Privacy policy
This English version is provided for information only. The Dutch version is the authoritative text. Privacyverklaring
In short
- We only process data you provide or that we need for quotes, sessions and invoicing.
- No ad cookies, no sale of data; we do not use your recordings to train AI.
- The contact form is routed through FormSubmit (US); you can also call or email us directly.
- Questions or requests: [email protected] — you may still complain to the Dutch supervisory authority.
1. Controller
The controller for personal data processed via https://mushyvanta.digital and in our business relationship is Mushyvanta B.V., a private limited company (B.V.), Bellamystraat 47, 1053 BL Amsterdam, the Netherlands ("Mushyvanta" or "we"). Trade register 70336191, VAT NL881526290B01. Contact: 020 244 8916, [email protected]. Editorial responsibility: Lars van der Berg.
We have not appointed a data protection officer; it is not required for our size and activity. Company details: legal notice.
2. Scope
This policy covers website visitors, people who use contact and clients who record, mix, master or rehearse with us in Amsterdam-West. It explains our practices and your rights under the GDPR and Dutch implementation law.
If you bring guests or artists as a business client, you are generally the controller for their data; we act as processor under our data processing agreement and your instructions. For podcast releases, see podcast rights and releases.
3. Data we process
Contact and quotes: name, email, phone (optional), chosen service, preferred date (optional) and your project message. Required fields are needed to reply; without email we cannot send a quote.
Booking and delivery: billing details, artist or band name, scheduling, email and phone exchanges, payment references. Card payments in the studio go through our bank terminal; we do not store card numbers.
Recordings: voice and performance are personal data when they identify someone. We use them only to deliver the agreed service. If you film in the studio, you remain responsible for other people’s image data.
Technical: our host TransIP B.V. processes server logs (IP address, time, page, user agent) for security. Your cookie choice is stored locally; see cookie policy.
We do not ask for special-category data. If you need to reschedule for health reasons, say you are unavailable; no medical certificate is required.
4. Purposes, legal bases and retention
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Answering enquiries | Form fields, email threads, call notes | Steps before a contract at your initiative (GDPR Art. 6(1)(b)) | Twenty-four months from the last message if no booking is made |
| Running sessions and projects | Names, contact routes, briefs, calendar slots | Performance of our agreement (Art. 6(1)(b)) | Five calendar years once the client relationship has ended |
| Audio and project copies | Multitracks, mixes, masters, session notes | Same contract basis (Art. 6(1)(b)) | 12 months from the last file activity, then removal under article 10 |
| Tax and accounting files | Invoice lines, bank references | Statutory bookkeeping duty (Art. 6(1)(c)) | Seven years to meet Dutch fiscal rules |
| Disputes and claims | Emails, contracts, evidence bundles | Legitimate interest to defend rights (Art. 6(1)(f)) | Until closure of the case plus any appeal window |
| Server hardening | IP logs at TransIP B.V. | Security interest plus telecom rules (Art. 6(1)(f)/(c)) | Short operational window, usually under ninety days unless an incident requires longer review |
| Remembering cookie choices | mshv_consent_v1 value in localStorage | Consent rules for non-essential trackers | 182 days before the banner returns |
We never trade personal data. Marketing mail only goes out with a separate opt-in. You may object where we rely on legitimate interest (Art. 21 GDPR).
5. Voice, image, minors and AI
Marketing pages on https://mushyvanta.digital never show audio snippets, behind-the-scenes photos or your project title unless you approve that in writing first.
Session material stays out of machine-learning pipelines: we neither fine-tune models on your takes nor synthesise a clone of your voice without a dedicated signed release from the performer.
Anyone below 16 needs a guardian to book and supply details. The contact form targets adults planning studio time, not children browsing alone.
6. Recipients and processors
Within the studio, Lars van der Berg, engineers and admin staff see data strictly on a need-to-know basis. Outside parties receive information only as listed:
- TransIP B.V. — Zuiderhoeveweg 16, 1108 BA Amsterdam, the Netherlands — keeps https://mushyvanta.digital online and mailboxes, predominantly in the EEA;
- FormSubmit (Elite Formular LLC, United States) — relays contact form submissions to [email protected];
- external bookkeeper — invoice metadata under professional confidentiality;
- payment service provider — settlement of transfers and in-studio card terminals;
- competent authorities — disclosure when statute demands it.
Each vendor signs Article 28 terms. Business productions with third-party talent should also sign our data processing agreement.
7. Transfers outside the EEA
Hosting and storage are primarily in the European Economic Area. FormSubmit processes form content in the United States. That transfer is necessary to handle your request via the form (Art. 49(1)(b) GDPR). To avoid it, email [email protected] or call 020 244 8916; we handle your request the same way.
We monitor developments on appropriate safeguards and adjust measures or alternatives when needed.
8. Security
We apply appropriate measures: HTTPS, restricted access with individual accounts and strong passwords, encryption on workstations where feasible, locked premises outside sessions, and deletion of archive files after the agreed period.
If a breach is likely to affect your rights, we notify the Dutch Data Protection Authority within 72 hours where required (Art. 33) and inform you directly when risk is high (Art. 34).
9. Your rights
You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20), objection (Art. 21) and withdrawal of consent (Art. 7(3)). Send requests to [email protected] or by post to Bellamystraat 47, 1053 BL Amsterdam. We reply within one month; complex cases may be extended by two months with an explanation.
You may lodge a complaint with the Autoriteit Persoonsgegevens (Dutch DPA), autoriteitpersoonsgegevens.nl. We prefer to resolve issues first via contact or FAQ.
10. Cookies and similar technologies
We use no cookies for analytics, advertising or social media. Only your consent for optional categories is stored under mshv_consent_v1 for 182 days. Details: cookie policy and .
11. External links and maps
The site links to third-party services such as OpenStreetMap for directions (Tram 13 stop Bellamyplein (5-minute walk). Bus 22 stop Bilderdijkstraat. From Amsterdam Centraal about 15 minutes on tram 13 towards Amsterdam Sloterdijk.). They apply their own privacy rules; we are not responsible for their processing.
12. Changes
We may update this policy when services or law change. The version on this page applies from 15 October 2026; last updated 15 October 2026. For material changes affecting ongoing clients we inform you by email where appropriate. Contractual rights remain under terms and conditions. Questions: [email protected].
The Dutch version of this policy is legally authoritative; this English text is provided for convenience.