Privacy policy
This English text is provided for convenience. The Dutch version is legally authoritative. Privacyverklaring
In brief
- We use your details to quote, run sessions and invoice — no ad profiling or data sales.
- Session files are kept up to 24 months after delivery unless your quote says otherwise.
- The contact form may route through FormSubmit (US); you can also email or call directly.
- Rights requests: [email protected] — supervisory authority: Dutch AP (Autoriteit Persoonsgegevens).
1. Controller
The controller for personal data processed through nephilimrivo.click and at our studio, Overtoom 289, 1054 SG Amsterdam, is:
Nephilimrivo B.V. (private limited company (B.V.)), trade register (KvK) 88138660, VAT NL862310040B01. Managing director: Charlotte de Vries. Contact: [email protected] or 020 244 8916.
We process data under the GDPR and the Dutch GDPR Implementation Act. We have not appointed a data protection officer. Company details are on legal notice.
2. Who this covers
This policy applies to website visitors, enquirers and clients who book recording or post-production: vocal recording, band recording, mixing, mastering and podcast recording.
When a business client brings guests, hosts or musicians, that client usually decides how their data is used. For those people we follow the client’s instructions and the data processing agreement; their privacy information should come from the client first.
3. Data we process
Contact and email: name, email, optional phone, requested service, optional date and project description. Required fields are needed to reply with a quote.
Booking and delivery: billing details, artist or band name, scheduling, correspondence, payment references. Card payments at the studio use our bank terminal; we do not store card numbers.
Recordings: voice and performance are personal data when you are identifiable. We use them only to perform the contract. If you film the session, you remain responsible for footage of others.
Technical: host TransIP B.V. keeps server logs (IP, time, page) for security. Your cookie choice is stored locally; see cookie policy.
We do not ask for special-category data. To reschedule for health reasons, say you are unavailable — no medical certificate is required.
4. Purposes, legal bases and retention
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Reply and quote | Form, email | Pre-contract steps / legitimate interest (Art. 6(1)(b) and (f)) | 3 years after last contact |
| Booking and performance | Contact, project, schedule | Contract (Art. 6(1)(b)) | 5 years after end of relationship |
| Session and raw files | Audio, project files | Contract | 24 months after final delivery, then deletion unless agreed otherwise |
| Invoicing | Identity, payments | Legal obligation (Art. 6(1)(c)) | 7 years (Dutch tax retention) |
| Complaint or dispute | Correspondence | Legitimate interest (Art. 6(1)(f)) | Duration of proceedings and appeals |
| Website security | Logs at TransIP B.V. | Legitimate interest / legal duty | Up to 12 months unless shorter at host |
| Cookie choice | Key nphl_consent_v1 in localStorage | Legal requirement (Dutch Telecommunications Act) | 182 days |
We do not sell or rent data. We do not send marketing newsletters. New purposes would require consent or a compatibility assessment.
5. Voice, image, minors and AI
We do not publish recording excerpts, session photos or your name on nephilimrivo.click or social media without prior written consent.
Client audio stays out of machine-learning datasets: no model training, benchmarking or synthetic voice recreation unless the performer signs a separate written release. Contract clauses appear in terms and conditions and disclaimer.
Minors book through a parent or guardian. Independent booking is from age 16. The contact form is not aimed at children under 16.
6. Recipients
Only team members who need access for their role can view your data. External recipients, for stated purposes only:
- TransIP B.V. (Vondellaan 47, 2332 AA Leiden, Netherlands), hosting for nephilimrivo.click and email, generally within the EEA;
- FormSubmit (formsubmit.co, United States), forwarding the contact form to [email protected];
- accountant, for billing data under professional duty;
- bank, for payments;
- authorities, when required by law.
Processors sign Article 28 GDPR terms. Business clients receive only files belonging to their project.
7. Transfers outside the EEA
Core studio and billing data is primarily hosted in the Netherlands with TransIP B.V.. FormSubmit processes form content in the United States. We rely on the GDPR exception for transfers needed for steps you request before a contract (Art. 49(1)(b)).
Prefer not to use the form? Email [email protected] or call 020 244 8916 instead — response times match contact enquiries. Technical notes are on legal notice.
8. Security
We apply appropriate measures: HTTPS, restricted access with individual accounts, strong passwords, encrypted workstations where feasible, locked premises outside sessions, and deletion of archive files after 24 months.
If a breach is likely to affect your rights, we notify the Autoriteit Persoonsgegevens and inform you when the GDPR requires it. No online transmission is completely risk-free; once received, we protect data within our means.
9. Your rights
You may request access, rectification, erasure, restriction, portability, object to processing based on legitimate interest, and withdraw consent where applicable. Contact [email protected] or write to Overtoom 289, 1054 SG Amsterdam.
We reply within one month; complex requests may be extended by two months with explanation. Requests are usually free; manifestly unfounded or excessive requests may be charged or refused under the GDPR.
You may lodge a complaint with the Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl. Many issues are resolved faster by contacting us — see FAQ.
10. Cookies
The public site does not run audience-measurement or ad trackers. We remember your banner answer in browser storage (key nphl_consent_v1) for 182 days. Full list and controls: cookie policy; reopen the banner via .
11. Third-party links
Route help may point to OpenStreetMap (OpenStreetMap). Once you leave nephilimrivo.click, the operator of that service decides how data is handled — read their notice before sharing location or account details.
12. Version and changes
This policy is informational and does not limit your statutory rights. Effective: 15 October 2026; last updated: 15 October 2026. Material changes are published here and, where appropriate, emailed to active clients.
Related: terms and conditions, data processing agreement, accessibility statement, contact.