Data processing agreement

1. Parties and definitions

This data processing agreement («Agreement») forms part of the contract between:

• Controller: the business client ordering a service from Namdazivo B.V. and deciding why and how participants' personal data are processed;
• Processor: Namdazivo B.V., private limited company (B.V.), Van Hallstraat 74, 1051 HH Amsterdam, trade register 80941921, represented by Maarten de Vries.

Agreement means the accepted quote plus this Agreement and our terms and conditions. Data means personal data about participants (guests, musicians, hosts) supplied by the Controller for podcast recording, band recording, vocal recording or other studio work.

2. Subject matter and term

The Processor processes Data only to deliver the studio service in the quote: scheduling, recording, technical editing, file delivery and limited correspondence with participants when the Controller authorises that in writing.

Processing runs from supply of Data until 12 months after the last session under that contract, unless a shorter or longer period is agreed in writing or law requires longer retention (for example the Processor's own invoicing data).

3. Controller instructions

The Processor follows only documented instructions from the Controller that comply with law, the quote and this Agreement. Default instructions include: record and edit per the project plan, store on secured systems, no publication on namdazivo.click without the Controller's consent, and no use of recordings to train artificial intelligence.

The Controller ensures a valid legal basis (consent, contract, legitimate interest) and informs participants. Practical guidance is in our podcast consent guide.

If an instruction would breach the GDPR, the Processor notifies the Controller and pauses until the instruction is amended or a legal basis is shown.

4. Confidentiality and staff

The Processor binds staff to confidentiality. Only people who need Data for the job may access it — the team across 24 input paths and 3 rooms in Amsterdam.

The Controller supplies no more Data than necessary (for example name, contact, episode role, rider information).

5. Security

The Processor implements appropriate technical and organisational measures under Article 32 GDPR: HTTPS on namdazivo.click, access control, strong authentication where available, encryption of portable media where reasonable, and physical access control to the studio outside sessions.

General security details are in the privacy policy, security section. The Controller secures its own systems receiving delivered files.

6. Sub-processors

The Controller authorises these sub-processors as needed for the assignment:

• TransIP B.V., hosting and email;
• FormSubmit (formsubmit.co), only when the Controller uses the web form on namdazivo.click to communicate with the Processor;
• IT or backup providers contractually bound by the Processor.

The Processor informs about sub-processor changes; the Controller may object within 14 days with reasons. On objection, the parties seek a reasonable solution.

7. Data subject rights

Requests from participants (access, rectification, erasure, restriction, objection, portability) received by the Processor are forwarded without undue delay to the Controller, unless law requires the Processor to respond directly.

The Processor assists the Controller with Articles 32–36 GDPR obligations within reasonable cost for standard support.

8. Personal data breaches

The Processor notifies the Controller without undue delay after becoming aware of a breach relating to the Controller's Data, with information Article 33 GDPR requires so far as known. The Controller remains responsible for notification to the supervisory authority and data subjects.

9. Transfers outside the EEA

Primary processing and storage are in the Netherlands or the EEA. Transfer to the United States may occur via FormSubmit when the contact form is used; the Controller accepts that route or uses email directly to [email protected].

Other transfers occur only with appropriate safeguards (standard contractual clauses or an adequacy decision) or on the Controller's instruction.

10. Audit and documentation

On request the Processor provides reasonable information demonstrating compliance with this Agreement. Audits at the Processor are limited to once per calendar year, with at least 30 days' notice, during business hours and without disrupting operations, unless law requires otherwise.

11. End, return and deletion

After the assignment the Processor deletes Data within 12 months unless the Controller asks in writing for earlier deletion or transfer via an agreed channel. The Processor's invoicing data about the Controller itself falls under our privacy policy, not this Agreement.

Back-ups may retain copies until the regular backup cycle expires.

12. Liability and precedence

Liability between the parties follows the main contract and terms and conditions, subject to mandatory law. For processing participants' Data, in case of conflict: (1) this Agreement, (2) the quote, (3) the terms and conditions.

The Agreement is available in Dutch (authoritative) and English (information). Version 15 October 2026; questions via contact.