All legal documents
Version 1.0, last updated 29 September 2026.
1. Parties and scope
1.1 This data processing agreement (in Dutch: verwerkersovereenkomst, the “DPA”) is entered into between you, the client, as controller, and MediaTuig B.V., trading as New Way Work, a private limited liability company incorporated under the laws of the Netherlands, with its registered office at Groenekanseweg 246, 3737 AL Groenekan, the Netherlands, registered with the Dutch Chamber of Commerce (KvK) under number 96665629, as processor. In this DPA, “we”, “us” and “New Way Work” refer to MediaTuig B.V.
1.2 This DPA forms part of every agreement between you and us for our editing services, including a monthly plan, a first project and any additional order. It applies from the moment we first process personal data on your behalf, including when you share footage with us before an agreement is concluded, for example so that we can estimate the work. You do not need to sign it separately. If you need a copy signed by both parties for your records, email info@newwaywork.nl.
1.3 If this DPA conflicts with our Terms and Conditions or any other part of the Agreement, this DPA prevails as far as the processing of personal data is concerned. Liability is the exception: article 15 refers to the Terms and Conditions.
1.4 Our Privacy Policy describes the processing for which we are controller ourselves, such as our client administration, sales contacts and recruitment. It does not apply to Client Data.
1.5 If you and we sign a separate data processing agreement for the Services, that agreement replaces this DPA.
1.6 If you process the personal data as a processor on behalf of your own client, for example as an agency, we act as your sub-processor. You confirm that your client has authorised you to engage us and that your instructions to us are consistent with your client’s instructions. References in this DPA to you as controller then apply to you in your role as processor, and you pass on to your client any information and notices from us that your client needs.
2. Definitions
2.1 Terms defined in the GDPR, such as controller, processor, personal data, processing, data subject, personal data breach, special categories of personal data and supervisory authority, have the meaning given to them in the GDPR. In addition:
“GDPR” means Regulation (EU) 2016/679, the General Data Protection Regulation.
“Agreement” means the agreement between you and us for the Services, including our Terms and Conditions, this DPA and any plan, first project or order you have with us.
“Services” means the video editing and related services we provide to you under the Agreement.
“Client Data” means the personal data we process on your behalf in providing the Services, as described in Annex 1.
“Footage” means the video recordings, audio recordings, photographs and other material you make available to us, and all files derived from them, such as Proxies, project files, transcripts, subtitles, review versions and Deliverables.
“Source Footage” means Footage in its original recorded quality.
“Proxies” means lightweight, lower-resolution copies of Source Footage that are used for editing.
“Deliverables” means the final edited files we deliver to you.
“My NWW” means our client portal at my.newwaywork.nl.
“Chat” means our editor chat (Mattermost) at chat.nww.agency.
“Review Environment” means our web application for timecoded feedback on edits.
“Editing Team” means PT Starianti Administrative Center, a company incorporated in the Republic of Indonesia with offices in Mataram, West Nusa Tenggara (Lombok), Indonesia, which employs our editors.
“Sub-processor” means another processor we engage to carry out processing activities on your behalf.
“SCCs” means the standard contractual clauses for the transfer of personal data to third countries adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021.
“In writing” includes email and messages in My NWW or the Chat.
3. Subject matter, nature, purpose and duration
3.1 Subject matter. We process Client Data to provide the Services: editing the Footage you make available to us and communicating with you about your projects. Annex 1 describes the categories of data subjects and personal data, the locations and the other details of the processing.
3.2 Nature. The processing consists of receiving or accessing Footage, storing it temporarily, viewing, selecting, cutting and editing it, transcription and subtitling, colour correction, sound editing, adding graphics, rendering review versions and Deliverables, delivering them to you, processing your feedback, and deleting the data when it is no longer needed.
3.3 Purpose. We process Client Data only to provide the Services to you. We do not process Client Data for our own purposes and we do not sell it.
3.4 Portfolio. Our Terms and Conditions allow us to use delivered work in our portfolio unless you object in writing. That use is not processing on your behalf. We decide on it ourselves and act as a separate controller for it, responsible for its lawfulness. If you object in writing, we do not use the work, or we stop using it.
