Privacy policy
This English text is for information only. The Dutch version is legally authoritative. Privacyverklaring
In short
- We keep what we need to answer you, schedule a session and deliver the work.
- No newsletters, no ad networks and no sale of personal data.
- Working sessions are deleted 24 months after the last recording day, unless the law requires a longer file.
- Voice and session files are not sent to systems that clone voices or train models.
- Questions or requests: [email protected] or 020 244 1836, during Tue–Fri 10–20, Sat 11–18.
1. Who processes this data
The controller is Claviforge B.V., a private limited company (B.V.) at Danzigerkade 78, 1013 AP Amsterdam (Amsterdam-Noord). Chamber of Commerce number 85363453. VAT number NL879466819B01. Day-to-day management: Maarten de Vries.
This notice covers personal data we process through claviforge.click, the contact form, email, phone and studio appointments. Dutch law and Regulation (EU) 2016/679 apply. The Dutch text is authoritative; this English page is for information.
Appointing a data-protection officer is not required for a studio of our size and activity. For privacy questions write to [email protected] or call 020 244 1836. Studio hours: Tuesday–Friday 10:00–20:00, Saturday 11:00–18:00. Closed Sunday and Monday. How to reach us: From Amsterdam Centraal, take metro line 52 (North/South) towards Noord and get off at Noorderpark. Walk about 8 minutes west along Danzigerkade; the studio is at number 78 on the waterfront. By bike from Centraal it is roughly 15 minutes via the IJ Tunnel.
2. Who this notice covers
It covers site visitors, people who ask for a quote, and clients of Vocal and instrument recording, Mixing, Podcast recording, Mastering or Rehearsal room.
When a production company, label or publisher books a session in which other people sing, speak or play, that client decides how those recordings are used afterwards. We then act as a processor. The terms for that role are in the data processing agreement. Guests of that client should read the client’s own privacy information; our contact page remains available for practical questions about the session itself.
3. Data we collect
Through the form. First and last name, email address, phone number (if you add one), the service you want, a preferred date and a short project note. Required fields are needed so we can reply; without a name and email we do not prepare a quote. The form is forwarded by FormSubmit to [email protected]. That transfer is explained in article 7.
At booking and during the work. Billing details, artist or band name, the schedule, email or phone exchanges, and payment references on a transfer. Site rates, such as €95 per hour of Vocal and instrument recording or €295 per podcast episode, include 21 % VAT; the invoice carries the client’s name, address and VAT number.
Recordings. Voice, a musical performance and, if you send them, existing stems or session files are personal data when a person can be recognised. We use them to deliver the booked service. If your own team films in the live room or the booths, that footage is your responsibility.
Technical data. TransIP B.V. (Vondellaan 47, 2332 AA Leiden, the Netherlands) keeps connection logs (IP address, time, page requested, browser) to secure the site. Your tracker choice sits in your browser’s local storage under clvf_consent_v1 and holds no name or email.
We do not ask for special-category data. If a session has to move for health reasons, it is enough to say you cannot attend; a medical certificate is not required.
4. Purposes, legal bases and retention
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Answer an enquiry and draft a quote | Form fields and messages | Steps before a contract, started by you (Art. 6(1)(b)) | Three years after the last exchange |
| Reserve, run and close out the booked work | Name, contact, project notes, diary | Performing the contract (Art. 6(1)(b)) | Five years after the relationship ends (limitation of contractual claims, Art. 3:307 Dutch Civil Code) |
| Hold working sessions and delivery files | Recordings, stems, mix and master files | Performing the contract (Art. 6(1)(b)) | 24 months after the last session day, then deletion, unless you ask in writing for a longer copy |
| Raise invoices and keep the books | Name, invoice, payment, VAT | A duty in statute (Art. 6(1)(c)) | Seven years (Art. 52 of the General State Taxes Act and Art. 2:10 Dutch Civil Code) |
| Handle a complaint or dispute | Letters and case papers | A real interest in defending our position (Art. 6(1)(f)) | Length of the proceedings and appeal windows |
| Keep the website safe | Connection logs at the host | A real interest and, where logging is required, a duty in statute (Art. 6(1)(f) and (c)) | As short as the host needs for security, in practice no more than twelve months |
| Remember your tracker choice | Key clvf_consent_v1 in the browser | Cookie-consent duty in Dutch telecom law (Art. 11.7a Telecommunications Act) | 182 days |
Personal data is not sold and not hired out. We do not send marketing mail. A deposit of 30 % and the cancellation window of 7 days (see the terms and conditions) only create payment and planning records, not extra profiles.
When we rely on a real interest we check that the aim exists, that the processing is needed and that your interests do not outweigh it. You can ask for a short account of that test and object to it.
