Data processing agreement

1. Parties and definitions

This data processing agreement («Agreement») forms part of the service between the client («Controller») and Monoxyleorix B.V., Grote Bickersstraat 74, 1013 KS Amsterdam, KvK 91760683 («Processor», trading as Monoxyleorix).

«Personal data», «data subject», «processing» and «sub-processor» have GDPR meanings. «Service» means studio recording, editing, mixing, mastering or related work such as podcast and audiobook where Processor handles data about guests, hosts or narrators on Controller’s instructions.

2. Subject matter and term

Processor processes Personal Data only for the Service and for the agreement term plus the retention period in Article 5. Controller determines purposes and means for that data; Processor follows written or electronic instructions consistent with the Service.

Typical cases: podcast production for a publisher, audiobook chapters for a label, voice work for an agency. Private artists acting for themselves are usually Controller; this Agreement does not apply unless confirmed in writing.

3. Nature of processing

Categories of data subjects: hosts, narrators, guests, musicians or other participants Controller sends to the studio.

Categories of data: voice recordings, names and contact details Controller provides, scheduling, biographical facts needed for the session, and technical metadata of audio files.

Special categories: not intended; Processor does not handle them unless Controller explicitly instructs with a valid legal basis.

Processing operations: recording, storing, backup copying, basic editing, export as instructed, and deletion after the retention period.

4. Processor obligations

Processor shall:

• process only on documented instructions from Controller, except where EU or member state law requires otherwise;
• ensure personnel respect confidentiality;
• implement appropriate technical and organisational measures (HTTPS, access control, physical studio security);
• assist Controller with data subject requests within reasonable time;
• notify Controller of personal data breaches without undue delay;
• delete or return data after the Service ends, except legal retention;
• make information available for Controller audits, at most once per year by appointment.

Processor does not use recordings for AI training or marketing, per privacy policy.

5. Sub-processors

Controller gives general written authorisation for sub-processors. Current categories:

• TransIP B.V. — hosting and email within the EEA;
• FormSubmit — only when Controller uses the web form for instructions (US transfer, see privacy policy).

Processor informs Controller of sub-processor changes; Controller may object within 14 days with reasons. Sub-processors are bound at least to the same obligations as this Agreement.

6. Transfers outside the EEA

Primary storage of session files stays within the EEA. FormSubmit transfer follows only the contact form path. For other transfers the parties add safeguards (e.g. EU standard contractual clauses) if needed.

7. Retention and return

Unless agreed otherwise in writing, Processor keeps working files for at most 24 months after completion of the Service, then deletes or anonymises. Controller receives agreed deliverables via the chosen medium; Processor keeps no commercial copy without consent.

On request within that period Processor supplies export in a common audio format; reasonable extra hours are quoted upfront per rates.

8. Liability and precedence

If this Agreement conflicts with terms and conditions on Personal Data processing, this Agreement prevails. Other liability follows the main contract.

Operational contact: [email protected], 020 244 8916. Model text effective 14 October 2026; last updated 14 October 2026. Business clients may accept by email confirmation with the booking.