Data processing agreement
This English text is for convenience. The Dutch version is legally authoritative. Verwerkersovereenkomst
In brief
- These terms apply when a company has us record other people and stays the controller.
- We handle voice and session files only on instruction, not for our own marketing.
- Sub-processors: TransIP B.V. in the EU, and FormSubmit if you use the web form.
- Working files are wiped 24 months after the last session unless you order otherwise.
- Dutch law; the Dutch text prevails over this English translation.
1. Parties and roles
This agreement covers jobs where the client (the controller) engages Resourceworks B.V. (the processor) to process personal data of other people — for example voice actors, podcast guests or band members the client books. The processor is a private limited company (B.V.), Chamber of Commerce 91428665, VAT NL888778995B01, Columbusplein 26, 1056 TS Amsterdam, represented by Daan van der Berg.
If someone books the studio for their own account, Resourceworks is the controller and the privacy policy applies, not this document. This page is the standard Article 28 GDPR framework. Changes only in writing. Commercial points — rates, a 40% deposit, free cancellation 7 days ahead — sit in the terms and conditions.
2. Subject and duration
The processor records, edits and delivers audio as commissioned: among others Vocal and speech recording, Band and session recording, Podcast recording, Mixing, Mastering and Voice-over and audiovisual. Processing starts at the first file exchange or the first session and ends when the job is done, plus the archive period below, or earlier if the controller so instructs.
Scale, as a picture of the rooms: 3 rooms, live room 28 m², 2 booths, up to 6 musicians on a band date, 32 input channels. That is capacity, not a duty to fill those maxima.
3. Nature of the processing
Data subjects: people the controller sends to the studio or joins remotely, plus the controller's own contacts.
Categories of data: vocal and instrumental recordings; names or artist names if supplied; technical session metadata; a script or cue sheet if sent. No special categories unless the controller includes them and has a basis. We do not ask for those.
Purposes: recording, choosing takes, mixing or mastering in the agreed revision rounds (default 2), exporting and handing files to the controller. No own publication, no training set for automated systems, no resale of contacts.
4. Instructions
The processor acts only on the controller's documented instruction, including as to transfers outside the EEA, unless Union or Dutch law requires otherwise; we say so in advance if the law allows. Instructions arrive by email to [email protected] or in the intake note. Unclear orders pause until we have a written answer.
The controller warrants that the processing has a valid basis (usually a contract with the person or a legitimate interest) and that those people have the information in Articles 13 or 14 GDPR. Resourceworks does not inform those third parties on the controller's behalf unless that is agreed separately.
5. Security
Appropriate technical and organisational measures (Art. 32 GDPR), sized for voice recordings as recognisable data: HTTPS on the site, individual team accounts, encrypted workstations where the software allows, physical lock-up of Columbusplein 26 outside booked sessions, and deletion after the archive. Studio hours: Monday to Friday 10:00–22:00, Saturday 10:00–18:00. Closed on Sunday.
The team is three people. Access to session disks is limited to whoever needs the mix or the schedule. We do not require a certificate from the controller and we do not claim an ISO or similar mark of our own.
6. Sub-processors
The controller accepts the sub-processors below. We announce a new standing sub-processor in advance; an objection within fourteen days leads to a talk about an alternative or to ending the part of the job that needs that party.
| Party | Task | Place |
|---|---|---|
| TransIP B.V. | Hosting of the website, email and digital storage | Vondellaan 47, 2332 AA Leiden, the Netherlands |
| FormSubmit | Forwarding the contact form to our inbox | United States |
FormSubmit appears only if someone uses the web form. Booking by email to [email protected] or by phone on 020 - 707 4829 skips that step. Detail on that transfer: article 7 of the privacy policy.
7. Transfers outside the EEA
By default files stay in the Union, at TransIP B.V.. The exception is FormSubmit (United States) for form contents. We have not established that this service sits under the EU–US Data Privacy Framework. Where a transfer happens because the controller (or its contact) submits the form, it rests on the derogation in Article 49(1)(b) GDPR or on a written instruction from the controller with another valid mechanism.
The processor does not start an extra transfer (for example a cloud outside the EEA) without an instruction.
8. Rights of data subjects
If we receive a request from a data subject (access, erasure, objection), we pass it to the controller and wait for an instruction, unless the law requires us to answer ourselves. The controller remains the contact for those people. We help with technical facts only we hold, such as which takes sit on which disk, within 2 days after the question reaches us.
9. Breaches
The processor notifies the controller of a personal-data breach without undue delay after we learn of it, with the information Article 33(3) GDPR lists so far as we have it. The controller decides whether to notify the Dutch Data Protection Authority or the people concerned, unless we are independently required to notify.
Incident contact: [email protected], marked “data breach” and the project name. Outside opening hours: the same inbox; we read it on the next working day under Mon–Fri 10–22, Sat 10–18.
10. Checks
The processor gives the controller the information needed to verify Article 28 GDPR, and allows audits or inspections that are reasonable, announced, and do not interrupt other clients' sessions. An audit takes place at Columbusplein 26 or remotely, at the controller's cost, at most once every twelve months unless a concrete incident requires more. Confidentiality covers what the auditor sees of third parties.
11. Return and deletion
When the services end, the processor delivers the agreed masters or stems and then deletes the working files, or returns them, as the controller chooses. Without another written order we wipe session disks 24 months after that project's last session. Invoice data we keep for seven years under Dutch Civil Code Art. 2:10; that is a duty of the processor as a taxable person, not processing on the client's behalf.
An export request during the archive window goes to [email protected]. Fees for extra copies or a fresh export are agreed separately; guide prices such as €85 per hour of mix follow-up sit on the service pages.
12. Liability, law and contact
Each party remains liable for damage it causes by failing to meet the GDPR, within the limits of the terms and conditions and mandatory law. This agreement ends when the job and the archive period are over, or earlier on written notice if the other party is in material default and does not cure it.
Governing law: the Netherlands. Competent court: the court with jurisdiction for Amsterdam, unless mandatory law points elsewhere. Effective date of this framework: 1 October 2026. Last reviewed: 1 October 2026.
Resourceworks B.V., Columbusplein 26, 1056 TS Amsterdam, [email protected], 020 - 707 4829. More context: legal notice, FAQ and contact.