5. Voice, image, minors and automation
Your voice and, if it is captured, your image are protected by the GDPR and by portrait rights in the Dutch Copyright Act. We do not put a session excerpt, a studio photo of you or your name on the site or on social media without your prior written consent.
We do not use clients’ recordings to train, test or improve artificial-intelligence systems. We do not build a voice clone or a synthetic voice without a specific written instruction from the person concerned.
Sessions for anyone under 16 are booked by a legal guardian, who supplies the details we need. That age matches Article 5 of the Dutch GDPR Implementation Act on consent for information-society services. The contact form is meant for adults or for that guardian, not as a service aimed at children. The live room and the two isolation booths also have a cap of 6 guests; that is a safety and workflow rule, not an extra data collection.
6. Who can see the data
The three people on the team have access, each for their own work: Maarten de Vries (owner and studio manager), Fleur Bakker (recording engineer for vocals and live) and Jonas Meijer (mix and mastering engineer). The following recipients may also see data, only for the purpose that requires it:
- TransIP B.V., Vondellaan 47, 2332 AA Leiden, the Netherlands, host of the website, transip.nl, with data centres in the Netherlands;
- FormSubmit (formsubmit.co), which forwards the contact form to our mailbox;
- our bookkeeper, bound by confidentiality, for invoice data;
- our bank, for transfers;
- a lawyer or court, if there is a dispute;
- competent authorities that ask within the law.
Every party that processes personal data for us is bound by a contract that meets Article 28 GDPR. More about the studio is on about us; service descriptions are under services.
7. Transfers outside the European Economic Area
Hosting and mailbox storage for the site run through TransIP B.V. in Leiden. FormSubmit is offered from the United States. If you send the form, its contents pass through that service. We have no confirmation that this provider is listed under the EU–US Data Privacy Framework. The legal ground is Art. 49(1)(b) GDPR: the transfer is required so we can take the steps you asked for by sending the project.
If you want to avoid that route, write directly to [email protected] or call 020 244 1836. We handle the request in the same way. Other files (stems, mixes) are preferably exchanged through a channel you choose or through our own storage at the host in the Union.
8. Security
We apply measures that fit a small studio: the site is served over HTTPS only, access to client files uses individual accounts and strong passwords, two-step confirmation where the service allows it, encrypted disks on workstations, a locked building outside session hours, and deletion of working sessions after the 24-month archive window. The studio has 3 rooms, including a 42 m² live room and 2 isolation booths; physical access is limited to the team and the booked guests.
If a breach is likely to risk your rights, we notify the Dutch Data Protection Authority within 72 hours (Art. 33 GDPR) and we tell you directly if the risk is high (Art. 34). No path across the internet is fully sealed; once data reaches us, our own measures apply.
9. Your rights
Under the GDPR you can, among other things:
- see what we hold and how we use it (Art. 15);
- have mistakes or gaps put right (Art. 16);
- ask for deletion when we no longer need the file (Art. 17);
- ask us to pause certain uses in the situations listed in Art. 18;
- receive a copy of data you supplied, in a structured digital format you can reuse (Art. 20);
- object where we rely on a real interest of the studio (Art. 21);
- take back consent, which does not undo earlier lawful use (Art. 7(3)).
Send a request to [email protected] or by post to Danzigerkade 78, 1013 AP Amsterdam. We reply within one month. For a complex request that period may be extended by two months; we will tell you (Art. 12(3) GDPR). Exercise is free. If we reasonably doubt your identity, we may ask for more information.
You may lodge a complaint with the Autoriteit Persoonsgegevens, the Dutch supervisory authority, at autoriteitpersoonsgegevens.nl (P.O. Box 93374, 2509 AJ The Hague). Write to us first: most questions are settled faster that way. Practical session questions, separate from a formal GDPR request, are answered within 2 working days.
10. Cookies and similar techniques
A cookie is a small file a site places on your device. The same idea applies to local browser storage. This site does not place measurement, advertising or social-media cookies. We only store your choice in local storage under clvf_consent_v1, for 182 days. The cookie policy lists the five categories and how to change the choice with .
11. Links to other sites
We link among others to OpenStreetMap for the route to Danzigerkade 78. Those services have their own privacy notices; we do not decide their processing. Help preparing a session is in the guides, for example preparing a vocal session or podcast formats. Those pages do not collect extra form fields.
12. Status and changes
This text describes our practice; it does not limit rights you have under the law. We may refresh it when services or rules change. The revised wording goes live here, dated, and takes the place of what stood before. If a change is substantial we email existing clients. Effective date: 1 October 2026. Last reviewed: 1 October 2026.
Contact: Claviforge B.V., Danzigerkade 78, 1013 AP Amsterdam — [email protected]. See also the legal notice and the FAQ.