Data processing agreement
In short
- Applies when you are controller and we record guests or speakers for you.
- We process only on your instructions and our privacy policy where relevant.
- Sub-processors: hosting and form relay; list on request.
- After the job: delete or return within 12 months unless agreed otherwise.
1. Parties and roles
This data processing agreement («Agreement») forms part of the contract between:
- Controller («Client»): the business customer who instructs work involving third parties’ personal data.
- Processor: Micracoriva B.V., Goudsbloemstraat 73, 1015 JM Amsterdam, KvK 91864893, represented by Maarten van der Berg.
Client determines purposes and means for those personal data. Micracoriva performs recording and related technical work as processor. For Client’s own contact persons we remain controller; see privacy policy.
2. Definitions
Terms from the General Data Protection Regulation (GDPR) keep their legal meaning. «Personal data», «data subject», «processing», «sub-processor» and «personal data breach» are used accordingly.
«Service»: studio work such as podcast recording, vocal recording or other sessions under terms and conditions.
3. Subject matter and duration
Processor processes personal data only to deliver the agreed Service in writing (record, edit, deliver audio files). Processing runs from quote acceptance until return or deletion afterwards, with default storage of up to 12 months after the last session unless Client requests another period or return in writing.
4. Nature of processing
Typical activities: capturing voice and conversation, storing on secured studio workstations and backup media, exporting to Client in agreed formats, and limited internal access by our engineers as needed; see about us for the team.
We do not use those recordings for marketing, publication or AI model training without separate written consent from Client and data subjects.
5. Categories of data and subjects
| Category | Examples |
|---|---|
| Identity and contact | Name, role, email or phone of guests, presenters or musicians Client invites |
| Audio content | Voice, performance, conversation |
| Technical | Session metadata, file names, timestamps |
Data subjects: speakers, guests, artists and other participants Client brings to the studio. Client informs them and provides a lawful basis (for example consent or legitimate interest).
6. Instructions
Processor follows only documented instructions from Client, including the quote, email agreements and this Agreement. If an instruction appears incompatible with the GDPR, we notify Client before acting.
Client is responsible for scripts, questionnaires and releases for guests. For stem delivery or loudness: streaming loudness guide.
7. Processor obligations
- Confidentiality: team members are bound to secrecy.
- Security: appropriate technical and organisational measures, including access control, HTTPS on the website, physical access control to the studio.
- Sub-processors only with Client consent or general authorisation with prior notice; see next section.
- Assistance with data subject requests and DPIAs where reasonably possible.
- Deletion or return after completion, except legal retention duties.
8. Sub-processors
Client gives general written authorisation for sub-processors that may be needed for communication and storage:
- TransIP B.V. — hosting and email (EU/EEA);
- FormSubmit — contact form relay (US, with safeguards as in privacy policy).
We inform Client of intended changes at least fourteen days ahead; Client may object on reasonable grounds. List and contracts available on request via [email protected].
9. Transfers
Primary session storage stays in our Amsterdam studio within the EEA. Transfers outside the EEA occur only when Client asks us to upload to a non-EEA service, or via FormSubmit for form testing; then only with appropriate safeguards or Client’s explicit instruction.
10. Personal data breaches
Processor notifies Client without undue delay after becoming aware of a breach, with at least available facts, categories of data, estimated number of subjects and measures taken. Client decides on notification to the supervisory authority and data subjects.
11. Audits
Client may once per calendar year, on reasonable notice and without disrupting the studio, request compliance information or an audit by an independent auditor under confidentiality. Costs are borne by Client unless the audit shows substantial failures attributable to Processor.
12. Liability and precedence
Where terms and conditions govern liability between the parties, those provisions apply. If documents conflict, this Agreement prevails for processing third parties’ personal data under GDPR Article 28.
We can send a countersigned copy by email on request. Contact: [email protected], contact page.