Data processing agreement
This English version is provided for information only. The Dutch version is the authoritative text. Verwerkersovereenkomst
In short
- For labels, agencies and producers who bring guests to our Amsterdam studio.
- You remain controller; Mushyvanta B.V. processes only on your instructions and this agreement.
- Sub-processors include TransIP B.V. and FormSubmit — with appropriate safeguards.
- Requests and signing: [email protected] — combine with your quote and terms and conditions.
1. Parties and roles
Controller (Client): the business customer confirming an order with Mushyvanta B.V., trade register 70336191, "Client".
Processor: Mushyvanta B.V., private limited company (B.V.), Bellamystraat 47, 1053 BL Amsterdam, VAT NL881526290B01, "Mushyvanta" or "Processor". Contact: [email protected], 020 244 8916.
The Client determines purposes and means for personal data of artists, guests, hosts or other participants the Client brings to the studio. Processor processes that data only on the Client’s instructions, in addition to terms and conditions and the privacy policy (for Processor’s own client contact).
2. Subject matter and term
This agreement covers processing for studio services: vocal recording, band recording, podcast recording, mixing, mastering or rehearsal space, as set out in the quote. Term: from acceptance until return or deletion after the retention period in article 10 (default 12 months archive), unless extended in writing.
3. Nature of processing
Processor captures audio, edits and delivers files, schedules sessions, keeps project copies for performance and supports quality checks for the Client. Processing takes place in Amsterdam and on approved sub-processor systems. No use for Processor’s own marketing or AI training, per privacy policy.
4. Categories of data and data subjects
| Category | Examples |
|---|---|
| Identity and contact | Name, stage name, email, phone of participants |
| Audio / performance | Voice, instruments, conversation in session |
| Scheduling | Attendance, session times |
| Optional image | Only if the Client films and Processor provides technical support |
Data subjects: artists, guests and staff introduced by the Client. The Client ensures a valid legal basis and informs data subjects, for example via podcast rights and releases.
5. Instructions
Processor processes only on documented instructions from the Client (quote, email, session brief). If instructions appear incompatible with the GDPR, Processor informs the Client. Processor may refuse clearly unlawful processing.
6. Processor obligations
- Confidentiality for all staff involved.
- Appropriate technical and organisational measures (access control, HTTPS, backups, physical studio security).
- Assistance with data subject requests where Processor holds the data; referral to the Client where appropriate.
- Notification of personal data breaches to the Client without undue delay, with information for Arts. 33 and 34 GDPR.
- After completion: return or deletion per the Client’s choice, subject to legal retention.
7. Sub-processors
The Client gives general written authorisation to use:
- TransIP B.V., hosting and storage;
- FormSubmit, form forwarding (US — see privacy policy);
- accountant and bank, limited to administration.
Processor informs the Client of intended changes to sub-processors; the Client may object within 14 days with reasons. Sub-processors are bound to equivalent Article 28 obligations.
8. Transfers
Processing is primarily within the EEA. Transfer via FormSubmit to the US occurs when the Client or data subjects use the contact form; alternative is direct email to [email protected]. Processor applies appropriate safeguards as in the privacy policy and additional measures where needed.
9. Audits
The Client may once per calendar year, by appointment and reasonable notice, request compliance information or an audit by an independent third party under confidentiality. Costs are borne by the Client unless serious breach by Processor is proven.
10. Liability
Liability between the parties follows terms and conditions and mandatory law. Processor is liable for damage from breach of this agreement or the GDPR to the extent Processor is liable under Art. 82 GDPR.
11. Final provisions
Dutch law applies. Disputes: preference for Amsterdam courts for business parties, subject to mandatory consumer rules. The text on https://mushyvanta.digital is a model; the signed copy in the quote file prevails. Request a PDF via contact. Model version: 15 October 2026.
The Dutch version of this agreement is authoritative; this English text is for information.