In brief
- Applies when you supply personal data (talent, voices, guests) and we deliver the studio service.
- We process only on your documented instructions and our privacy policy.
- Subprocessors: host Hostnet B.V. and FormSubmit for website contact only, not session audio.
- After the job we return or delete data within 24 months unless agreed otherwise.
1. Parties and definitions
Controller (client): the organisation or freelancer that supplies personal data about performers, speakers or guests for work at Misfiredexa.
Processor: Misfiredexa B.V., Eerste Helmersstraat 78, 1054 DL Amsterdam, trade register 84964854, represented by Maarten van Dijk. Contact: [email protected], 020 261 8473.
Agreement: this document supplements terms and conditions and the quote for services such as voice-over, vocal recording, live recording, mixing or mastering. A signed written addendum prevails if it conflicts.
2. Subject matter and term
The processor handles personal data solely to deliver the agreed studio service: scheduling, recording, editing, mix, master, export and limited backup for 24 months after the last relevant session, unless the controller requests another period in writing subject to reasonable storage fees.
Processing lasts for the main contract and until archive and invoicing duties are complete. The controller’s own billing data as our customer is covered by our privacy policy where we act as controller.
3. Nature of data and data subjects
Typical categories: identification and contact details of talent, audio recordings (voice/performance), optional photo or video files the controller brings, and scheduling information. No special-category data unless the controller explicitly supplies it and has a lawful basis.
Data subjects may include vocalists, band members, voice-over artists, podcast guests or other performers you send to Eerste Helmersstraat 78. General booking rule: minimum age 16, with parental responsibility where required.
4. Instructions and confidentiality
The processor follows only documented instructions from the controller that fit the service. Implicit instructions in the quote and session plan count as written when confirmed by email.
Staff with access to recordings are bound by confidentiality. We do not use recordings for portfolio, marketing or AI training without written permission from the controller and, where needed, the data subject.
5. Security
The processor implements appropriate technical and organisational measures: HTTPS where relevant, restricted workstation access, physical access control in the studio, separated storage per project and deletion after the archive window. Details align with the security section of our privacy policy.
The controller delivers files through agreed channels (cloud, drive, session export) and warrants lawful processing.
6. Subprocessors
For session audio we do not use cloud subprocessors outside our direct storage unless agreed in writing (for example your enterprise storage).
For website and email we use Hostnet B.V.. The public form on contact uses FormSubmit (US); it does not touch session audio, only visitor messages. We notify the controller of subprocessor changes with reasonable time to object.
7. Data subject rights
Requests from data subjects received by us are forwarded to the controller within 2 business days unless law requires us to respond directly. We assist the controller technically within reason while files remain in the archive period.
8. Personal data breaches
If a breach affecting personal data occurs, we inform the controller without undue delay once aware, with available details so the controller can notify the supervisory authority and data subjects where required.
9. Audits and documentation
On request we provide information needed to demonstrate Article 28 GDPR compliance, limited to what is reasonable for a small studio. On-site audits only by appointment and without disrupting active sessions.
10. End of processing, return and deletion
After the job we deliver agreed masters/stems and delete remaining copies on our systems within 24 months, unless the controller buys extension or legal retention applies to invoice data about the order itself.
The controller may request earlier deletion in writing when no revision round remains open (up to 2 rounds where stated in the quote).
11. Acceptance
By accepting a quote referencing this page, or by separate signature, the controller agrees to this data processing agreement. Questions: contact or [email protected]. Related: cookie policy, legal notice, guides guides.