Data processing agreement
English pages summarise the Dutch originals; where texts differ, the nl version prevails. Verwerkersovereenkomst
In brief
- Applies when you are controller and we process personal data on your instructions.
- Typical for podcast production, brand voice-over or batch mastering for your label.
- We process only as instructed and under our studio agreements.
- Request a signed copy via contact before the first processor engagement.
1. Parties and definitions
This agreement is between you as controller (client) and Mushrumpmirami B.V., Weesperzijde 96, 1091 DS Amsterdam, KvK 66412539, as processor, when we record, edit, mix or master audio that includes personal data of third parties (speakers, artists, guests).
GDPR terms have the same meaning as in Regulation (EU) 2016/679. Processing, personal data and sub-processor are used accordingly.
2. Subject matter and term
The processor processes personal data only to deliver studio services described in the order or terms and conditions, such as Podcast and spoken audio, Vocal recording, Mixing or Mastering. The term runs from the start of the order until return or deletion of data afterwards, with a technical archive period of up to 6 months unless agreed otherwise in writing.
3. Nature of processing and categories
Type of processing: recording, editing, mixing, mastering, exporting, temporary storage and transfer to the controller via agreed channels.
Categories of data subjects: speakers, presenters, musicians or other performers supplied by the controller.
Categories of data: voice, performance, name and contact details for scheduling, any photo or video the controller supplies, and metadata in session files.
The processor does not process special-category data unless the controller explicitly instructs this and demonstrates a valid legal basis.
4. Instructions and compliance
The processor follows only documented instructions from the controller and legal obligations. Instructions may be given by email, project brief or session notes. If an instruction appears unlawful under the GDPR, the processor will inform the controller without undue delay.
The processor notifies the controller of changes that may affect processing, including updates to the privacy policy or security measures.
5. Confidentiality and staff
Persons authorised by the processor to access personal data are bound by confidentiality or statutory secrecy. Access is limited to what the order requires; team roles are described on about.
6. Security
The processor implements appropriate technical and organisational measures under Article 32 GDPR, including physical access control to the studio, restricted accounts, encryption where reasonable, and deletion of working files after the archive period. Details align with our security section.
7. Sub-processors
The controller gives general written authorisation for sub-processors required for hosting and form forwarding:
- TransIP B.V. — hosting and storage in the Netherlands/EU;
- FormSubmit — contact message forwarding (US); the controller may use direct email to avoid that route.
The processor informs the controller of intended changes to sub-processors with an opportunity to object. Article 28 terms are in place with each sub-processor.
8. Data subject rights
The processor assists the controller, within a reasonable time and at the controller's cost if disproportionate, with requests from data subjects (access, rectification, erasure, restriction, objection, portability). Requests sent directly to the processor are forwarded to the controller unless the law requires the processor to respond.
9. Personal data breaches
The processor reports a personal data breach concerning the controller's data without undue delay after becoming aware, with information the controller needs for notification to the supervisory authority and data subjects. The processor documents each breach.
10. Audits and information
The controller may request reasonable information on compliance. On-site audits are limited to business days with at least 1 business days' notice and must not disrupt live sessions. The processor may provide a recent questionnaire or statement instead of repeated physical audits.
11. Return and deletion
After the order ends, the processor delivers personal data and copies to the controller in the agreed format and deletes remaining copies within 6 months unless retention is legally required. Earlier deletion is available on the controller's request.
12. Liability and governing law
Liability between the parties follows the terms and conditions and Dutch law. This schedule forms part of the contract once both parties agree in writing (email is sufficient for the first order when you explicitly accept this DPA).
Questions or signature: contact, [email protected], 020 737 1846. Business rates: services; B2B payment term 14 days where applicable.