked outside Mon–Fri 10–19, Sat 11–17, and deletion after the archive period. The live room (28 m²) and the 2 booths are reserved for that booking; we do not let a second production listen in. A residual risk remains on any path over the internet; the client chooses how stems are delivered.
8. Sub-processors
The client gives general written authorisation for the following sub-processors, insofar as they take part in this processing:
- TransIP B.V., Vondellaan 47, 2332 AA Leiden, Nederland, transip.nl — hosting and storage in the Netherlands;
- our bookkeeper — only the client’s invoice lines, not guest audio.
FormSubmit processes messages from our own contact form, in which the client types contact details. That is not sub-processing of guest recordings. If we appoint a new sub-processor that does see guest data, we say so in advance. An objection within fourteen days we treat seriously; without a reasonable alternative the order may stop without extra studio hire for hours not yet run.
9. Transfers outside the EEA
Guest recordings and working sessions we keep at TransIP B.V. in the Union. We do not send those files to FormSubmit or to a US platform unless the client chooses that channel and instructs us in writing. If the client chooses a transfer service outside the EEA, that choice is an instruction of the controller, who must itself provide a valid transfer ground.
10. Assistance
We help the controller with data-subject requests (access, erasure, restriction), with a data-protection impact assessment if the nature of the production requires it, and with contact with the Dutch Data Protection Authority. We reply to the client within 2 working days so that the client can meet the statutory one-month period. Requests from a guest we forward to the client, unless the law requires us to act ourselves.
11. Breaches
If we discover a personal-data breach that falls under this agreement, we warn the controller without undue delay, and in any event within 48 hours after we established the breach. We give the nature of the incident, the categories concerned, the likely consequences and the measures we already took. The client decides whether notification to the Autoriteit Persoonsgegevens or to the guests is needed. Our own duties as a studio remain, see article 8 of the privacy policy.
12. Return, deletion and audits
When the order ends we deliver the agreed files and delete the working sessions after 12 months, or earlier on request, except what we must keep by law (invoice records). On written request we confirm the deletion. The client may, with reasonable notice and at most once every twelve months, ask for a written explanation of our measures or — if that explanation is not enough — an on-site audit during Mon–Fri 10–19, Sat 11–17, without disturbing other people’s sessions. Costs of an external auditor are borne by the client, unless the audit shows a serious shortcoming we should have prevented.
13. Liability, law and closing
Each party remains liable for its own GDPR role. We are not liable for instructions of the client that prove unlawful, nor for publication the client makes itself. Dutch law applies. Disputes about this processor role belong before the competent court in Amsterdam, without prejudice to mandatory law.
Effective date: 1 October 2026. Last check: 1 October 2026. Questions: [email protected] or contact. See also the legal notice and services for the underlying studio offer.