Data processing agreement

1. When this agreement applies

This data processing agreement (DPA) applies when you, as client or commissioning party, are the controller under the General Data Protection Regulation (GDPR) and Murkiernode B.V. (processor) processes personal data on your instructions. Typical cases: podcast guests or voice artists you book, narrators for your production, or your staff recorded in our studio in Amsterdam.

If you are a consumer booking for yourself, the privacy policy governs and this DPA does not apply. Business orders fall under our terms and conditions; where they conflict on personal data, this DPA prevails.

2. Parties and contact

Controller (you): the entity that confirms the order and gives instructions about the recordings.

Processor: Murkiernode B.V., Van Boetzelaerstraat 35, 1051 DT Amsterdam, KvK 82181318, contact [email protected] / +31 (0)20 214 18 52, represented by Eva de Vries.

Security or deletion questions go to the same address; include the project or session date.

3. Subject matter and term

The processor processes personal data solely to perform the services in the accepted quote: studio recording, editing, mixing, mastering or related audio delivery. The term runs from first processing until return or deletion after completion, with a technical archive period of up to 12 months unless we agree otherwise in writing.

4. Nature of data and data subjects

Data may include: name, contact details, voice recordings, likeness if you shoot video, and metadata in session files. Data subjects: speakers, musicians, presenters or staff you designate.

We do not process special categories on your request unless you provide prior written instructions and a valid legal basis.

5. Instructions and confidentiality

The processor processes data only on documented instructions from the controller, including this DPA, the quote and reasonable oral directions during the session (for example which takes to keep). Instructions that violate the GDPR will be refused.

Anyone with access to data is bound by confidentiality or an equivalent statutory duty.

6. Security

The processor implements appropriate technical and organisational measures under Article 32 GDPR, including HTTPS on murkiernode.click, access control, encryption where suitable, physical locking of the studio outside sessions, and backups within the EEA at TransIP B.V..

On request the processor provides reasonable information about relevant measures without compromising security itself.

7. Sub-processors

The controller authorises the processor to use:

• TransIP B.V. — hosting, email and storage, Vondellaan 47, 2332 AA Leiden, Netherlands;
• FormSubmit — only when the contact form is used for communication about your order; transfer to the US may occur; see transfers in the privacy policy.

The processor informs the controller of intended changes to sub-processors with an opportunity to object. The processor concludes Article 28 terms or equivalent binding rules with each sub-processor.

8. Data subject rights

Requests from data subjects (access, rectification, erasure, restriction, objection, portability) received by the processor are forwarded without undue delay to the controller unless the processor must respond by law.

The processor assists the controller, as reasonably possible, with Chapter III GDPR obligations and impact assessments where needed.

9. Personal data breaches

The processor notifies the controller without undue delay after becoming aware of a personal data breach, with information needed for notification to the supervisory authority and data subjects.

10. Audits and documentation

The processor makes available information necessary to demonstrate Article 28 compliance and allows audits or inspections by the controller, at most once per calendar year on business days, with at least thirty days’ notice, unless a regulator requires immediate inspection.

11. Return and deletion

After services end, the processor deletes personal data or returns it to the controller, at the controller’s choice, unless EU or member-state law requires storage. Copies in backups are overwritten in the normal rotation cycle.

By default we archive session material for 12 months for possible follow-up work; after that we delete unless you order an extension.

12. Liability and final provisions

Liability between the parties follows the terms and conditions unless mandatory law says otherwise. Dutch law applies to this DPA. Disputes go to the competent court in the Amsterdam district, without prejudice to the controller’s right to sue where the GDPR allows in the data subject’s country.

This text is a model; by accepting a quote that refers to this page, the parties agree to the DPA where applicable. Version: 15 October 2026.

Practical questions: contact page or FAQ.