Data processing agreement

1. Parties and definitions

This data processing agreement ("DPA") forms part of the commercial relationship between:

• Controller: the business client that supplies personal data or arranges recordings;
• Processor: Mormonyra B.V., Haarlemmerweg 178, 1051 CV Amsterdam, trade register 68310200, VAT NL877581083B01, represented by Maarten van Dijk.

GDPR terms have the same meaning. Where this DPA is silent compared with our privacy policy or terms and conditions, processor-specific terms here prevail.

2. Subject matter and term

Processor processes personal data only to deliver services the Controller orders: including live ensemble recording, mix production, mastering and podcast recording, and storing session files for up to 24 months unless agreed otherwise in writing.

The term runs alongside the main contract and ends on completion or termination, except processing required by law (e.g. invoicing).

3. Nature and categories of data

Typical data: names, contact details of artists, guests or hosts, audio and video recordings, track metadata, scheduling and billing references. No special-category data unless the Controller supplies it and documents necessity.

Processor does not use data for its own marketing or profiling.

4. Instructions and confidentiality

Processor processes only on documented instructions from the Controller, including written changes by email. Instructions must not breach the GDPR.

Staff with access are bound by confidentiality. Access is limited to what the job requires (engineers and studio management).

5. Security

Processor implements appropriate technical and organisational measures: physical access control in the studio, locked storage, HTTPS for the website, restricted backups and deletion of session files after the agreed period.

Hosting details: TransIP B.V.; see our privacy policy.

6. Sub-processors

The Controller gives general written authorisation for sub-processors needed for hosting, email, form forwarding (FormSubmit) or accounting. Processor informs about changes and allows objection within a reasonable time.

Sub-processors are contractually bound to at least the same obligations as in this DPA.

7. Data subject rights

Processor assists the Controller, within reasonable limits, with data subject requests (access, rectification, erasure, restriction, portability). Requests sent directly to us are forwarded promptly to the Controller unless law requires us to respond.

8. Personal data breaches

Processor notifies the Controller without undue delay after becoming aware of a breach relating to personal data under this DPA, with information needed for notification to the supervisory authority and data subjects.

9. Audits and information

On request, Processor provides reasonable information about compliance with Art. 28 GDPR. On-site audits at our premises are available by appointment, at most once per calendar year unless a regulator requires more, without unnecessarily disrupting studio work.

10. Transfers outside the EEA

Processing is mainly in the Netherlands/EU. FormSubmit may transfer contact form content to the United States when data subjects use the website form; project file exchange uses EU hosting where possible. Further transfers only with appropriate safeguards or Controller approval.

11. End of processing

After the service ends, Processor deletes or returns personal data and copies, except what must be kept by law (tax records up to 7 years). Recordings are deleted after 24 months or earlier on written Controller request, unless litigation requires retention.

12. Liability and governing law

Liability between the parties follows terms and conditions where applicable to B2B work. This DPA is governed by Dutch law. Disputes go to the competent courts in the Netherlands unless mandatory consumer law applies differently (typically not for pure B2B processing).

Contact contact to request a signed copy or project-specific schedule.