Data Processing Agreement

⬇ Download as PDF

Version 1.0 — April 2, 2026

1. Parties

• Controller: the Customer who has entered into a license agreement with VoxCloud ("Customer")
• Processor: VoxCloud, located at Woestduinstraat 145-1, Amsterdam, KvK 56765789 ("VoxCloud")

2. Purpose and scope

VoxCloud processes personal data solely for the purpose of:

• License validation and volume monitoring via the license server
• Providing technical support via the customer portal and email
• Sending license-related notifications (expiry, renewal)

The categories of personal data processed are described in the privacy policy, section 2.

2.1 Categories of data subjects

• Contact persons and administrators of the Customer
• Employees of the Customer who submit support requests

2.2 Categories of personal data

• Name, email address, phone number of contact persons
• Company name and address details
• Content of support tickets and messages
• Instance identification (SHA-256 hash, no direct personal data)

3. Obligations of VoxCloud

1. Instructions: VoxCloud processes personal data solely on the basis of documented instructions from the Customer, unless a legal obligation requires otherwise. In that case, VoxCloud will inform the Customer in advance, unless legally prohibited.
2. Confidentiality: All persons with access to personal data are bound by confidentiality.
3. Security: VoxCloud takes appropriate technical and organizational measures to protect personal data, as described in the privacy policy, section 5. This includes:
   • Encrypted connections (HTTPS/TLS)
   • Hashing of passwords (bcrypt) and API keys (SHA-256)
   • Access restriction via SSH keys
   • Rate limiting and security headers
4. Sub-processors: VoxCloud uses the following sub-processors:

   Sub-processor	Location	Purpose
   MijnHost	Netherlands	Hosting of the license server
   Soverin.nl	Netherlands	Sending email notifications

   VoxCloud will notify the Customer in writing at least 30 days in advance when engaging a new sub-processor. The Customer may object within 14 days of notification.

5. Assistance: VoxCloud assists the Customer with:
   • Fulfilling data subject requests (access, rectification, erasure, etc.)
   • Conducting a Data Protection Impact Assessment (DPIA), if necessary
   • Consultation with the Dutch Data Protection Authority, if required
6. Data breach notification: VoxCloud will notify the Customer of a data breach as soon as possible and in any case within 48 hours of discovery. The notification will include at least:
   • The nature of the data breach
   • The categories and estimated number of data subjects affected
   • The likely consequences
   • The measures taken to address the breach
7. Deletion: After termination of the agreement, VoxCloud will delete all personal data within 90 days, unless a legal retention obligation applies. At the Customer's request, VoxCloud will provide a copy of the data in a common format before deletion.

4. Rights of the Customer

1. The Customer has the right to conduct or have conducted audits to verify compliance with this Data Processing Agreement. VoxCloud will cooperate on reasonable terms and with reasonable advance notice.
2. The Customer may at any time provide written instructions regarding the processing of personal data.

5. Transfers outside the EEA

VoxCloud does not process personal data outside the European Economic Area (EEA). All sub-processors are located in the Netherlands. Should transfer outside the EEA become necessary in the future, VoxCloud will implement appropriate safeguards in accordance with Chapter V of the GDPR and inform the Customer in advance.

6. Duration

This Data Processing Agreement is effective for the duration of the license agreement between VoxCloud and the Customer, and terminates automatically upon its termination, without prejudice to the obligations under article 3.7 (deletion).

7. Governing law

This Data Processing Agreement is governed by Dutch law. Disputes shall be submitted to the competent court in Amsterdam.