In brief
- You are controller; Nubilosegate processes on your instructions for agreed recording or mix work.
- We use security measures and sub-processors such as TransIP B.V. only as needed.
- Working files: default retention 18 months, then deletion or return.
- Agree this before sessions with guests; questions via [email protected] or contact.
1. Parties and definitions
This agreement is between you as controller (Client) and Nubilosegate B.V., Czaar Peterstraat 104, 1018 RR Amsterdam (Processor, trading as Nubilosegate), when we process personal data you provide or have recorded in our studio.
GDPR terms have the same meaning. The main contract for studio services is in our terms and conditions; if they conflict, this schedule prevails for data protection.
2. Subject matter and term
The Processor processes personal data only to perform services described in the order, such as Vocal and spoken-word recording, Band and live-room recording, Podcast recording, Mixing or Mastering, including storage of session files and scheduling communication.
Processing runs from the first instruction until deletion or return after the retention period, unless law requires longer storage.
3. Nature of data and data subjects
Typical data: name, contact details, voice or instrument recordings, podcast conversations, your organisation’s billing data and technical file metadata. Data subjects may be your artists, band members, podcast guests or voice-over talent.
The Client ensures a valid legal basis (for example consent or contract) and informs data subjects via its own privacy notice. See our privacy policy for data where Nubilosegate is controller.
4. Instructions and confidentiality
The Processor processes only on documented Client instructions, including email or the contact form. If an instruction appears incompatible with the GDPR, the Processor will flag it before acting.
Staff and freelance engineers (see about) are bound by confidentiality.
5. Security
The Processor implements appropriate technical and organisational measures: access control, encrypted storage where available, physical locking of the studio outside Tue–Fri 10–21, Sat 11–17, and incident procedures aligned with Article 32 GDPR.
After a personal data breach, the Processor notifies the Client without undue delay with information needed for regulator notification where required.
6. Sub-processors
Permitted sub-processor categories:
- hosting and email via TransIP B.V.;
- FormSubmit when the Client uses that channel for forms;
- cloud or backup services you explicitly designate for file delivery.
The Processor signs Article 28 GDPR terms with sub-processors. We notify changes at least fourteen days ahead; the Client may object with reasons.
7. Data subject rights
Requests from data subjects received by the Processor are forwarded to the Client within 3 business days. We assist with fulfilment where technically feasible, at reasonable cost unless otherwise agreed.
8. Retention and return
By default we keep working files 18 months after the last relevant session, as in our privacy policy. We then delete copies on our systems or deliver exports in an agreed format (for example WAV for a mix).
Early deletion is available on request unless tax law requires invoices to be kept longer.
9. Audits and liability
The Client may request reasonable compliance information once per year by appointment. On-site audits require fourteen days’ notice and must not disrupt live sessions.
Liability for breach of this schedule follows the limitation clauses in our terms and conditions, as far as permitted under Dutch law.
10. Transfers outside the EEA
We mainly process within the EEA. If FormSubmit or a cloud provider you choose processes data outside the EEA, we use appropriate safeguards (standard contractual clauses or equivalent) or act only on your written instruction.
11. Final provisions
Dutch law applies to this schedule. Disputes go to the competent court in Amsterdam unless mandatory consumer law says otherwise.
Questions or paper signature: [email protected], 020 261 4783. Related: cookie policy, accessibility statement, streaming master requirements.