Data processing agreement

1. Parties and roles

This data processing agreement ("Agreement") is between:

• Controller ("Client"): the business customer supplying personal data of participants, guests, presenters or musicians for work at Soredialhub.
• Processor: Soredialhub B.V., Haarlemmerweg 71, 1014 BD Amsterdam, KvK 84637019, represented by Daan van der Berg.

The Client determines purposes and means for those data subjects. The Processor delivers studio work under services such as vocal recording, band recording, mixing, mastering and podcast recording, and processes personal data only on the Client’s instructions.

2. Definitions and underlying contracts

GDPR terms have the same meaning. The commercial relationship follows our terms and conditions and the written quote. If this Agreement conflicts with the terms on processing of Client-designated data subjects, this Agreement prevails.

The Client warrants a legal basis to pass data to us and to inform data subjects where required.

3. Subject matter and duration

The Processor processes data needed for the studio job: identity, contact, voice recordings, optional image if brought by the Client, and technical session metadata. Duration runs from quote acceptance until return or deletion after the archive period in article 9 of the terms (default 24 months unless extended in writing).

4. Client instructions

The Processor processes data only on documented instructions: quote, email agreements and this Agreement. Instructions incompatible with the GDPR are rejected and the Client is informed.

Default instructions: record per schedule, store on secured systems, deliver agreed files, no publication on soredialhub.click without written consent from Client or data subject.

5. Confidentiality

Persons under the Processor’s authority with access to personal data are bound by confidentiality or a statutory duty of secrecy. Access is limited to what the job requires (up to 6 musicians in the live room per studio rules).

6. Security measures

The Processor implements appropriate technical and organisational measures under Article 32 GDPR, including HTTPS, access control, strong authentication where available, physical measures at Haarlemmerweg 71, and deletion of archive files after 24 months unless the Client requests extension in time.

The Client secures files after delivery to its own systems.

7. Sub-processors

The Client authorises:

• TransIP B.V., Vondellaan 47, 2332 AA Leiden, Nederland — hosting, email and EEA storage;
• FormSubmit (United States) — only when data subjects use the website contact form; not for raw session multitracks.

We conclude Article 28 GDPR terms with sub-processors. We inform the Client before changes or additions; reasoned objection within 14 days is possible. Without an alternative we cannot provide the affected service.

8. Data subject rights

Requests from data subjects received by the Processor are forwarded to the Client without undue delay. The Processor assists the Client in responding, as far as technically possible and at reasonable cost for excessive requests.

Information for direct studio clients is in our privacy policy; for data subjects supplied by the Client, the Client’s policy applies primarily.

9. Personal data breaches

The Processor notifies the Client without undue delay after discovering a breach of security of personal data under our responsibility, with information to enable notification to the AP and data subjects. We cooperate on investigation and mitigation.

10. DPIA, audit and information

The Processor supports the Client with a data protection impact assessment or prior consultation where mandatory, insofar as our role is involved.

The Client may once per calendar year, by appointment, request an audit or independent report limited to processing under this Agreement, under confidentiality and without unreasonably disrupting studio activity.

11. Transfers outside the EEA

We primarily process in the EEA via TransIP B.V.. FormSubmit may process data in the United States when the contact form is used. The Client acknowledges that transfer for website enquiries; session files remain in EEA storage unless agreed otherwise in writing.

12. Return and deletion

After completion we deliver agreed final files. We delete raw session files after 24 months unless extension is agreed in writing. On the Client’s request we delete earlier except where tax retention applies.

13. Liability and law

Liability between the parties follows the terms and conditions insofar as not contrary to mandatory GDPR provisions. Dutch law applies. Disputes go to the competent court in Amsterdam, without prejudice to data subjects’ rights.

Questions or signature: contact, [email protected] or 020 244 8193. Version 15 October 2026.