Data processing agreement
Summary
- Applies when we process material containing other people's data for you, such as podcast guests or speakers.
- You decide purpose and means; we process only on your instructions.
- Files are deleted 6 months after delivery, or sooner if you ask.
- We report a data breach without undue delay, within 48 hours of discovery.
01 Parties and scope
This agreement is between the business client (controller) and Vedrodev B.V., Overtoom 293, 1054 HW Amsterdam, KvK 85771006 (processor). It forms part of every assignment in which Vedrodev processes personal data you are responsible for, for example in podcast recording, voice-over work or mixing tracks you supply. The terms and conditions also apply; where they conflict on personal data, this agreement prevails.
02 Subject matter and data
| Item | Description |
|---|---|
| Purpose | Recording, editing, mixing, mastering and delivering audio |
| Data subjects | Speakers, guests, voice actors and musicians in your project |
| Data | Voice recordings, names in file names or scripts, content of conversations |
| Duration | The assignment plus the archive period of 6 months |
If your material contains special categories of data, such as health information in an interview, tell us beforehand so we can agree on extra measures.
03 Instructions
Vedrodev processes the data only on your documented instructions, including the booking confirmation and project e-mails. If we believe an instruction breaches the GDPR, we tell you straight away. We do not use the material for our own purposes, such as a portfolio or demos, without your explicit permission.
04 Confidentiality and security
Only Joris van Leeuwen and the engineers on the team have access, and they are bound to confidentiality. We take appropriate technical and organisational measures: encrypted storage, a separate backup, personal accounts and download links that expire after a limited time. Sessions take place in closed rooms with no third-party access while you record.
05 Sub-processors
You give general authorisation for these sub-processors:
- TransIP B.V., Schipholweg 9B, 2316 XB Leiden, Nederland: hosting of the website and delivery environment, within the EU.
- FormSubmit (United States): forwarding form messages, under standard contractual clauses.
We announce any new sub-processor by e-mail at least 14 days in advance, so you can object on reasonable grounds. Sub-processors are bound by the same obligations as this agreement.
06 Data breaches
We report a personal data breach to your contact person within 48 hours of discovery, with what is known about its nature, scale and the measures taken. That lets you decide within the legal 72 hours whether to notify the Autoriteit Persoonsgegevens. Notifying the authority and data subjects remains your responsibility unless we agree otherwise.
07 Data subject rights and assistance
If a data subject contacts us directly, we forward the request to you without delay and do not answer on substance ourselves. We give reasonable help with requests and with any data protection impact assessment. Assistance taking more than one hour is charged at €70.25 per hour excluding 21% VAT, after prior agreement.
08 Audits
You may verify that we comply with this agreement. On request we provide the written information needed. An on-site inspection is scheduled together, at least two weeks ahead and within opening hours (Mon–Fri 10–22, Sat 11–18).
09 Termination and return
After delivery we keep the files in our archive for 6 months so you can ask for small corrections. We then delete every copy, including backups. If you want this sooner, or want all raw tracks first, let us know at [email protected]; we confirm deletion in writing. Statutory retention of invoices still applies.
10 Liability and governing law
The liability limits in the terms and conditions apply as far as the law allows. This agreement is governed by Dutch law, and the Dutch text is authoritative. Version of 5 October 2026, effective from 5 October 2026. See also the privacy policy.