3.5 Duration. We process Client Data for as long as the Agreement runs and, after it ends, until the Client Data has been deleted in accordance with article 13 and our Data Retention Policy.
4. Your responsibilities as controller
4.1 You determine the purposes and means of the processing of Client Data. You are responsible for complying with the GDPR as controller, including:
having a lawful basis for the processing of the Footage and other Client Data, including for making it available to us;
obtaining any consent that is needed from the people who appear in the Footage, including consent under image rights (in Dutch: portretrecht);
informing the people in the Footage about the processing where the GDPR requires this, including that processors may process the Footage outside the European Economic Area;
making available to us only the Footage and information we need for the Services; and
telling us in the brief if the Footage contains special categories of personal data or other sensitive or confidential content, and how you want us to handle it.
4.2 You are responsible for the services and equipment you control yourself. These include your Blackmagic Cloud account, your project library and its sync settings, a Mac mini at your premises if you choose that option, and the login details of your own users of My NWW, the Chat and the Review Environment.
5. Instructions
5.1 We process Client Data only on your documented instructions, including with regard to transfers of personal data to a third country, unless Union or Member State law to which we are subject requires us to do otherwise. In that case, we inform you of that legal requirement before processing, unless that law prohibits this on important grounds of public interest.
5.2 Your documented instructions are:
the Agreement, including this DPA;
briefs and requests you submit in My NWW;
messages you send to us or to your editor in the Chat; and
other instructions you give us in writing.
5.3 By entering into the Agreement, you instruct us to process Client Data as described in this DPA and Annex 1, including processing by the Editing Team in Indonesia under article 10 and by the Sub-processors listed on our sub-processors page. Your choice of workflow for a project (your own Blackmagic Cloud library, uploading Footage to us, or a Mac mini at your premises) is also an instruction.
5.4 If, in our opinion, an instruction infringes the GDPR or other Union or Member State data protection provisions, we inform you immediately. We may suspend carrying out that instruction until you confirm or change it. We are not obliged to carry out a legal assessment of every instruction, and our notice is not legal advice.
6. Confidentiality
6.1 We keep Client Data confidential. We do not disclose it to third parties, except to Sub-processors under article 8 or where Union or Member State law requires disclosure. In that last case, we inform you before the disclosure, unless the law prohibits this.
6.2 We only give access to Client Data to persons who need it to perform the Services. All our team members, including the editors employed by the Editing Team, are bound by confidentiality through their contracts.
6.3 This obligation continues after the end of the Agreement.
7. Security
7.1 We implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, as required by Article 32 of the GDPR. We take into account the state of the art, the costs of implementation and the nature, scope, context and purposes of the processing, in particular that Footage shows and records identifiable people.
7.2 Annex 2 describes the measures we apply. Our Information Security page describes our approach in more detail.
7.3 We may change our measures, provided that the overall level of security does not decrease.
7.4 No measure makes processing completely secure. We commit to maintaining the measures in Annex 2 and a level of security appropriate to the risk. We do not guarantee that incidents cannot happen.
8. Sub-processors
8.1 You give us general written authorisation to engage Sub-processors. The current list is published on our sub-processors page. Annex 3 contains a snapshot of that list on the date of this version.
8.2 We inform you at least 30 days before we add or replace a Sub-processor. We do so in writing, by email to your contact person or through My NWW, and we update the sub-processors page. Anyone who wants to receive these notices, such as your privacy officer, can subscribe by emailing info@newwaywork.nl.
8.3 You may object to the change in writing within those 30 days, on reasonable grounds relating to data protection. We then discuss your objection in good faith and look for a solution, such as not using the new Sub-processor for your Client Data. If we cannot resolve your objection before the change takes effect, you may terminate the affected Services, or the Agreement if the affected Services cannot be separated, free of charge and with effect from the date on which the change takes effect.
8.4 We engage each Sub-processor through a written contract that imposes on it data protection obligations that offer at least the same level of protection as this DPA, in particular sufficient guarantees to implement appropriate technical and organisational measures.
