Data processing agreement

1. Parties and roles

This data processing agreement (the Agreement) attaches to every job in which a business client (the Controller) instructs Okiatech B.V. (the Processor) to process personal data of third parties. The Processor is a private limited company (B.V.) at Eerste Helmersstraat 42, 1054 DG Amsterdam, the Netherlands, Chamber of Commerce 64390335, VAT NL832342774B01, director Maarten van der Berg.

If you book as an artist or band for your own session, Okiatech is itself the controller. The privacy policy applies, not this Agreement. This text is for publishers, labels, agencies and production companies that buy, for example, a podcast or audiobook session or vocal recording for talent they have contracted themselves.

The Agreement implements Article 28 GDPR. Commercial terms — rate, 35 % deposit, 2 revision rounds, payment within 14 days — sit in the quote and the terms and conditions. On data protection this Agreement prevails; on price or scheduling the quote and the terms prevail.

2. Subject matter and duration

The Processor records, edits, mixes or masters audio and keeps the related session folders, solely on the Controller's instructions. Processing starts on the date of the accepted quote and ends when the Processor has deleted or returned the files under article 11, or earlier if the job is stopped in writing.

The Agreement remains in force for as long as the Processor holds personal data for the Controller, including the 9-month archive. It ends by itself once no personal data of the Controller remains with the Processor.

3. Nature, purposes and instructions

The nature of the processing is technical recording, editing, mix and mastering in the 3 rooms of the studio in Amsterdam, plus file exchange with the Controller. The purpose is limited to delivering the agreed audio. The Processor does not use the recordings for its own publication, portfolio, model training or marketing.

The Processor processes only on documented instructions from the Controller, including instructions on transfers, unless Union or Dutch law requires another act. In that last case the Processor says so in advance, unless the law forbids that notice. An instruction that the Processor considers contrary to the GDPR is refused in writing.

Instructions travel through the accepted quote, e-mail to [email protected], or a written addendum. Spoken directions during a session count as an instruction once the engineer writes them into the session note and the Controller does not contradict them in writing the same day.

4. Categories of data subjects and data

The Processor does not set out to process special categories (health, politics, religion, sexual orientation). If those appear in a recording because the manuscript or the conversation includes them, they remain in the audio file. The Controller is responsible for a legal basis toward those people. The Processor does not send an extra health or background questionnaire.

5. Obligations of the processor

The Processor:

• ensures that anyone with access — the three team members, including Maarten van der Berg — is bound to confidentiality;
• applies the security measures in article 7;
• does not add a further sub-processor outside article 6;
• helps the Controller with data-subject requests, within the reasonable limits of a studio without a 24-hour desk;
• helps with a data-protection impact assessment if the Controller runs one and needs studio facts;
• lets the Controller check that this Agreement is being kept, under article 12;
• deletes or returns data under article 11.

The Controller warrants that the instruction is lawful, that data subjects have been informed, and that a legal basis exists. The Processor is not the Controller's privacy lawyer.

6. Sub-processors

The Controller hereby gives general written authorisation for the following sub-processors:

• TransIP B.V., Vondellaan 47, 2332 AA Leiden, the Netherlands — hosting of okiatech.click and the technical environment that belongs with it; www.transip.eu;
• FormSubmit (formsubmit.co) — only if the Controller or a contact uses the contact form. That transfer to the United States is described in article 7 of the privacy policy. You can avoid it via [email protected] or 020 737 0891.

The Processor will announce a new sub-processor at least fourteen days in advance by e-mail. The Controller may object in writing within that period. Without a serious data-protection reason, that objection is not a unilateral ground to cancel the studio job; the parties then look for another technical route. The Processor imposes on sub-processors the same duties as in this Agreement, so far as those duties fit their service.

The Processor's house accountant and bank process the studio's own invoice data. That is not sub-processing of the Controller's talent files.

