Data processing agreement
This English version is for convenience. The Dutch text is legally authoritative. Verwerkersovereenkomst
In short
- Applies when you supply personal data (guests, voices, band members).
- Milepostvivo processes only on your instructions and our studio agreements.
- Sub-processors include host TransIP B.V. and FormSubmit for forms; list on request.
- After the job we delete working files within 24 months unless agreed otherwise.
1. Parties and definitions
This data processing agreement (Agreement) forms part of the commercial relationship between you as controller (Client) and Milepostvivo B.V., a private limited company (B.V.), Helmersstraat 73, 1054 CV Amsterdam (Processor), trading as Milepostvivo.
GDPR terms have the same meaning. Personal data includes voice recordings, participant names and contact details Client provides for Vocal recording, Podcast recording, Band recording, Mixing or Mastering.
2. Subject matter and term
Processor processes personal data only to deliver services described in the quote or terms and conditions. The term runs from booking until return or deletion after retention, capped at 24 months after the last session unless extended in writing.
Processor does not use data for its own marketing or analytics without separate consent from Client and data subjects.
3. Nature and purpose of processing
Processing includes recording, editing, mixing, mastering, temporary storage on studio systems and delivering final files to Client via agreed channels. The purpose is audio production for Client’s project only.
Processor does not perform automated decision-making with legal or similar effect on data subjects. General practices are in our privacy policy.
4. Categories of data subjects and data
Typical data subjects: artists, hosts, podcast guests, band members and other participants Client brings to the studio. Data may include audio, video if Client films, names, contact details and project notes.
Client ensures a valid legal basis (for example consent or contract) and informs data subjects via Client’s own privacy notice where needed.
5. Instructions and confidentiality
Processor follows Client’s written or oral instructions that fit the service. If an instruction conflicts with the GDPR, Processor notifies Client and pauses until Client adjusts the request or provides a legal basis.
Milepostvivo staff are bound by confidentiality. Access is limited to what the session requires.
6. Security
Processor implements appropriate technical and organisational measures, including physical access control in the studio, password protection, encryption where reasonable and periodic cleanup of working folders. Details can be explained on request.
Client is responsible for security of files after delivery and for backups of final masters.
7. Sub-processors
Client gives general written authorisation for sub-processors needed for hosting, email or form forwarding:
- TransIP B.V. — hosting and storage in the Netherlands;
- FormSubmit — contact form forwarding (US transfer; see privacy policy).
Processor informs Client of sub-processor changes with reasonable notice to object. Sub-processors are contractually bound to at least the same obligations as this Agreement.
8. Data subject rights and audits
Processor assists Client with data subject requests (access, erasure, etc.) within a reasonable time, given the nature of processing. Requests may arrive via [email protected]; Client coordinates substance.
On request and at most once per calendar year unless a breach warrants extra review, Processor provides information needed to demonstrate Article 28 GDPR compliance. On-site audits only by appointment and without disrupting sessions.
9. Personal data breaches
Processor notifies Client without undue delay after becoming aware of a personal data breach related to this processing, with available details so Client can notify the AP if required.
Both parties document measures taken and support each other within reasonable limits.
10. Return, deletion and liability
After the service Processor delivers final files to Client as agreed. Working files and intermediate copies are deleted within 24 months unless Client requests written extension or legal retention applies.
Liability for GDPR-related damage between the parties follows the main contract and terms and conditions, without prejudice to mandatory law.
On request the parties may sign a short confirmation per project; this page is the default framework. Contact: Milepostvivo B.V., [email protected], 020 244 8619. Last updated 14 October 2026. The Dutch version is legally authoritative.