8.5 We remain fully liable to you for the performance of the obligations of our Sub-processors, as for our own acts.
8.6 Services and equipment you control yourself are not our Sub-processors. This applies in particular to Blackmagic Cloud: you create the project library in your own account, invite us, and decide who has access and how long the library is kept, under your own agreement with Blackmagic Design. It also applies to a Mac mini at your premises. When our editors access your library or your Mac mini, that access is part of our processing under this DPA.
8.7 On request, we give you information about the data protection terms we have agreed with a Sub-processor. We may remove commercial information before sharing it.
9. Use of AI tools
9.1 We use an external AI service on Client Data only if you have agreed to this for the project concerned. That service is then a Sub-processor for that project, and we name it on our sub-processors page before we use it.
9.2 Where we transcribe Footage, we do so locally on our own hardware where possible.
9.3 We never use Client Data to train AI models. We do not create synthetic faces, voices or statements without explicit written consent.
9.4 A human editor makes and reviews every creative decision.
10. International transfers
10.1 We transfer Client Data to a country outside the European Economic Area (EEA) only in accordance with Chapter V of the GDPR and this article.
10.2 Our editors work in Indonesia and are employed by the Editing Team. Indonesia is not covered by an adequacy decision of the European Commission. We therefore transfer Client Data to the Editing Team on the basis of the SCCs, Module Three (processor to processor), which MediaTuig B.V. as data exporter and PT Starianti Administrative Center as data importer have concluded as part of a data processing and transfer agreement. That agreement also contains the obligations required by Article 28(4) of the GDPR, is governed by Dutch law and names the Autoriteit Persoonsgegevens as the competent supervisory authority.
10.3 We have assessed the laws and practices of Indonesia that are relevant to this transfer in a transfer impact assessment. Based on that assessment, we apply the following supplementary measures:
proxy-only workflow: in the cloud workflow, your Source Footage stays on your own storage and our editors work with Proxies;
limited uploads: if you upload Footage to us, the upload is capped at 20 GB per project, and we delete the Source Footage after delivery (article 13);
the Mac mini option (clause 10.5), in which the Source Footage never leaves your premises;
encryption in transit: our services use TLS (HTTPS), and remote access to render machines runs over an encrypted relay or a private network;
access control: single sign-on for our internal tools, with multi-factor authentication being rolled out as mandatory, and non-admin accounts for editors;
confidentiality obligations in the contracts of all team members;
deletion of local working copies by the Editing Team after delivery; and
notification of personal data breaches by the Editing Team to us within 24 hours.
10.4 Under Clause 15 of the SCCs, the Editing Team must notify us if it receives a legally binding request from a public authority for access to Client Data, where it is allowed to do so. It must also review the legality of such a request and challenge it where there are reasonable grounds to consider it unlawful. If the Editing Team has reason to believe that it can no longer comply with the SCCs, it must tell us promptly. We then identify appropriate measures or, if none can be ensured, suspend the transfer, and we inform you.
10.5 Proxies are still personal data, so the SCCs apply to them as well. If you do not want your Source Footage to leave your premises at all, you can choose the Mac mini option. The Footage stays on a Mac mini at your office, and our editors connect to it remotely over an encrypted connection and render the Deliverables from the originals into a folder for you. What the editors see on screen is still processed from Indonesia, so the safeguards in this article also apply to that remote access.
10.6 Data subjects can enforce certain clauses of the SCCs directly as third-party beneficiaries. On request, we give you a copy of the SCCs as concluded with the Editing Team and a summary of the transfer impact assessment. We may remove commercial information before sharing them. More information on the risks we have identified and how we address them is in our Risk Assessment.
10.7 Where another Sub-processor processes Client Data outside the EEA, we make sure that a valid transfer mechanism under Chapter V of the GDPR applies, such as an adequacy decision or the SCCs. Our sub-processors page states the location and transfer mechanism of each Sub-processor.
