Privacy policy
This English text is for convenience. The Dutch version is legally authoritative. Privacyverklaring
In brief
- Most processing comes from messages you send and files we create during booked studio time.
- Marketing trackers are off; we do not monetise contact lists or use takes for machine-learning products.
- Project media stays on our systems for 12 months after the final session unless you agree otherwise.
- Reach us at [email protected]; expect a first reply within roughly 2 working days.
1. Controller identity
The controller is Obligerpath B.V., trading as Obligerpath, a private limited company (B.V.) at Overtoom 141, 1054 HG Amsterdam. Chamber of Commerce 92455685, VAT number NL887198909B01. Managing director: Sanne de Vries.
Personal data are processed through obligerpath.digital, email, phone and on-site work for vocal recording, mixing, mastering, podcast recording, band recording and related administration. Processing follows Regulation (EU) 2016/679 and the Dutch GDPR Implementation Act.
No data protection officer is appointed for this organisation. Questions go to [email protected] or 020 737 0842. Registration details: legal notice.
2. Who this notice covers
Visitors browsing the site, senders of contact messages and artists or producers attending sessions at our Amsterdam rooms are in scope. The notice explains categories processed, why we use them and the controls available to you.
If a company hires us to capture third parties — guests on a podcast, session musicians for a label — that company remains controller towards those individuals. Our role is then processor-only; terms are in the data processing agreement.
3. Categories of information
Enquiries: identity and reachability (name, email, optional phone), service selection, optional date preference and free-text project notes. Mandatory items are the minimum to scope time and gear.
Commercial relationship: invoicing identity, band or project name, threaded email or call notes, bank transfer metadata. In-studio card payments are handled on the acquirer terminal; PAN data never enter our CRM.
Creative captures: audio (and incidental video you bring) may identify performers. Usage stays within the production brief you approve. Self-shot video in the live room remains your compliance duty.
Infrastructure: TransIP B.V. may log IP, timestamp and URL for abuse prevention. Consent state for cookies lives client-side; see cookie policy.
We do not solicit health, belief or biometric templates. Rescheduling for personal reasons needs no clinical paperwork.
4. Purposes, bases and storage limits
| Activity | Typical fields | Basis | Storage cap |
|---|---|---|---|
| Answering leads | Form payload, mail threads | Legitimate interest; steps before contract | 36 months from last touch |
| Delivering booked time | Schedule, creative notes | Contract | 60 months after relationship ends |
| Multitracks and masters | WAV/STEM archives | Contract | 12 months post last take, then wipe |
| Tax records | Invoice lines, payer ID | Statutory bookkeeping | 84 months |
| Claims | Case file exports | Legitimate interest defence | Until limitation expires |
| Edge security | Host diagnostics | Legitimate interest | Short rolling window at provider |
| Banner memory | oblg_consent_v1 flag set | Telecom/cookie rules | 182 days |
Lists are not licensed to brokers. Bulk promotional email is absent unless you separately opt in.
5. Performers, likeness and age limits
Audio likeness receives confidentiality comparable to other identifiers. We refrain from promotional clips, behind-the-scenes galleries or name-drops on obligerpath.digital unless you sign a release.
Material recorded here is excluded from synthetic voice modelling, classifier training or similar automated refinement unless a dedicated written waiver exists.
Participants below 16 require a guardian to contract and sign attendance sheets. The public site is not designed as a child-facing platform.
6. Disclosures to processors
Internal visibility is limited to staff on shift (capacity up to 6 people in the building; 2 acoustic spaces). External parties may receive data only as needed:
- TransIP B.V. — publication stack and mailboxes, facilities in the EEA;
- FormSubmit relay (formsubmit.co) — transient routing of HTML form posts;
- Chartered accountant — ledger entries under professional privilege;
- Bank — settlement of invoices;
- Public authorities — lawful demand only.
Each vendor processing on our instruction signs Article 28 terms.
7. Cross-border flows
Primary storage sits with TransIP B.V. in the Netherlands. FormSubmit processing may occur in the United States; submitting the web form triggers that hop. We document safeguards or rely on the necessity of handling your outbound project request.
Prefer a path without US intermediaries? Write [email protected] or dial 020 737 0842 — we log the thread manually with the same SLA.
8. Integrity and confidentiality
Controls include TLS everywhere, role-based credentials, physical locks when rooms are idle, disk encryption on engineer laptops where supported, and scheduled purges once 12-month media retention ends. Absolute security online is unattainable; after intake we apply studio-grade handling.
Incidents likely to harm individuals are reported to the Autoriteit Persoonsgegevens and, when severity warrants, to affected clients directly.
9. Individual rights
Under the GDPR you may request access, correction, deletion, limitation, portability, object to certain processing or withdraw consent without retroactive invalidity. Address [email protected] or post to Overtoom 141, 1054 HG Amsterdam. Standard deadline: one month, extendable to three with notice.
Unresolved concerns can be escalated to the Dutch supervisory body at autoriteitpersoonsgegevens.nl. Practical issues are usually settled faster when you loop in our coordinator first.
Operational policies: terms and conditions, FAQ, guides hub.
10. Cookies and local storage
Measurement or ad networks are not loaded. The banner writes oblg_consent_v1 for 182 days. Full breakdown: cookie policy; reopen choices via .
11. Third-party sites
Outbound references (maps, app stores) operate under separate policies; we do not control their cookies or retention.
12. Version history
Effective date 7 October 2026; document refreshed 7 October 2026. We publish amendments here; substantive shifts may trigger email to active clients. Pricing references include 21% VAT — see services. Direct line: Obligerpath B.V., [email protected].