Data processing agreement

1. Parties

This agreement (“Agreement”) is between:

• Controller: the client instructing Neustonorix where third-party personal data is processed (podcast guests, audiobook narrators, band members who are not party to the contract, etc.).
• Processor: Neustonorix B.V., Overtoom 282, 1054 GZ Amsterdam, trade register 62244243, represented by Femke van der Meulen.

GDPR terms have the meaning in Regulation (EU) 2016/679. The Agreement supplements our terms and conditions and service pages such as podcast and audiobook, vocal recording and music production.

2. Subject matter and term

The Processor processes personal data only to perform agreed studio and post-production work: recording, editing, mixing, mastering and delivery through agreed channels.

The term starts on the first session date and ends 12 months after the last delivery, unless the Controller requests earlier deletion in writing or a longer archive period is agreed.

3. Data and processing operations

Data subjects: guests, hosts, voice talent, musicians or others whose voice or footage is captured.

Categories: audio (and video the Controller supplies), names, contact details, scheduling, script or rider excerpts.

Special categories: not intended; the Controller instructs no processing of sensitive data unless strictly necessary with an appropriate legal basis.

Operations: capture, storage, backup, technical editing, transfer per instruction, deletion after the retention period.

4. Instructions and confidentiality

The Processor follows only documented instructions from the Controller. Default workflow follows the quote and terms and conditions; deviations in writing via [email protected]. If an instruction appears incompatible with the GDPR, the Processor notifies the Controller promptly.

Anyone with access under the Processor’s authority is bound by confidentiality or statutory secrecy.

5. Security and sub-processors

The Processor implements appropriate technical and organisational measures: team-only access, encrypted storage where feasible, physical access by appointment during Mon–Fri 09:00–21:00 · Sat 10:00–18:00, and breach notification to the Controller within 72 hours.

Permitted sub-processors:

• TransIP B.V. — hosting and email within the EU/EEA;
• EU/EEA storage for session files the Processor uses, after written notice.

FormSubmit (United States) does not process session or guest data, only submissions from the public contact form on neustonorix.digital. New sub-processors are announced at least 2 business days in advance; reasoned objection is possible.

6. Data subject rights and information

The Processor assists the Controller with data subject requests within a reasonable time. Requests sent directly to the Processor are forwarded to the Controller unless the Processor must act under law.

The Processor provides information needed to demonstrate Article 28 GDPR compliance. On-site audits by appointment, at most once per year during business hours, with reasonable confidentiality.

7. Transfers, termination and liability

Transfers outside the EEA only on the Controller’s instruction with appropriate safeguards (standard contractual clauses, adequacy decision or Article 49 GDPR).

After termination the Processor deletes personal data or returns it to the Controller, except where tax retention (7 years) applies. The Processor can demonstrate deletion.

Liability follows the terms and conditions; this Agreement adds no guarantees beyond the law.

8. Contact and version

Activate this Agreement via contact, [email protected] or 020 248 3164. State “data processing agreement” and your company name.

Effective 15 October 2026, updated 15 October 2026. See also privacy policy and legal notice.