11. Assistance
11.1 Taking into account the nature of the processing, we assist you by appropriate technical and organisational measures, insofar as this is possible, in responding to requests from data subjects who exercise their rights under Chapter III of the GDPR, such as the rights of access, rectification, erasure and objection.
11.2 If a data subject contacts us directly about Client Data, we forward the request to you without undue delay. We do not respond to the request ourselves unless you authorise us to do so.
11.3 Our assistance can include helping you find the material in which a person appears within a project you identify, and deleting Client Data. Changing a video, for example to remove or blur a person, is editing work. We handle it as a request under the Agreement, unless the need for it results from our failure to comply with this DPA.
11.4 Taking into account the nature of the processing and the information available to us, we also assist you in meeting your obligations under Articles 32 to 36 of the GDPR, including data protection impact assessments and prior consultation of the supervisory authority. We do so mainly by providing the information in this DPA and its annexes, on our Information Security page and, on request, further information about our processing.
12. Personal data breaches
12.1 We notify you without undue delay after becoming aware of a personal data breach affecting Client Data.
12.2 Our notification describes, as far as the information is available:
the nature of the breach, including, where possible, the categories and approximate number of data subjects and of personal data records concerned;
the name and contact details of the person you can contact about the breach;
the likely consequences of the breach; and
the measures we have taken or propose to take to address the breach, including measures to mitigate its possible adverse effects.
12.3 Where we cannot provide all information at the same time, we provide it in phases without undue further delay.
12.4 We take reasonable measures to contain the breach and limit its consequences, we keep you informed, and we document the breach, its effects and the measures taken.
12.5 You decide whether the breach must be notified to the supervisory authority and to data subjects, and you make those notifications. We do not notify them on your behalf unless you instruct us to do so in writing.
12.6 Our agreement with the Editing Team requires it to notify us of a personal data breach within 24 hours after becoming aware of it.
12.7 Our notification of a breach is not an admission of fault or liability.
13. Deletion and return
13.1 Source Footage you upload to us is deleted after delivery: once the delivery is approved or deemed approved, and no later than 30 days after final delivery.
13.2 Proxies and working files on our side, including copies on the workstations of the Editing Team, are deleted when the project is closed, and no later than 30 days after final delivery.
13.3 Your Blackmagic Cloud project library and a Mac mini at your premises remain under your control. You decide how long the Footage stays there and when you remove our access.
13.4 Deliverables remain available in My NWW while the Agreement runs. We delete them within 3 months after the Agreement ends, unless agreed otherwise in writing.
13.5 Other Client Data, such as Chat messages and briefs, is kept and deleted as described in our Data Retention Policy.
13.6 When the Agreement ends, you choose whether we return or delete the Client Data. You can download your Deliverables from My NWW until they are deleted. If you want a copy of other Client Data we still hold, ask us in writing before it is deleted. After the periods in this article and in our Data Retention Policy, we delete all Client Data and existing copies, unless Union or Member State law requires us to keep them.
13.7 Deleted Client Data remains in our encrypted backups until the backup concerned is overwritten under our backup rotation, as described in our Data Retention Policy. We use backups only to restore our systems. If we restore a backup, we again delete any Client Data that was due for deletion.
13.8 You can ask us in writing at any time to delete Client Data earlier. We carry out the request without undue delay and confirm in writing when it is done. If you ask us to delete Source Footage before delivery, we cannot complete the edit.
14. Audits and information
14.1 We make available to you all information necessary to demonstrate compliance with Article 28 of the GDPR and this DPA. We start with documentation: this DPA and its annexes, our Information Security page, answers to reasonable questions and security questionnaires and, on request, a copy of the SCCs and a summary of the transfer impact assessment (clause 10.6).
14.2 If that information is not sufficient to demonstrate compliance, we allow for and contribute to audits, including inspections, by you or by an independent auditor you mandate. The auditor must be bound by confidentiality and must not be a competitor of ours.
14.3 An audit takes place with reasonable notice, during normal business hours, on a scope agreed in advance, and without unreasonably disrupting our operations. It does not give access to data of other clients or to our commercial information. Audits take place at most once a year, unless a personal data breach affecting Client Data has occurred or a supervisory authority requires an audit.
