Skip to main content

Data processing agreement

Last updated : 14 October 2026

This English text is for convenience. The Dutch version is legally authoritative. Verwerkersovereenkomst

Summary

  • Applies when you are controller and we record or process files for you.
  • We process only on your instructions and under our terms.
  • Sub-processors such as TransIP B.V. and FormSubmit are listed; we notify changes.
  • After the job we delete or return data within 14 months unless agreed otherwise.

1. Parties and definitions

This data processing agreement ("Agreement") forms part of the contract between the client as controller ("Controller") and Miekpixel B.V., Wibautstraat 224, 1097 DN Amsterdam, trade register 64133575 ("Processor", trading as Miekpixel).

Personal data means all data covered by this Agreement, including voice recordings, talent names, contact details and project metadata. Processing includes recording, editing, mixing, mastering, storing, transferring and deleting as instructed.

2. Subject matter and term

Processor processes personal data only to deliver agreed studio services (such as Voice-over and narration, Vocal and spoken-word recording, Mixing and editing or Mastering and delivery) and as needed for scheduling, invoicing and quality control.

The term runs from first processing until return or deletion after the project, with a default archive period of 14 months after the last session unless agreed in writing or longer retention is legally required for invoices (see privacy policy).

3. Nature and purpose

Typical processing: multitrack capture in our rooms (live room about 38 m², 32 inputs), editing with up to 2 revision rounds on mixes per terms and conditions, export to agreed formats, and secure delivery to Controller.

Processor does not use personal data for its own marketing or AI training; see voice and AI in our privacy policy.

4. Categories of data subjects and data

Data subjects: performers, presenters, musicians or other talent engaged by Controller, plus Controller’s contact persons.

Data categories: audio recordings, video sync if supplied, names/roles, contact details, session notes, file names, and — where needed for payment — Controller’s billing data (not every talent unless Controller supplies it).

5. Controller’s instructions

Processor follows documented instructions from Controller within the main contract. Default instructions include: record only after schedule confirmation, no publication on miekpixel.digital without written approval, delivery within agreed timelines, and incident notification within a reasonable time.

If Processor believes an instruction breaches the GDPR, it informs Controller before acting. Urgent contact: [email protected] and 020 261 4783.

6. Confidentiality

Persons authorised by Processor — including Roos van den Berg and technical staff — are bound by confidentiality or an equivalent duty. Access is need-to-know per project.

7. Security

Processor implements appropriate technical and organisational measures, including HTTPS on the website, physical access control at Wibautstraat 224, encrypted storage where available, backups limited to continuity needs, and deletion after the archive period.

On request Processor provides a summary of relevant measures without disclosing details that would weaken security.

8. Sub-processors

Controller gives general written authorisation for sub-processors required to deliver the service. Current categories:

  • TransIP B.V. — hosting, email, storage;
  • FormSubmit — only when Controller or talent uses the website form (US transfer; see privacy policy);
  • cloud or transfer services — only when Controller specifies a delivery method.

Processor informs Controller of new sub-processors with reasonable notice to object. Sub-processors are bound by Article 28 GDPR terms.

9. Data subject rights

Processor assists Controller — considering the nature of processing — with data subject requests (access, erasure, etc.) where Controller cannot handle them alone. Requests sent directly to Processor are forwarded to Controller unless law requires otherwise.

10. Personal data breaches

Processor notifies Controller without undue delay after becoming aware of a personal data breach, with available details for notification to the supervisory authority where required. The parties coordinate communication to data subjects.

11. Impact assessments and audits

Processor supports Controller with a data protection impact assessment when required for the assignment, on reasonable effort. Controller may audit or appoint an independent auditor once per calendar year at an agreed time, under confidentiality, unless a regulator requires inspection.

12. Transfers outside the EEA

We primarily process within the EU/EEA. Transfers may occur when Controller chooses a US cloud or when FormSubmit is used. The parties apply appropriate safeguards (such as SCCs) where required.

13. Return and deletion

After completion Processor delivers agreed masters and working files to Controller and deletes remaining copies within 14 months, except where Processor must keep invoice data by law. Earlier deletion on request with written confirmation.

14. Liability and precedence

If this Agreement conflicts with terms and conditions on personal data where Controller is controller, this Agreement prevails. Other liability follows the main contract and Dutch law.

Processor questions: [email protected]. General privacy information: privacy policy.

15. Version

Model text published on miekpixel.digital, effective 14 October 2026, last updated 14 October 2026. Deviations are valid only if signed in writing by both parties.