7. Security

Taking account of the state of the art, the cost of implementation and the nature of studio audio, the Processor applies among other things:

• HTTPS on okiatech.click;
• individual team accounts, no shared passwords;
• encrypted working disks and backup media;
• a locked building at Eerste Helmersstraat 42 outside sessions;
• file delivery through a channel the Controller agrees or a protected download, not a public folder;
• deletion after the archive period.

The Processor does not promise an impossible zero risk. A recording in a live room with up to 5 people is audible to anyone standing in that room. The Controller makes sure guests know that.

8. Transfers outside the EEA

The Processor keeps session files in the Netherlands. A transfer outside the EEA happens only on the Controller's instructions (for example delivery to a US distributor) or through FormSubmit if someone uses the site form. Without a valid Chapter V GDPR mechanism — an adequacy decision, standard contractual clauses or an Article 49 derogation — the Processor will not start that transfer on its own.

9. Data-subject rights

If the Processor receives a request for access, erasure or another right from someone who appears on a recording, the Processor forwards that request to the Controller within 2 working days and waits for instructions, unless the law requires immediate action. The Processor does not answer data subjects itself about the purpose of the recording.

Technical help — a copy of the takes, a list of file names, deletion of a guest track — is billed at the hourly rate in the current job, or otherwise at €89 per studio hour, unless it corrects a mistake by the Processor. That hourly rate includes 21 % VAT.

10. Personal-data breaches

If the Processor finds a breach involving the Controller's personal data, the Processor notifies the Controller's contact address without undue delay and, where possible, within 48 hours of discovery. The notice states what is known: the nature of the incident, categories and an approximate number of people, likely consequences, and measures already taken or proposed.

The statutory notice to the Dutch Data Protection Authority (Art. 33 GDPR) is the Controller's task, unless the parties agree otherwise in writing. The Processor supplies the facts it has. An incident in the live room or booth that does not touch personal data on a disk — a fallen microphone, a late guest — is not a breach for this article.

11. Retention, return and deletion

After the last delivery the Processor keeps the working folders for 9 months, so a late revision or a lost file can still be recovered. After that the Processor wipes the audio from working disks and backups, unless the Controller asks in writing for an earlier return or deletion, or Dutch law requires a longer hold.

Invoices and the accounts of Okiatech B.V. stay for seven years. Those records usually hold the Controller's name and a project line, not the takes themselves. They fall under the studio's own controllership, described in article 4 of the privacy policy.

Return uses the format the job already used, or WAV/ZIP if that format is missing. The Processor need not keep an endless stack of copies after the Controller has confirmed receipt.

12. Checks and audits

The Controller may, once every twelve months and additionally on a reasonable suspicion of a breach, ask in writing how this Agreement is being kept. The Processor answers with a description of the measures. A physical audit at Eerste Helmersstraat 42 can be arranged during Mon–Fri 09:00–21:00 · Sat 10:00–18:00, without interrupting another client's session and without access to anyone else's drives.

An audit by an outside party is at the Controller's expense. The auditor signs a confidentiality undertaking. The Processor may refuse an auditor who is a direct competitor of Okiatech.

13. Liability

Liability for the studio job follows the terms and conditions. For damage that follows from processing contrary to this Agreement or the GDPR, Article 82 GDPR applies: the Processor is liable when it has gone beyond the instructions or has failed in its own GDPR duties. Fines from a supervisory authority that result from an unlawful instruction or a missing legal basis on the Controller's side are not the Processor's to bear.

14. Law, language and changes

This Agreement is governed by Dutch law. The courts of Amsterdam have jurisdiction, without prejudice to mandatory law. The Dutch text is the authentic version. Effective 1 October 2026, last updated 1 October 2026.

Changes to this model text on the site apply to new jobs. If recording has already started, the Agreement changes only if both parties confirm that in writing, or if the law forces an update. Contact: [email protected], 020 737 0891, Eerste Helmersstraat 42, 1054 DG Amsterdam.