Privacy policy

01 Who is responsible

Variatesystems B.V., located at Wibautstraat 164, 1091 GR Amsterdam, registered with the Dutch Chamber of Commerce (KvK) under number 88433815, is the controller of the personal data collected through this website and in our dealings with the studio. The managing director is Sanne de Vries.

We have not appointed a data protection officer, as a small recording studio is not required to. Privacy questions can go straight to us via [email protected] or 020 846 3172. To find out more about the team, see about us. This English text is provided for information; the Dutch version is legally authoritative.

02 Who this policy covers

It applies to visitors of this website, to anyone who sends us a question or a request for a quote, and to clients booking vocal recording, band recording, mixing or mastering.

When we record voices or musicians on behalf of a business, such as an advertising agency or a podcast production, that business decides what happens to the recordings. We then act as a processor and our data processing agreement applies.

03 What data we handle

• Contact form: name, email address, phone number (optional), the service you are interested in, a preferred date (optional) and your message.
• Booking and invoicing: name or artist name, billing address, and for business clients the company name, KvK and VAT numbers, plus payment details for the deposit and the final invoice.
• Session: the audio recordings themselves, session files, engineer notes and agreements on revisions.
• Age: we ask you to confirm you are at least 16; younger musicians book through a parent or guardian.
• Technical: our hosting provider's server logs IP address, time and requested page.

We do not ask for special categories of data such as health or religion. A recorded voice is personal data, but we do not use it to identify anyone biometrically.

04 Why we use it and on what legal basis

We send no newsletter and build no profiles. We only use an excerpt of your recording as an example on the site or on social media if you give prior written consent, which you can withdraw at any time.

05 The contact form and transfer to the United States

The form on our contact page is processed by FormSubmit, a service operating from the United States, outside the European Economic Area. FormSubmit receives the fields you fill in and forwards them to us by email. Transfers outside the EEA require appropriate safeguards; we rely on the European Commission's standard contractual clauses and keep the form limited to what we need to reply.

If you would rather your details did not pass through a US service, email [email protected] directly or call 020 846 3172. Your request is handled in exactly the same way.

06 Who else sees your data

Inside the studio, only the people working on your project have access: the recording engineer, the mix engineer and the mastering engineer who also handles scheduling. We also work with:

• TransIP B.V. in Leiden, hosting the website and email within the EU;
• FormSubmit, forwarding form messages (see above);
• our accountant and bank, for invoices and payments;
• a file transfer service when we deliver large audio files, reachable only through the link we send you.

We have GDPR-compliant agreements with our processors. We do not sell data or share it with advertisers, and we only hand it to a public authority when the law requires us to.

07 How long we keep data

• Messages that do not lead to a booking: up to 12 months after the last contact.
• Recordings, session files and mixes: 12 months after your last session, so you can come back for an extra revision or a new master. After that we delete them unless you ask us to keep them longer.
• Invoices and related records: seven years, under Dutch tax record-keeping rules.
• Server logs at the host: a few weeks, for security.
• Your cookie choice: 182 days in your own browser; see the cookie policy.

Keep your own copy of the final files as soon as we deliver them; once the retention period ends we cannot recover them.

08 Security

The website uses an encrypted connection (HTTPS). Project files sit on studio computers and backup drives that are not publicly reachable, and the studio is locked outside booked sessions. Download links for your files expire after a limited time. Staff accounts use strong passwords and, where available, two-step verification.

If something does go wrong with personal data, we assess it straight away, report it to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) within 72 hours where required, and inform you if the risk to you is high.

09 Your rights

Under the GDPR you may:

• see your data and receive a copy;
• have inaccurate data corrected;
• have data erased when there is no longer a reason to keep it;
• have processing restricted;
• object to processing based on legitimate interest;
• take data you supplied with you in a common format;
• withdraw consent, without affecting processing that took place before.

Send your request to [email protected]. We may ask you to confirm your identity, but we never ask for a passport copy showing your citizen service number. We reply within one month; for complex requests this can be extended by two months, in which case we tell you.

10 Complaints

If you are unhappy with how we treat your data, tell us first; most issues are solved quickly that way. You can always lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens: autoriteitpersoonsgegevens.nl.

11 Changes

When we change how we work or which providers we use, we update this policy and the date at the top of the page. This version applies from 5 October 2026. Session conditions are in our terms and conditions; company details are in the legal notice.