Data processing agreement

1. Parties and definitions

This data processing agreement ("DPA") forms part of the contract between:

• Controller (Client): the business customer that hires Monimiavyra for recording, mixing, mastering or voice-over and determines purposes and means for personal data of data subjects (artists, speakers, guests).
• Processor: Monimiavyra B.V., Van Woustraat 78, 1074 LN Amsterdam, trade register 80238145, represented by Mieke van der Berg.

Personal data: any information about identified or identifiable natural persons that the Processor handles for the Controller, including audio, names, contact details and scheduling. Processing: any operation within GDPR Article 4.

Company details: legal notice. Privacy for end clients booking directly: privacy policy.

2. Subject matter and term

The Processor processes personal data solely to deliver agreed studio services: booking, recording, editing, file delivery and related communication. Processing runs from order acceptance until return or deletion under payment and delivery and this DPA, with a default archive of 24 months after the last session unless written otherwise.

3. Nature and purposes

Typical jobs: Voice-over and narration for publishers, Vocal recording for labels, Live ensemble recording for productions, and Mixing / Mastering on supplied material. Purposes are set by the Controller (public release, internal use, audition, etc.). The Processor does not use data for its own marketing or AI training; see privacy policy.

4. Data subjects and categories

Data subjects: performers, narrators, guests and others recorded under the Controller’s responsibility.

Categories: identity and contact data, schedules, session metadata, multitrack and mix files, billing data for recharge. We do not process special categories on the Controller’s request; the Controller ensures a valid legal basis towards data subjects.

5. Instructions

The Processor follows documented instructions from the Controller — briefings, email, quotes and terms and conditions. If an instruction appears incompatible with the GDPR, the Processor informs the Controller before acting.

The Controller informs data subjects via its own privacy notice and secures consent or other grounds, including portrait and voice rights where needed.

6. Processor obligations

The Processor shall:

• use data only for the engagement;
• ensure confidentiality of staff with access;
• implement appropriate technical and organisational measures (access control, HTTPS, physical studio security);
• not engage sub-processors without notice as in section 6 below;
• assist the Controller with data subject requests within a reasonable time;
• notify personal data breaches without undue delay so the Controller can meet reporting duties;
• delete or return data after completion, except legal retention (7 years for invoices we issue to the Controller).

7. Sub-processors

The Controller gives general authorisation for sub-processors required for the service:

• TransIP B.V. — hosting, email and storage for site and project communication, servers in the Netherlands;
• FormSubmit (US) — only when the Controller or data subjects use the contact form; transfer as described in privacy policy.

The Processor contracts sub-processors with at least the same protection as this DPA. Changes are announced via monimiavyra.click or email; the Controller may object within 30 days with reasons.

8. Transfers outside the EEA

Primary project storage is in the Netherlands. Transfer to the United States may occur via FormSubmit when the web form is used. The Controller may email [email protected] directly to avoid that path. Where transfer occurs, we apply appropriate safeguards such as EU standard contractual clauses when required.

9. Audits and information

On request the Processor provides reasonable information about compliance, e.g. a summary of security measures. Physical audits in the studio are possible by appointment during Wed–Fri 10–20, Sat 11–16, without disrupting other clients’ sessions.

10. Liability and precedence

If this DPA conflicts with terms and conditions, this DPA prevails for personal data processing; pricing, revisions (2 rounds where applicable), cancellation (5 days) and deposit (30%) follow the general terms.

Neither party is liable for indirect damage; the Processor’s total liability for processing remains capped as in the general terms unless mandatory law says otherwise.

11. Contact and acceptance

Questions about this DPA: [email protected] or 020 261 3847, Monimiavyra B.V., Van Woustraat 78, 1074 LN Amsterdam.

By placing and confirming a business order, the Controller accepts this DPA. We can send a PDF copy with signature blocks on request. Last updated: 14 October 2026.