Data processing agreement

1. Parties

This agreement («Agreement») is between:

• Controller: the client instructing Nazeriniedgevi where third-party personal data is processed, e.g. podcast guests, featured vocalists or band members who are not party to the contract.
• Processor: Nazeriniedgevi B.V., Van Ostadestraat 184, 1072 AK Amsterdam, trade register 97727664, represented by Daan Vermeer.

GDPR terms have their statutory meaning. This Agreement supplements terms and conditions and service pages such as vocal recording, mixing and mastering.

2. Subject and term

The Processor processes personal data only to perform agreed studio and post-production work: recording, technical edits, mixing, mastering and delivery via the agreed channel. The term starts on the first session day and ends 6 months after the last delivery, unless the Controller requests earlier deletion in writing or a longer archive period is agreed.

3. Categories and operations

Data subjects: guests, hosts, vocalists, rappers, musicians or others whose voice (and optionally image) is captured.

Data: audio recordings, names and contact details supplied by the Controller, scheduling information, scripts or riders where relevant.

Special categories: not intended; the Controller instructs the Processor not to collect sensitive data unless strictly necessary with an appropriate legal basis.

Operations: capture, storage, backup, technical editing (up to 2 revision rounds where applicable), transfer via agreed medium, deletion after the retention period.

4. Instructions and confidentiality

The Processor follows only documented instructions from the Controller. Default workflow follows the quote and terms and conditions; deviations in writing via [email protected]. If the Processor believes an instruction breaches the GDPR, it will notify the Controller promptly.

Staff and freelance engineers with access are bound by confidentiality or professional secrecy.

5. Security

The Processor implements appropriate technical and organisational measures: team-only access, encryption where feasible, physical access control during Mon–Fri 10–20, Sat 11–18, incident procedures with notification to the Controller within 72 hours when required.

Session files remain on systems in the EU/EEA unless the Controller explicitly instructs otherwise with appropriate safeguards.

6. Sub-processors

Approved sub-processors:

• TransIP B.V. — hosting for nazeriniedgevi.digital and business email in the EU/EEA;
• EU/EEA cloud or backup storage used for project files, after notice.

FormSubmit (United States) processes only submissions from the public contact form, not session or guest data. New sub-processors are notified at least 1 business day in advance; the Controller may object with reasons.

7. Data subject rights

The Processor assists the Controller with access, rectification, erasure or restriction requests within a reasonable time. Requests sent directly to the Processor are forwarded to the Controller unless the Processor must act by law.

The Processor provides information needed to demonstrate Article 28 GDPR compliance. On-site audits by appointment, at most once per year during office hours, subject to reasonable confidentiality.

8. Transfers, termination and liability

Transfers outside the EEA occur only on the Controller’s instruction with appropriate safeguards (standard contractual clauses, adequacy decision or Article 49 GDPR).

After termination the Processor deletes personal data or returns it to the Controller, except where tax law requires retention (7 years for invoice data). The Processor can confirm deletion in writing.

Liability follows terms and conditions; this Agreement does not create guarantees beyond the law. Questions: contact. Data overview: privacy policy.