Data processing agreement

1. Parties and purpose

This agreement sits between the business client (the controller) and Labsterra B.V., Czaar Peterstraat 213, 1018 PL Amsterdam, the Netherlands, Chamber of Commerce 73172301 (the processor). It forms part of the job created by accepting a quote and the terms and conditions, and it prevails over those terms for personal data of third parties. Accepting the quote counts as accepting this text and the annexes.

It is meant for cases where the client asks us to process voice, performance or contact details of people they bring: singers, session players, podcast guests, voice talent. It does not cover data we collect ourselves in order to quote and invoice; that is in the privacy policy.

2. Terms

Personal data, processing, controller, processor, data subject and personal data breach have the meaning in Article 4 GDPR. Applicable rules are the GDPR and the Dutch GDPR Implementation Act. A sub-processor is any party we engage to process the client's data. Other words follow the terms and conditions.

3. Instructions and scope

We process only what the quote needs — Vocal recording, Mixing, Mastering, Band recording or Podcast recording — under this agreement and the client's written instructions, including transfers outside the European Union. If an instruction looks unlawful, we say so at once. We do not use other purposes, except where the law requires it; where the law allows, we warn the client first.

We do not sell the data, we do not use it for our own marketing and we do not put it into training sets for artificial intelligence. We do not build a voice clone without a specific written order from the client and permission from the person concerned.

4. Our duties

• The four team members who may touch a file (Lars van den Berg, Sophie Meijer, Noah El Amrani, Emma de Vries) are bound to confidentiality and know their tasks.
• We apply the technical and organisational measures of Article 32 GDPR, summarised in Annex B, taking account of the state of the art, cost, nature, scope, context, purposes and risks. Measures may change; they will not fall below Annex B.
• We help the client, as far as is reasonable, with data-subject requests and with security, notification, impact assessment and prior consultation (Articles 32 to 36 GDPR).
• We supply the information the client needs to show compliance with this agreement.

5. The client's duties

The client warrants a legal basis, informs the people concerned and obtains their permission where needed, including for exploiting a performance (neighbouring rights). They send only what the session needs and give instructions in writing (email is enough). Security on the client's side — links, drives, guest lists — remains theirs.

Simple help is included in the session rate. Heavy help (an on-site audit, detailed DPIA input, export in a special format) may be charged at a reasonable cost after a separate quote. Studio-hour rates, such as Band recording at €125 per hour including 21 percent VAT, sit on the services page; those sums are not a processing fee.

6. Sub-processors

The client gives general authorisation to use sub-processors. On the effective date we use one for hosting and mail:

We use FormSubmit only for the public contact form on labs24terra.click, not to send session files of your guests. We announce an addition or replacement at least 30 days ahead by email. The client may object in writing within 10 working days, on reasonable grounds. If the job cannot run without that party, the client may end the part concerned and we refund the unused part. Each sub-processor receives equivalent duties; we remain liable to the client.

We do not place the client's session files outside the European Economic Area. A future transfer would happen only after written notice and on a basis in Articles 45 to 49 GDPR.

7. Requests from data subjects

If a guest, singer or player contacts us directly about their data in your job, we forward the request and do not answer ourselves, unless you ask us to or the law requires it. At the client's request we rectify, erase, restrict or export the files concerned, as far as we still hold them within the 24-month archive window.

8. Checks

On request we supply reasonable information to show compliance. If that is not enough, the client may, at their own cost, audit only their own file, during Tue–Fri 10–20, Sat 11–18, with at least four weeks' notice — except after a proven incident — and without disrupting other sessions. The auditor signs a confidentiality undertaking. These arrangements organise the right to check; they do not reduce it to an empty line.

9. Personal data breach

When we become aware of a breach that touches the client's file, we notify without undue delay and at the latest within 48 hours, by email and by phone if we have a number. The notice describes, as far as known, the nature, the categories and an estimate of the number of people and files, the likely effects and the measures. We limit the effects where we can and we help the client with their duties toward the Dutch Data Protection Authority and the people concerned.

10. Cooperation and changes in the law

We tell the client about a request from a supervisor or a complaint that concerns them, unless the law forbids it. The parties cooperate if the Autoriteit Persoonsgegevens asks. If a change in the law requires this text or our measures to change, we propose that within a reasonable time; if we cannot agree, the client may end the part of the service that can no longer be lawful.

11. Liability

Liability under this agreement follows the terms and conditions, without prejudice to Articles 82 and 83 GDPR. We stand for sub-processors as for ourselves. The same loss is not paid twice. Payment term for business invoices: 14 days.

12. Term, return and deletion

This agreement runs for the job and for as long as we keep session files. By default we keep them 24 months after the last session, unless the client asks otherwise in writing. After that, or earlier on written request, we return the files in a common audio format or delete them, as the client chooses within 30 days after the job ends. Backup copies disappear in the rotation, no later than three months after the active set is deleted, unless a law requires longer retention.

Archive space is 48 TB on site; that is not endless cloud. Delivery and the client's own backup remain necessary. Two revision rounds (2) on a mix or master are a service rule, not an extra retention duty.

13. Final clauses

If one sentence falls away, the others stay and we replace the fallen sentence with the closest valid rule. Dutch law applies. The competent court follows the terms and conditions. The Dutch text prevails over this English translation. Effective date: 1 October 2026. Processor contact: Lars van den Berg — [email protected] — 020 244 18 06.

14. Annex A — Description of the processing

15. Annex B — Security measures

Questions about stems or rights among band members sit outside this annex; see exchanging stems and rights in a band recording.