Data processing agreement

1. Parties and roles

This data processing agreement ("Agreement") is between:

• Controller ("Client"): the business customer supplying personal data about participants, guests, hosts or musicians for a project at Nephilimrivo.
• Processor: Nephilimrivo B.V., Overtoom 289, 1054 SG Amsterdam, trade register 88138660, represented by Charlotte de Vries.

The Client determines purposes and means for those individuals; the Processor performs recording, editing and delivery under studio services (vocal recording, band recording, mixing, mastering, podcast recording) and processes personal data only on the Client’s instructions.

2. Definitions and main contract

GDPR terms have the same meaning as in Regulation (EU) 2016/679. The commercial relationship is governed by terms and conditions and the written quote. If this Agreement conflicts with those terms on processing of data about individuals the Client introduces, this Agreement prevails.

The Client warrants a lawful basis to pass data to us (for example consent, employment or contract) and to inform data subjects where required.

3. Subject matter and term

The Processor handles data needed to perform the studio job: identity, contact details, voice recordings, optional image material supplied by the Client, and technical session metadata. The term runs from quote acceptance until return or deletion after the retention period in article 9 of the terms (24 months archive unless agreed otherwise in writing).

4. Instructions

The Processor processes data only on documented instructions from the Client, including the quote, email agreements and this Agreement. Instructions that would breach the GDPR are rejected and the Client is notified.

Default studio instructions: record per schedule, store on secured systems, deliver agreed files, no publication on nephilimrivo.click without written approval from Client or the data subject.

5. Confidentiality

Anyone processing data under the Processor’s authority is bound by confidentiality or a statutory duty of secrecy. Access is limited to team members who need it for the project.

6. Security

The Processor implements appropriate technical and organisational measures under Article 32 GDPR, including HTTPS on the site, access control, strong authentication where available, physical measures at the studio on Overtoom 289, and deletion of archive files after 24 months unless the Client requests an extension in time.

The Client is responsible for security of files once delivered to the Client’s systems.

7. Sub-processors

The Client authorises these sub-processors for hosting and form relay:

• TransIP B.V., Vondellaan 47, 2332 AA Leiden, Netherlands — hosting and email;
• FormSubmit (United States) — only when individuals use the website contact form; not for raw session files.

The Processor imposes Article 28 GDPR terms on sub-processors. We inform the Client before adding or changing sub-processors; the Client may object within 14 days with reasons. Without an alternative we may be unable to provide the affected service.

8. Data subject rights

Requests from data subjects received by the Processor are forwarded promptly to the Client. The Processor assists the Client in responding, insofar as technically feasible and subject to reasonable cost for excessive requests.

General information for end clients is in our privacy policy; for individuals introduced by the Client, the Client’s policy applies first.

9. Personal data breaches

The Processor notifies the Client without undue delay after discovering a breach of security affecting personal data under our responsibility, with information to enable notification to the Autoriteit Persoonsgegevens and data subjects. We cooperate on investigation and mitigation.

10. DPIA and audit

The Processor assists the Client with a data protection impact assessment or prior consultation where mandatory, insofar as our role is concerned.

The Client may request one audit per calendar year by appointment, or an independent report, limited to processing under this Agreement. Audits must not unreasonably disrupt studio operations and are subject to confidentiality.

11. Transfers outside the EEA

We primarily process within the EEA via TransIP B.V.. FormSubmit may process data in the United States when the contact form is used. The Client acknowledges that transfer for website enquiries; session files remain in EEA storage unless otherwise agreed in writing.

12. Return and deletion

After the job we deliver agreed final files to the Client. Raw session files are deleted after 24 months unless extension is agreed in writing at the quoted rate. On the Client’s request we delete earlier, except where invoicing law requires retention.

13. Liability and governing law

Liability between the parties follows terms and conditions, without limiting mandatory GDPR provisions. Dutch law applies. Disputes go to the competent courts in Amsterdam, without prejudice to data subjects’ rights.

Questions or execution: contact, [email protected] or 020 244 8916. Version 15 October 2026.