Data processing agreement
This English text is for convenience. The Dutch version is legally authoritative. Verwerkersovereenkomst
In short
- Applies when you as client supply personal data about guests or artists for a session.
- Morigliolink processes only on your instructions and under our terms and conditions.
- Sub-processors such as TransIP B.V. are contractually bound; we notify you of changes.
- After the project we delete or return data within 12 months unless agreed otherwise.
1. Parties and acceptance
This data processing agreement («Agreement») forms part of every contract between:
- Controller («Client»): the business customer instructing Morigliolink B.V. («Morigliolink», «Processor») and determining why third parties’ personal data are processed (for example podcast guests, voice talent, band members or interviewees).
- Processor: Morigliolink B.V., a private limited company (B.V.), Overtoom 682, 1054 JT Amsterdam, KvK 75843421, VAT NL818710214B01, represented by Lars van der Meer.
By accepting a quote and supplying third-party data, Client accepts this Agreement. If documents conflict, this Agreement prevails for those third parties’ data; other topics are governed by the terms and conditions.
2. Definitions
GDPR terms apply. «Personal data», «data subject», «processing» and «breach» have GDPR meanings. «Service» is any recording, editing or post-production service described on services and in the quote. «Session data» includes audio, video (if supplied by Client), session folders, metadata and contact details of invitees Client provides.
3. Subject matter and duration
Processor processes Personal data only to deliver the agreed Service: scheduling podcast and interview recording, vocal and spoken-word recording, band and live recording, mixing, mastering or music for picture, including technical storage during and after the session.
Processing runs from quote acceptance until return or deletion of Session data under «Termination and return», unless a longer archive period is agreed in writing (default up to 12 months after delivery).
4. Nature of processing and categories
| Topic | Details |
|---|---|
| Data subjects | Guests, artists, hosts, musicians and other participants Client sends to the studio. |
| Categories | Name, contact details, voice and image recordings, intro biographies, rider information excluding special categories. |
| Operations | Collection via Client, storage on secured systems, editing, mixing, mastering, export to Client, deletion after archive period. |
| Location | Studio Overtoom 682, Amsterdam and hosting with TransIP B.V. in the Netherlands, plus delivery channels Client chooses. |
Client warrants a valid legal basis towards data subjects (for example consent or employment) and supplies only data needed for the Service.
5. Instructions and confidentiality
Processor processes Personal data only on documented instructions from Client, including the quote, written email and oral directions during the session confirmed by Client. Processor will flag instructions that breach the GDPR.
Persons authorised by Processor are bound by confidentiality or statutory secrecy. Access is limited to team members delivering the Service.
6. Security
Processor implements appropriate technical and organisational measures under Art. 32 GDPR, including physical access control at the studio, HTTPS on the website, restricted accounts, encryption where reasonable, and backup and recovery procedures. Further detail is in the privacy policy.
Client is responsible for security of accounts and links used to receive files. Each party notifies the other without undue delay if a breach is suspected.
7. Sub-processors
Client gives general written authorisation for sub-processors required for the Service. Current categories:
- TransIP B.V. — hosting of the website and related infrastructure;
- FormSubmit — only when Client or invitees use the contact form (US transfer; see privacy policy);
- accountant — billing data when Client is a debtor.
Processor contracts with each sub-processor with at least the same protection as this Agreement. Before adding a new sub-processor, Processor informs Client; Client may object within 14 days with reasons. If objection is valid, the parties seek an alternative or end the affected part of the Service.
8. Data subject rights
Processor assists Client, considering the nature of processing, with data subject requests (access, rectification, erasure, restriction, objection, portability) via [email protected]. Disproportionate effort may be charged under the terms and conditions.
Requests sent directly to Processor are forwarded to Client unless law requires Processor to respond.
9. Personal data breaches
Processor notifies Client without undue delay after discovering a breach relating to Personal data supplied by Client, with information Client needs to notify the AP and data subjects. Processor documents each breach.
10. Audits and information
On Client request, Processor provides reasonable information about compliance, such as a summary of measures or a recent audit report if available. On-site audits are limited to once per calendar year, with 30 days’ notice, during business hours and without disrupting operations or other clients.
11. Transfers outside the EEA
We primarily process within the EEA. When Client requests delivery via non-EEA services, or when FormSubmit is used, Processor applies appropriate safeguards (for example SCCs) or processes only on Client instruction that provides a transfer legal basis.
12. Termination, return and deletion
After the Service ends or on Client’s written request, Processor returns Session data in common formats (such as WAV, AIFF or agreed stems) and deletes remaining copies within 30 days, except:
- data Processor must keep by law (tax records up to 7 years);
- backups overwritten on a rolling basis within 90 days;
- extended archive up to 12 months when stated in the quote for re-deliveries.
Client may request earlier deletion in writing; extra work is agreed in advance.
13. Liability and governing law
Liability between the parties is governed by the terms and conditions, subject to mandatory data protection law. Dutch law applies to this Agreement. Disputes go to the competent court in Amsterdam, without prejudice to data subjects’ right to complain to the AP.
Questions about this Agreement: [email protected] or contact. Rate indications: services (VAT 21 %).