14.4 You bear the costs of the audit, including the costs of any auditor you engage. We remedy at our own cost any shortcomings the audit reveals in our compliance with this DPA.
14.5 You keep the audit results confidential and use them only to verify our compliance with this DPA. You may share them with a supervisory authority and, if you act as a processor yourself (clause 1.6), with your own client under the same confidentiality.
14.6 Where an audit concerns the Editing Team, we arrange it through our agreement with the Editing Team, which provides for audits by our clients or by auditors they mandate.
14.7 We cooperate with the supervisory authority on request.
15. Liability
15.1 The liability of the parties under or in connection with this DPA is governed by the liability provisions in our Terms and Conditions, including the limitations set out there. These provisions also apply to our liability for Sub-processors under clause 8.5.
15.2 Nothing in this DPA limits the rights of data subjects under the GDPR, including their right to compensation under Article 82 of the GDPR.
16. Term and termination
16.1 This DPA takes effect when we first process Client Data on your behalf (clause 1.2) and runs for as long as the Agreement.
16.2 After the Agreement ends, this DPA continues to apply for as long as we still process Client Data, until the Client Data has been deleted in accordance with article 13. It then ends automatically.
16.3 This DPA cannot be terminated separately from the Agreement. Clause 8.3 describes when you may terminate the Agreement or affected Services because of a change of Sub-processor.
16.4 Obligations that by their nature continue after the end of this DPA remain in force, in particular confidentiality (article 6), deletion (article 13) and liability (article 15).
17. Changes, notices and governing law
17.1 We may update this DPA, for example when the law, our Services or our working methods change. We inform you in writing before an update takes effect. An update does not reduce the protection of Client Data under this DPA without your written agreement. Changes of Sub-processors follow article 8.
17.2 If a provision of this DPA is invalid or unenforceable, the other provisions remain in force. The parties then replace that provision with a valid provision that comes as close as possible to its purpose.
17.3 You can send notices under this DPA to info@newwaywork.nl. We send notices to the contact person and email address you have given us, or through My NWW.
17.4 This DPA is governed by Dutch law. Disputes arising from or in connection with this DPA are submitted exclusively to the competent court of the Rechtbank Midden-Nederland (District Court of Midden-Nederland), the Netherlands.
Annex 1: Details of the processing
Subject matter and purpose
Editing of the Footage you make available to us, and communication about your projects, in order to provide the Services under the Agreement.
Nature of the processing
Receiving or accessing Footage (through your own Blackmagic Cloud project library, through our upload link, or through remote access to a Mac mini at your premises), temporary storage, viewing, selection, editing, transcription, subtitling, rendering, review, delivery, communication about projects, and deletion.
Categories of data subjects
People who appear in or can be heard in the Footage, such as your employees, customers, interviewees, event participants and members of the public.
Your staff and contact persons who use My NWW, the Chat or the Review Environment, or who otherwise communicate with us about your projects.
People named in briefs, scripts, captions, subtitles or credits.
Categories of personal data
Images of people, including their faces and appearance.
Voices and recorded speech.
Names, job titles and other information shown or mentioned in the Footage, for example in captions or credits.
Statements, opinions and other content of what people say.
Contact details of your staff and contact persons, such as name, email address and phone number, and account details for My NWW, the Chat and the Review Environment.
Briefs, feedback, review comments and Chat messages, insofar as they contain personal data.
Technical metadata embedded in files, such as recording dates and, if your camera stores it, the recording location.
Special categories of personal data
Depending on its content, Footage may reveal special categories of personal data, for example health information in footage of a healthcare organisation, or religious beliefs in footage of a religious gathering. We process such data only as part of the Footage you make available to us and only as you instruct. We do not use it for any purpose other than editing the Footage. Please tell us in the brief if the Footage contains special categories of personal data or other sensitive content (clause 4.1).
Frequency and duration
Continuous for the duration of the Agreement, on a per-project basis. Client Data is kept only as long as described in article 13 and our Data Retention Policy.
