Data processing agreement

1. Parties and how the agreement is formed

This data processing agreement forms part of the assignment between the business client (the controller) and Oaklandledger B.V., a private limited company (B.V.), Chamber of Commerce 86221245, of Bilderdijkstraat 165, 1053 KV Amsterdam (the processor). The processor's director is Sanne de Vries.

The agreement is formed when the controller accepts a written quote that incorporates these terms, or when the controller expressly refers to this page. A separate signature is not required. On questions about third-party data this text prevails over the terms and conditions. Data the studio collects as a controller in its own right — its own contact form, its own invoice to the client — sit under the privacy policy, not under this document.

2. Definitions

Terms not defined here take their meaning from the GDPR or from the terms and conditions.

3. Subject matter, nature and duration

The processor handles personal data only to deliver the agreed services: recording, mixing, mastering or exporting audio, including scheduling, a technical backup during the archive window, and correspondence about those files. The nature of the processing is technical and organisational: microphones, session files up to 96 kHz, copies on studio equipment, and delivery to the controller.

Processing lasts for the assignment, plus 12 months of archive after the last session or delivery, unless the controller asks in writing for a shorter or longer period. We then delete or return the files, except what the law requires us to keep (the invoice to the controller itself).

4. Categories of data subjects and data

The controller decides which people to send. In practice that means:

• singers, rappers and voice-over talent for Vocal recording;
• players in a line-up of up to 5 for Band recording;
• guests, hosts or interviewees for Podcast & voice-over;
• people whose stems or mixes arrive for Mixing or Mastering.

Categories of data: voice and performance, a name or artist name, e-mail or phone if the controller shares them for scheduling, and technical session metadata. We do not ask for special categories (health, political views, religion). If a conversation still contains them, the controller is responsible for a valid legal basis before asking us to record it.

The controller warrants that it has informed the data subjects and, where needed, obtained their consent or another basis. We do not review lyrics or spoken content to check that basis.

5. Processor obligations

The processor:

• processes only on the controller's documented instructions and under this agreement;
• says so at once if an instruction appears, in its view, to breach the GDPR;
• binds staff involved in the session — including Sanne de Vries and the engineer or scheduler — to confidentiality;
• takes appropriate technical and organisational measures, taking account of the state of the art, cost, nature and risk, within the meaning of Article 32 GDPR;
• does not use the recordings for its own publication, for artificial-intelligence training, or for any commercial purpose other than the assignment;
• helps the controller, so far as the nature of the processing allows, with data-subject requests and with duties under Articles 32 to 36 GDPR.

Access to session files is limited to whoever is mixing, mastering or exporting. We publish no excerpt without the controller's written request.

6. Controller obligations

The controller remains the controller. It provides a valid legal basis, informs data subjects, and sends only the data the session needs. It keeps measures of at least equal strength when it sends files to us or receives them from us.

Help that goes beyond a reasonable reply to a request — for example an on-site audit, an extra export in an unusual format, or an impact assessment — may be charged at a reasonable cost. We state that cost in advance. The controller pays the studio under the quote; the business payment window is 14 days, as the terms and conditions set out. That is not a processing ground, only the commercial setting of the job.

7. Sub-processors

The controller gives a general authorisation for the following sub-processors, to the extent the relevant chain is actually used:

Session files themselves stay in the studio, not with the website host. We announce a new or replacement sub-processor at least thirty days in advance by e-mail. The controller may object in writing within ten working days. If we cannot perform the service without that party, the controller may end that part of the assignment; we refund the unused part of any advance.

With each sub-processor that handles the controller's personal data we put in place a written arrangement with substantially the same duties. We remain liable to the controller for that sub-processor, within the limits of the terms and conditions.

8. Transfers outside the EEA

Hosting at TransIP B.V. stays inside the European Union. FormSubmit processes from the United States. If the controller uses the contact form and includes names or project details of third parties, that content leaves the EEA. That transfer rests on Article 49(1)(b) GDPR (necessary for pre-contractual steps) or, after the assignment is formed, on Article 49(1)(c) (concluding or performing a contract in the data subject's interest), where those grounds apply. If the controller wants to avoid that route, it sends files and names only to [email protected].

