Data processing agreement

1. Parties and definitions

Controller: you, the client who decides why and which personal data are processed in a recording project.

Processor: Obligerpath B.V., Overtoom 141, 1054 HG Amsterdam, trade register 92455685, contact [email protected], represented by Sanne de Vries.

Agreement: this data processing agreement, the booking confirmation or studio contract, and any annexes on deliverables. If they conflict, this agreement prevails for personal data processing.

2. Subject matter and duration

The processor processes personal data solely to deliver studio services you order, such as podcast recording, band recording, vocal recording, mixing or mastering, including scheduling, recording, basic edit prep and file handover.

Processing runs from your order until deletion or return of data after the retention period, unless the controller must keep data longer by law.

3. Nature of data and data subjects

Typical data: name, contact details, voice and image recordings, production role, studio attendance dates and session metadata. Data subjects may include hosts, musicians, speakers, crew or your customers.

The processor does not process special-category data unless you instruct this explicitly and a valid legal basis exists; you must document that obligation.

4. Instructions and compliance

The processor follows only documented instructions from the controller, including reasonable verbal directions during sessions within the project scope. If an instruction appears unlawful under the GDPR, the processor will say so before acting.

The processor implements appropriate technical and organisational measures under GDPR Article 32, including access control, HTTPS for transfers and physical security of the studio outside booked hours.

5. Confidentiality and staff

Anyone acting under the processor’s authority is bound by confidentiality or statutory secrecy. Access is limited to what the order requires; the core team is described on about us.

6. Subprocessors

The controller gives general written authorisation for subprocessors. Current subprocessors:

• TransIP B.V. — hosting obligerpath.digital and email, data in the Netherlands/EEA;
• FormSubmit — only when the controller uses the contact form for project communication; US transfer with safeguards as in privacy policy transfers.

The processor informs about subprocessor changes; the controller may object within a reasonable time to material changes.

7. Data subject rights

Requests from data subjects received by the processor are forwarded to the controller without undue delay. The processor provides reasonable assistance in responding, given the nature of processing.

8. Retention and return

Session files and raw recordings are kept for 12 months after the last session of the project, consistent with our privacy policy. We then delete copies on our systems unless you request a different term or handover in writing.

After the order ends, we deliver agreed exports in common formats on request; extra media costs may apply under terms and conditions.

9. Audits and documentation

On request, the processor provides reasonable information about Article 28 GDPR compliance. Controller audits are possible by appointment, at most once per calendar year, without disproportionately disrupting operations.

10. Personal data breaches

If a security incident affects personal data, the processor notifies the controller without undue delay once aware, with information needed for any report to the Dutch Data Protection Authority.

11. Liability and closing

Liability between the parties follows the studio contract and terms and conditions, as far as mandatory law allows.

This text is a template for business orders; individual projects may need annexes (guest lists, embargoes). Questions: contact or [email protected]. Effective 7 October 2026; version 7 October 2026.