Data processing agreement

1. Parties and definitions

This data processing agreement ("Agreement") is between the business client ("Controller") and Mordancyedge B.V., a private limited company (B.V.), Wibautstraat 137, 1091 GL Amsterdam ("Processor"), managing director Lars van den Berg.

Processor operates the Mordancyedge recording studio and delivers services such as vocal recording, mixing, podcast recording and related technical work. GDPR terms have the same meaning as in Regulation (EU) 2016/679.

2. Subject matter and term

Processor processes personal data only on behalf of Controller under the main contract (studio session, post-production or similar), as far as needed to perform it. Processing lasts for the main contract and afterwards only for archiving and legal duties as in our privacy policy (working files for 24 months after the last session unless agreed otherwise in writing).

Consumers who book directly with us are not covered by this Agreement; for them Mordancyedge B.V. is controller.

3. Nature and purpose of processing

Typical processing includes capturing voice or instruments of persons designated by Controller, storing multitrack files, basic editing, delivering mixes or masters to Controller, and communication about schedule and technical specs.

Data subjects may include presenters, podcast guests, voice talent, musicians and Controller's technical staff. Data categories: audio recordings, names, contact details if supplied by Controller, and session metadata.

4. Controller's instructions

Processor processes data only on documented instructions from Controller, including the main contract, written emails and oral directions during sessions that fit the assignment. Processor informs Controller if an instruction appears incompatible with the GDPR.

Controller ensures a legal basis for recording and processing (consent, contract, legitimate interest) and informs data subjects where required.

5. Confidentiality and staff

Processor ensures that team members and temporary staff with access to personal data respect confidentiality. Access is limited to what the assignment needs. Team roles are on about us.

6. Security

Processor implements appropriate technical and organisational measures, including physical access control in the studio, restricted IT access, encrypted connections for the website, and procedures for backup and deletion after retention periods. Details can be explained on request.

7. Sub-processors

Controller gives general authorisation to engage sub-processors essential to the service:

• TransIP B.V. — hosting and email;
• FormSubmit — only when Controller uses the web form on mordancyedge.digital for communication (US transfer; see privacy policy).

Processor informs Controller of sub-processor changes with reasonable time to object. Processor concludes Article 28 GDPR terms with each sub-processor.

8. Data subject rights

Processor assists Controller, as reasonably possible, with data subject requests (access, rectification, erasure, restriction, portability, objection). Requests sent directly to Processor are forwarded to Controller unless law requires Processor to respond.

9. Personal data breaches

Processor notifies Controller without undue delay after becoming aware of a breach relating to the assignment, with information needed to assess notification to the Dutch DPA and data subjects. Both parties cooperate to investigate and limit harm.

10. Audits, deletion and liability

Processor provides information on reasonable request demonstrating compliance with Article 28 GDPR. After the assignment ends, Processor deletes or returns personal data per instruction, except where law requires retention.

Liability between the parties follows the main contract and terms and conditions. This Agreement may be amended in writing. Questions: [email protected], contact. Version 14 October 2026.