We do not have a separate set of standard contractual clauses with FormSubmit. We make no other transfers outside the EEA without a prior written instruction and a valid transfer tool.

9. Data-subject rights

If the processor receives a request from a data subject (access, erasure, correction), we point that person to the controller, unless the law requires us to answer ourselves. We inform the controller without undue delay. The controller remains the contact point.

On the controller's written request we correct, erase, restrict or export the files we still hold, so far as our systems allow and so far as no statutory retention applies. Reasonable extra hours may be charged, stated in advance.

10. Personal-data breach

If the processor becomes aware of a personal-data breach — destruction, loss, alteration, unauthorised disclosure or access, accidental or unlawful — it notifies the controller without undue delay and in any event within 48 hours of becoming aware. That leaves the controller room to inform the Dutch Data Protection Authority within 72 hours if Article 33 GDPR requires it.

The notice includes, so far as known: the nature of the incident, the categories of data subjects and data, the likely consequence, and the measures already taken or proposed. We help the controller further, within what we actually know. We do not notify data subjects ourselves unless the law or an order requires it.

11. Audits

The processor gives the controller the information reasonably needed to check that this document is followed. That starts with a written explanation and, if one exists, a recent statement from the host. If that is demonstrably not enough, the controller may carry out a more targeted check at its own cost: only about its own data, during our opening hours (Tue–Fri 10–20, Sat 10–18), with at least four weeks' notice, and without blocking other people's daily sessions. A clearly serious incident may shorten that notice.

This arrangement does not take away the controller's statutory audit right; it sets a workable order. We hold no ISO or SOC certificate and we do not claim one.

12. Security

Measures we actually apply:

• HTTPS on oaklandledger.click;
• access to session files limited to the people running the job;
• encrypted disks on workstations and backup media;
• a locked building outside sessions, at Bilderdijkstraat 165, 1053 KV Amsterdam;
• separation of jobs: one client's files do not sit in another client's folder;
• deletion after 12 months, unless agreed otherwise in writing;
• no use of recordings for artificial intelligence.

We do not claim an annual penetration test or a certification we do not have. The controller judges whether this set fits the risk of the project — a spoken diary is not the same as a commercial campaign voice.

13. Deletion and return

After the service ends the controller asks in writing, within thirty days, whether it wants the files back or wants them deleted. Without a choice we delete after the 12-month archive window. Copies in backups leave with the rotation of those disks, at the latest twelve months after the deletion request, unless a legal duty to keep them applies.

Invoice data of the controller itself we keep for seven years. That is our own duty as a taxable person, not processing on instruction. Delivery during the job uses the format named in the quote; revisions follow 2 rounds, as the terms and conditions and the service pages describe.

14. Liability, term and governing law

The liability clause in the terms and conditions also covers failures under this data processing agreement. The processor stands behind sub-processors as behind its own acts, within that cap. The same loss is not paid twice. Mandatory GDPR rules remain untouched.

This agreement runs with the assignment and ends when that assignment ends, without prejudice to duties of deletion, confidentiality and assistance that continue by their nature. Dutch law applies. A professional controller brings disputes arising from this agreement before the competent court in Amsterdam, without prejudice to mandatory law.

If a clause is invalid, the others stand. An invalid part is replaced by a valid rule closest to the intended meaning. The Dutch version is legally authoritative; this English text is a translation for information.

15. Closing and contact

Version of 1 October 2026, in force from 1 October 2026. Questions about this agreement: [email protected] or 020 261 4890. Visiting address: Bilderdijkstraat 165, 1053 KV Amsterdam. How to get here: Tram 3 and 12 stop Bilderdijkstraat (2 minutes' walk). Bus 15 stop Bilderdijkstraat. From Amsterdam Centraal about 15 minutes on tram 3 towards Muiderpoortstation.. Other studio details sit on the legal notice and about the studio.