Data processing agreement

1. Parties and definitions

This data processing agreement («DPA») forms part of the contract between:

• Controller («Client»): the business customer that decides why and for what purpose personal data is processed, for example a label, producer, podcast network or agency.
• Processor: Morceauxnode B.V., Overtoom 301, 1054 GL Amsterdam, KvK 63085050, represented by Niels van Dijk («Morceauxnode»).

Personal data: any information about identified or identifiable natural persons that Client has Morceauxnode process, such as voice recordings, contact details of artists, guests or hosts, and session scheduling.

Processing: any operation on personal data in the context of studio and post-production services under terms and conditions.

2. Subject matter and duration

Morceauxnode processes personal data solely to perform agreed services: recording, mixing, mastering, podcast production and related technical work in Amsterdam. Processing runs in parallel with the main contract and ends when all deliverables are supplied and the 24-month archive period has elapsed, unless a longer term is agreed in writing or law requires longer storage.

3. Nature and purpose

Typical processing: capturing audio (and any video Client supplies), storing session files, exporting to agreed formats, limited communication with artists about scheduling, and invoicing Client. Morceauxnode does not use the data for its own marketing and does not train AI models on recordings of data subjects.

Purposes and categories of data subjects are determined by Client; see also guide on rights.

4. Categories of personal data

Depending on the project this may include: name, contact details, voice and performance recordings, biographical data Client shares, schedule information, and technical file metadata. Morceauxnode does not process special categories unless Client explicitly instructs this and documents a valid legal basis and instruction.

5. Client instructions

Morceauxnode processes only on documented instructions from Client, including the quote, session brief and written email. If Morceauxnode believes an instruction infringes the GDPR, it will inform Client promptly. Client ensures instructions are lawful and that data subjects are informed where required.

6. Confidentiality

Persons authorised by Morceauxnode to access personal data are bound by confidentiality or a statutory duty of secrecy. Access is limited to what the assignment requires.

7. Security

Morceauxnode implements appropriate technical and organisational measures under Article 32 GDPR, including HTTPS, access restriction, physical studio security, and deletion of working files after 24 months. On request Morceauxnode provides reasonable information about measures; extensive audits only by separate agreement on cost allocation.

8. Sub-processors

Client gives general written authorisation for sub-processors that may process personal data:

• TransIP B.V. — hosting and email;
• FormSubmit — contact form forwarding (US);
• accountant and bank — Client’s own billing and payment data only.

Morceauxnode informs Client of intended changes to sub-processors with an opportunity to object. Each sub-processor is bound by equivalent data protection terms.

9. Data subject rights

Morceauxnode assists Client, as far as reasonable, in responding to data subject requests (access, rectification, erasure, restriction, objection, portability). Requests received directly by Morceauxnode are forwarded to Client unless Morceauxnode is controller.

10. Personal data breaches

Morceauxnode notifies Client without undue delay after becoming aware of a breach affecting Client’s data, with the information Article 33 GDPR requires as far as known. Client remains responsible for notification to the supervisory authority and data subjects.

11. Transfers outside the EEA

We primarily process within the EEA. Transfer via FormSubmit to the United States occurs when Client or data subjects use the contact form; legal basis and safeguards are in privacy policy. Other transfers only on Client instruction with appropriate safeguards (for example EU standard contractual clauses).

12. Audit and information

Client may once per calendar year, with reasonable notice, ask in writing for confirmation that Morceauxnode complies with this DPA. Morceauxnode may respond with a recent description of measures instead of a physical audit unless law requires otherwise or a serious incident justifies it.

13. End of processing

After services end, Morceauxnode deletes Client data subjects’ personal data within 24 months unless Client requests return in a common digital format within that period, or Morceauxnode must retain data for tax or civil limitation periods. Deletion covers working copies in the studio archive, except backups overwritten on schedule.

14. Liability and precedence

Where processing falls under this DPA, it prevails over conflicting terms in other documents on data protection. Other liability remains under terms and conditions.

Operational contact: [email protected], 020 789 0416, contact page.