Data processing agreement

1. Parties

This data processing agreement («Agreement») is between:

• Controller: the client instructing Natickpixelhub where personal data of third parties is processed, for example podcast guests, voice-over artists, singers or rappers who are not party to the contract.
• Processor: Natickpixelhub B.V., Kinkerstraat 312, 1053 ES Amsterdam, trade register 61382792, represented by Thijs Bakker.

GDPR terms have the same meaning. The Agreement supplements our terms and conditions and service pages such as podcast recording or vocal recording.

2. Subject and duration

The Processor processes personal data only to perform agreed studio and post-production services: recording, editing, mixing, mastering and file delivery. Duration runs from the first session date until 18 months after the last delivery, unless the Controller requests earlier deletion in writing or a longer archive period is agreed.

3. Data and processing operations

Data subjects: guests, hosts, voice actors, singers, rappers or others whose voice is recorded.

Categories: audio recordings, names, contact details supplied by the Controller, scheduling, scripts or rider information.

Special categories: not intended; the Controller instructs the Processor not to collect sensitive data unless strictly necessary with an appropriate legal basis.

Operations: capture, storage, backup, technical editing, transfer via agreed channel, deletion after the retention period.

4. Instructions and confidentiality

The Processor follows only documented instructions from the Controller. Standard workflow follows the quote and terms and conditions; deviations in writing via [email protected]. If the Processor believes an instruction violates the GDPR, it will say so promptly.

Persons with access under the Processor’s authority are bound by confidentiality or statutory secrecy.

5. Security and sub-processors

The Processor applies appropriate technical and organisational measures: team-only access, encrypted storage where feasible, physical access control during Mon–Fri 9:30–18:30, Sat 12–16 (by appointment) and notification of incidents to the Controller within 72 hours when data subjects are likely at risk.

Permitted sub-processors:

• TransIP B.V. — hosting and email within the EU/EEA;
• EU/EEA storage for session files the Processor uses, after written notice.

FormSubmit (US) is not used for session or guest data, only for the public contact form on natickpixelhub.digital. New sub-processors are notified at least 2 business days in advance; the Controller may object with reasons.

6. Data subject rights and audits

The Processor assists the Controller with data subject requests within a reasonable time. Requests sent directly to the Processor are forwarded to the Controller unless the Processor must act under law.

The Processor provides information needed to demonstrate GDPR Article 28 compliance. On-site audits by appointment, at most once per year, during office hours, subject to reasonable confidentiality.

7. Transfers, termination and liability

Transfers outside the EEA occur only on the Controller’s instruction with appropriate safeguards (standard contractual clauses, adequacy decision or GDPR Article 49).

After termination the Processor deletes personal data or returns it to the Controller, except where tax retention (7 years) applies. The Processor can demonstrate deletion on request.

Liability follows the terms and conditions; this Agreement does not create guarantees beyond the law.

8. Contact

Activate this Agreement via contact, [email protected] or 020 245 8317. State «data processing agreement» and your company name.

Version 15 October 2026, updated 15 October 2026. See also privacy policy and legal notice.