Skip to content
Prozoneova

Data processing agreement

Last updated : 16 October 2026

This English text is for convenience. The Dutch version is legally authoritative. Verwerkersovereenkomst

In short

  • Applies when we process personal data only on your documented instructions.
  • Typical for label, podcast or agency jobs involving guests or session musicians.
  • Security, sub-processors and breach notification are contractually defined.
  • Request a signed copy via contact before the first session.

1. Parties and definitions

This data processing agreement ("Agreement") is between:

  • Controller ("Client"): the business customer hiring Prozoneova for recording, mixing, mastering or podcast work;
  • Processor: Prozoneova B.V., Transformatorweg 7, 1014 AA Amsterdam, trade register 91986385, represented by Maarten Jansen.

GDPR terms have the same meaning as in Regulation (EU) 2016/679. "Personal data" includes voice recordings, names and contact details of artists, hosts and guests. Our privacy policy describes processing when we are controller.

2. Subject matter and term

The Processor processes personal data solely to deliver services under the order or terms and conditions, such as vocal recording, live recording, mixing, mastering or podcast recording.

Processing lasts for the main contract and afterwards only as needed for archive, invoicing or legal retention. Working files are deleted after 18 months from the last session unless Client instructs a different compatible period in writing.

3. Nature of processing

Activities may include: studio recording, temporary storage on secured drives, basic editing, exporting stems or masters to Client, and limited communication with data subjects when Client instructs.

We do not use recordings for our own marketing, publication or AI model training. Any publication beyond the order requires Client instruction and lawful basis; see podcast guest rights guide.

4. Data subjects and categories

Data subjects: artists, band members, podcast guests, hosts and other session participants Client introduces.

Categories: identity, contact details, voice and instrument recordings, session notes, and footage Client brings. We do not process special-category data unless Client explicitly instructs with an appropriate basis.

5. Client instructions

The Processor acts only on documented Client instructions, including booking emails, technical riders and export formats. If an instruction appears unlawful under the GDPR, we notify Client before executing it.

Client ensures a lawful basis to share data with us and that data subjects are informed where required. For podcast guests, see our guide.

6. Processor obligations

The Processor shall:

  • keep data confidential and limit team access to need-to-know;
  • apply appropriate technical and organisational measures (HTTPS, access control, locked premises, encryption where feasible);
  • assist Client with data-subject requests as reasonably possible, aiming within 3 business days where feasible;
  • notify Client of personal data breaches without undue delay so Client can notify the supervisory authority;
  • delete or return data after the order ends, subject to legal retention.

Further security detail: privacy policy.

7. Sub-processors

Client authorises these sub-processors while they process data only for our mandate:

  • TransIP B.V. (website and mail infrastructure);
  • FormSubmit (contact form relay, US — see privacy policy).

We inform Client before adding a new sub-processor that touches session personal data; Client may object within 14 days with reasons. Sub-processors sign Article 28 GDPR terms.

8. Transfers outside the EEA

We primarily process in the Netherlands. Transfer to the United States via FormSubmit mainly concerns Client’s own contact-form data, not raw session files. Session files stay on our EU systems unless Client requests export to Client’s cloud; Client then instructs that transfer.

9. Audits and information

Client may once per calendar year, by appointment and without disrupting sessions, request reasonable documentation on compliance. Confidentiality of other clients remains protected. We can complete a standard security questionnaire when proportionate.

10. Liability and precedence

If this Agreement conflicts with terms and conditions on personal data, this Agreement prevails. Liability follows the main contract and Dutch law.

Service rates are published on the site (for example €920 for a live day); 21% VAT is included where stated.

11. Contact and execution

For a signed copy or questions: contact, [email protected] or 020 737 4829. Address: Transformatorweg 7, 1014 AA Amsterdam.

Template published 16 October 2026. We notify active business clients in writing of material changes.