Data processing agreement

1. Parties and definitions

Controller (client): the person or company that hires Olivevanta and decides why personal data of participants (podcast guests, voice talent, band members, etc.) is processed.

Processor: Olivevanta B.V., Sarphatistraat 72, 1018 GE Amsterdam, KvK 88503974, represented by Femke Jansen. We provide recording, editing, mixing, mastering, and related studio services.

Agreement: this DPA supplements the terms and conditions and any project quote. If they conflict on personal data, this annex prevails.

2. Subject matter and term

The processor handles personal data only on the controller’s instructions for the project duration, and afterwards only as needed for archive, invoicing, or legal retention. Typical data: names, contact details, audio or video recordings, session notes.

Working files are kept for 18 months after the last relevant session unless a different period is agreed in writing. We then delete or anonymise copies at the processor, except rotating backups.

3. Nature and purpose

Processing includes capture, editing, mixing, mastering, export, and transfer of files to the controller through agreed channels. We do not use the data for our own marketing, profiling, or AI training. Nothing is published on olivevanta.click without separate written approval from the controller and, where needed, data subjects.

Services and rates (VAT 21%) are on services, e.g. podcast recording from €245 or vocal sessions from €98.

4. Categories of data subjects and data

Typical data subjects: hosts, guests, musicians, voice-over artists, and the controller’s staff present in the studio.

Typical categories: identification and contact details, audiovisual recordings, technical metadata (timecode, track lists), and project communication. We do not intentionally process special categories; tell us if content might include them so we can align safeguards.

5. Instructions and compliance

The processor follows written or electronic instructions from the controller that comply with the GDPR. Verbal directions during a session are confirmed by email when they differ from standard practice. The processor will inform the controller if an instruction appears unlawful.

We assist the controller, within reasonable limits, with data subject requests and impact assessments when the project requires it.

6. Confidentiality and security

Staff under the processor’s authority are bound by confidentiality. We apply appropriate technical and organisational measures: access control, encryption where sensible, studio access by appointment, and hosting logs via TransIP B.V..

More detail is in the privacy policy. On a personal data breach we notify the controller without undue delay with facts needed for AP notification and data subject communication.

7. Sub-processors

The controller gives general authorisation for:

• TransIP B.V., Vondellaan 47, 2332 AA Leiden, Nederland, hosting and email;
• FormSubmit (United States), only when the contact form channel is used;
• accountant and bank, limited to administrative data.

We notify new sub-processors at least 14 days before use; the controller may object with reasons. Sub-processors are contractually bound to at least the same obligations as this DPA.

8. Transfers outside the EEA

Processing is mainly in the EEA. Transfers to the United States via FormSubmit may occur when the contact form is used. The controller remains responsible for a valid legal basis towards data subjects; we provide chain information.

Delivery to the controller’s cloud services follows the controller’s instructions; use encrypted channels where possible.

9. Data subject rights and audit

Requests from data subjects are forwarded to the controller unless law requires us to respond directly. We provide technical assistance within 2 working days after a written request.

The controller may ask audit questions or appoint an independent auditor once per year by appointment, provided other clients’ confidentiality is protected. Extensive audits may be charged by mutual agreement.

10. End of processing

After the job, the processor deletes personal data within 18 months unless the controller requests export earlier or tax law requires invoices for 7 years. Standard deliverables (WAV, stems, notes) follow the quote.

The controller remains responsible for lawful processing of copies it holds.

11. Liability and governing law

Liability between the parties follows the terms and conditions, subject to mandatory law. Dutch law applies. Disputes go to the competent court in Amsterdam, without prejudice to non-waivable consumer rights.

Activate by stating at booking that you act as controller, or email [email protected] with company name, KvK/VAT, and project scope. Published 7 October 2026.