Data processing agreement
This English version is for information only. The Dutch version is the legally authoritative text. Verwerkersovereenkomst
In brief
- You are controller for your guests' data; we process only on your instructions.
- Typical for podcast recording or corporate voice-over with several participants.
- Session files kept up to 24 months, then deleted unless agreed otherwise.
- Accepted via your quote or written confirmation together with terms and conditions.
1. Parties and definitions
This data processing agreement ("Agreement") is between:
- Controller: the business client ("Client") placing an order with Nikausync B.V., Grote Bickersstraat 74, 1013 KS Amsterdam, trade register 93890356;
- Processor: Nikausync B.V. ("Nikausync"), performing recording and related services in Amsterdam.
GDPR terms have the same meaning. "Personal data" and "Processing" include recordings and metadata of participants where they identify natural persons.
The Dutch verwerkersovereenkomst on this site is authoritative; this English text is for information.
2. Subject matter and duration
Nikausync processes personal data only to deliver the service in the accepted quote: for example podcast and dialogue recording, vocal recording for a label, or mixing of stems that include third-party voices.
The Agreement runs from quote acceptance until return or deletion of data after retention, and in any case while Nikausync must keep Client invoicing data under law.
3. Client instructions
Nikausync processes data only on documented instructions from Client, including this Agreement, the quote, terms and conditions and reasonable oral directions during the session (for example which takes to keep). Instructions incompatible with the GDPR will be refused.
Client ensures a valid legal basis for participants (information, consent, employment or contract). Practical music-rights context: podcast music rights guide.
4. Categories of data subjects and data
| Category | Examples |
|---|---|
| Data subjects | Podcast guests, voice-over artists, band members or presenters Client brings |
| Data | Name, contact (if collected by Client), audio recordings, session notes, timestamps, optional photo or video if Client captures it |
| Special categories | None — Client does not supply health or criminal data for processing by Nikausync |
5. Processor obligations of Nikausync
- Confidentiality: only staff with need-to-know access.
- No own marketing using recordings or names of participants without Client and data subject consent.
- No use of recordings to train or develop artificial intelligence.
- Assistance with data subject requests: we forward within 2 business days unless Client responds directly.
- Impact assessments: we flag processing likely to pose high risk to Client.
6. Sub-processors
Client gives general written authorisation for the following sub-processors, provided they are bound by Article 28 GDPR terms:
- TransIP B.V. — hosting, email, storage in the EEA where possible;
- FormSubmit — only when Client uses the website form for project mail (US transfer, see privacy policy);
- accountant and bank — limited to Client billing data, not raw recordings.
We notify changes at least 14 days ahead; Client may object with reasons.
7. Transfers outside the EEA
We primarily work within the EEA. Transfers to the United States may occur via FormSubmit or Client email providers. We apply standard contractual clauses or other appropriate safeguards and inform Client on request of the current country per sub-processor.
8. Security
We implement appropriate technical and organisational measures: HTTPS, access control, encrypted storage where feasible, physical studio lock-up, backups with restricted access. Client is responsible for security of materials they bring (laptops, drives).
9. Personal data breaches
If we discover a breach affecting personal data we process, we notify Client without undue delay with information needed for reports to the authority and data subjects where required. Client remains controller for notifications unless law says otherwise.
10. Return and deletion
After the service we deliver agreed files to Client. Working and session files are deleted no later than 24 months after the last session unless the quote states a longer period or legal retention applies. On request we delete earlier except what we must keep for administration.
11. Audits and information
Client may once per calendar year, by appointment, ask reasonable questions or receive a compliance checklist. Unreasonable frequent or commercial audits without concrete cause may be refused. Costs of a Client-initiated audit are for Client unless non-compliance by Nikausync is proven.
12. Liability and governing law
Liability between the parties follows terms and conditions where not overridden by mandatory law. This Agreement prevails over other documents for processing of third-party personal data by Nikausync.
Dutch law applies. Disputes go to the competent court in the Amsterdam district, without prejudice to mandatory consumer rules if Client is a consumer.
Questions: [email protected] — contact page. General privacy: privacy policy.