Locations
European Union, the Netherlands: our own hardware, and object storage and backups at DigitalOcean in Amsterdam.
European Union, Germany: our servers at Hostinger, and email at Strato.
Indonesia: the Editing Team in Mataram, Lombok, under the SCCs (article 10).
Under your control: your Blackmagic Cloud project library, under your own agreement with Blackmagic Design, and a Mac mini at your premises if you choose that option.
Contact and supervisory authority
Questions about this processing can be sent to info@newwaywork.nl. Our competent supervisory authority is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority).
Annex 2: Technical and organisational measures
This annex lists the measures we apply today. Where a measure is still being rolled out, we say so. Our information security policy follows the structure of ISO/IEC 27001 and 27002. We are not ISO 27001 certified. Our Information Security page gives more detail.
Data minimisation
In the cloud workflow, the project library syncs Proxies only (Proxy Only), so Source Footage stays on your own storage.
Uploads of Footage to us are capped at 20 GB per project. Larger productions use the cloud workflow.
Source Footage uploaded to us is deleted after delivery (clause 13.1).
With the optional Mac mini at your premises, the Footage never leaves your building.
Encryption
TLS (HTTPS) on all our services, through a reverse proxy.
Remote access to render machines runs over an encrypted relay (RustDesk with forced encryption) or a private network (Tailscale).
Backups of our servers are encrypted (GPG) before they are stored off-site.
Access control
Single sign-on for our internal tools.
Multi-factor authentication is available and is being rolled out as mandatory. It is not yet enforced for all users.
Our servers can only be accessed over SSH with keys, not with passwords.
Editors use non-admin accounts on their workstations and render machines.
On render machines we manage, deleting source files requires an administrator password, to protect source files against accidental deletion.
Network and server security
A firewall on our servers, with hardened rules for containerised services.
Automatic blocking of repeated failed login attempts.
Our core tools, including My NWW, the Chat, the Review Environment and the file exchange for uploads, are self-hosted on virtual private servers that we manage, rather than on third-party software-as-a-service platforms.
Maintenance and testing
A weekly maintenance and update round for our servers and tools.
Periodic security scans of our systems.
Periodic rotation of passwords, keys and other secrets.
Availability
Encrypted backups of both of our servers, stored off-site in DigitalOcean Spaces (Amsterdam).
People and organisation
All team members are bound by confidentiality through their contracts.
Our editors are employed by the Editing Team, which is bound by the data processing and transfer agreement described in article 10.
A human editor makes and reviews every creative decision. External AI services are used on Client Data only when agreed per project (article 9).
Incident handling
The Editing Team notifies us of a personal data breach within 24 hours.
We notify you without undue delay after becoming aware of a personal data breach affecting Client Data.
Where we are controller ourselves and notification is required, we notify the Autoriteit Persoonsgegevens within 72 hours.
Deletion
Source Footage, Proxies and working files, including local working copies held by the Editing Team, are deleted after delivery within the periods in article 13.
Annex 3: Sub-processors
The current list of Sub-processors, with the location and transfer mechanism of each, is published on our sub-processors page. That page prevails over this snapshot. Changes follow article 8.
Snapshot on 24 September 2026:
PT Starianti Administrative Center, Mataram, Indonesia: our editing team, which employs our editors. Transfer mechanism: the SCCs (Module Three), a transfer impact assessment and supplementary measures (article 10).
Hostinger: rented virtual private servers on which we host our own tools, including My NWW, the Chat, the Review Environment and the file exchange for uploads. Location: Germany (EU).
DigitalOcean: object storage (Spaces) for files of some of our tools and for our encrypted backups. Location: Amsterdam, the Netherlands (EU).
Strato AG: email hosting and outgoing email for newwaywork.nl. Location: Germany (EU).
External AI services: the standard briefing estimator does not send briefs to an external AI provider. Any external service proposed for client material must be identified, agreed for the project and added to the sub-processors list before use (article 9).
Not Sub-processors: Blackmagic Cloud, which is your own service (clause 8.6), and the providers we use only for our own business administration. The sub-processors page lists these as well.