1. Data Controller Information
The controller responsible for processing personal data collected through this website and during studio tracking, mixing, mastering, and facility rental operations is:
Gualacaflow Music B.V.
Statutory Seat & Facility: Gedempte Oude Gracht 92, 2011 GV Haarlem, Netherlands
Chamber of Commerce (KvK): 89341028 | VAT Number (BTW-id): NL893410280B01
Issued Share Capital: €18.000
Data Protection Contact: [email protected]
Direct Telephone Line: +31 23 847 6290
2. Categories of Personal Data Processed
Gualacaflow Music B.V. processes only personal data strictly necessary for booking fulfillment, technical execution, and statutory compliance:
- Contact & Identification Data: Full name, artist/band alias, company name, billing address, email address, and direct telephone number provided via session request forms.
- Technical & Connection Telemetry: Anonymized IP addresses, session identifiers, TLS handshake logs, browser client user-agents, and server diagnostic logs maintained for cybersecurity defense.
- Artistic Assets & Audio Materials: Multitrack session files, DAW project files, audio stems, rough mixes, lyric sheets, and metadata submitted for recording, mixing, or mastering services.
3. Legal Grounds and Processing Purposes
| Processing Purpose |
Legal Basis (Article 6 GDPR) |
Statutory Retention Period |
| Studio session booking, calendar scheduling, quote preparation, and client communication. |
Performance of a contract or pre-contractual measures (Art. 6(1)(b)). |
Duration of contract plus 24 months after final stem delivery. |
| Statutory bookkeeping, corporate billing, and fiscal declarations under Dutch tax law. |
Legal obligation (Art. 6(1)(c)) under Dutch State Taxes Act (AWR). |
7 years strictly pursuant to Article 2:10 of the Dutch Civil Code (BW). |
| Facility security, IP rights protection, and defense against contractual claims. |
Legitimate interest of the controller (Art. 6(1)(f)). |
Until the expiration of the statutory prescription period under Dutch law. |
4. Data Storage & International Data Transfers
All client records, digital session stems, and invoicing archives are hosted within secure, redundant data centers located strictly within the European Economic Area (EEA). Gualacaflow Music B.V. does not transfer personal data to third countries outside the EEA unless adequate safeguards are established pursuant to Chapter V of the GDPR (Standard Contractual Clauses).
5. Data Subject Rights under the GDPR
Pursuant to Articles 15 through 22 of the GDPR, you hold specific enforceable rights regarding your personal data held by Gualacaflow Music B.V.:
- Right of Access (Art. 15): Obtain confirmation as to whether your personal data is processed and request an electronic copy.
- Right to Rectification (Art. 16): Require immediate correction of inaccurate or incomplete personal data.
- Right to Erasure (Art. 17): Request deletion of data when no longer necessary, subject to mandatory 7-year fiscal obligations under Dutch Civil Code (Art. 2:10 BW).
- Right to Restriction of Processing (Art. 18): Restrict active processing while accuracy or dispute inquiries are resolved.
- Right to Data Portability (Art. 20): Receive your personal data in a structured, commonly used, machine-readable format (JSON/CSV).
- Right to Object (Art. 21): Object at any time to processing based on legitimate interest.
To exercise any of these rights, contact our privacy desk directly at [email protected]. We respond within 30 calendar days.
6. Supervisory Authority & Right to Lodge a Complaint
If you believe that the processing of your personal data infringes the GDPR or Dutch data protection legislation, you have the right to lodge a formal complaint with the Dutch Data Protection Authority:
Autoriteit Persoonsgegevens (AP)
Bezuidenhoutseweg 30, 2594 AV Den Haag, The Netherlands
Postal Address: Postbus 93374, 2509 AJ Den Haag
Official Portal: autoriteitpersoonsgegevens.nl