This page lists the sub-processors that MediaTuig B.V., trading as New Way Work, uses when we process personal data on behalf of our clients, the client-controlled services we work inside, and the providers we use for our own business data. It is the current list referred to in article 8 and Annex 3 of our Data Processing Agreement (the “DPA”).

How this list is organised

• Section 1 lists our sub-processors: providers that may process your project data, such as footage, briefs, feedback, messages and the details of your contact persons, on our behalf.

• Section 2 lists services and equipment that you control yourself and that we work inside. These are not our sub-processors.

• Section 3 lists providers we use for our own business data, for which we are controller. Our Privacy Policy describes that processing.

For each provider, we describe what it does for us, which data it processes, where, and the transfer mechanism that applies if data leaves the European Economic Area (EEA).

1. Sub-processors for client project data

PT Starianti Administrative Center

• What it does for us: it is our editing team. Our editors are employed by PT Starianti on employment contracts and do the editing work for our clients. PT Starianti is a related company, owned by the family of our founder. MediaTuig B.V. holds no shares in it.

• What data: footage (proxies in the cloud workflow, source footage in the upload workflow, and the remote screen view in the Mac mini option), briefs, feedback, chat messages, and the names and contact details of your project contacts.

• Location: Mataram, West Nusa Tenggara (Lombok), Indonesia.

• Transfer mechanism: Indonesia has no EU adequacy decision. Transfers rely on the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), Module Three (processor to processor), in a data processing and transfer agreement between MediaTuig B.V. and PT Starianti. We add a transfer impact assessment and supplementary measures, such as the proxy-only workflow, encryption in transit, access control and deletion after delivery. Article 10 of the DPA describes these in full.

Hostinger

• What it does for us: it rents us the virtual private servers on which we host our own tools: the client portal My NWW, the editor chat, the review environment, the file exchange for uploads, our CRM, automation, e-signing, mailing and transactional email, single sign-on, scheduling and project management. Hostinger provides the infrastructure. We install, configure and manage the tools ourselves.

• What data: all client data held in these tools, including footage uploaded through our upload link, review versions, deliverables, briefs, feedback, chat messages and contact details.

• Location: a data centre in Germany (EU).

• Transfer mechanism: not applicable, because the servers are located in the EU.

DigitalOcean

• What it does for us: object storage (Spaces) for files of some of our self-hosted tools, and for the backups of our servers.

• What data: the files those tools store there, and backups that contain the data held in our self-hosted tools. Backups are encrypted (GPG) before they leave our servers.

• Location: region Amsterdam, the Netherlands (EU). DigitalOcean is a company based in the United States.

• Transfer mechanism: our selected storage region is in the EU. Section 4 of DigitalOcean’s Data Processing Agreement describes the applicable Data Privacy Framework mechanism and SCC fallback for transfers outside protected regions. The applicable account and service terms determine which mechanism covers a specific transfer.

Strato AG

• What it does for us: email hosting and outgoing email (SMTP) for newwaywork.nl, including info@newwaywork.nl.

• What data: emails between you and us, including attachments and any personal data they contain. Footage is exchanged through the workflows described in the DPA, not by email.

• Location: Germany (EU).

• Transfer mechanism: not applicable, because Strato is based in the EU.

External AI services

• We use an external AI service on client material only when this has been agreed with you for a specific project. We list any such service here, with the same details as above, before we use it.

• Transcription runs locally on our own hardware where possible. Client material is never used to train AI models. We do not create synthetic faces, voices or statements without explicit written consent. A human editor makes and reviews every creative decision.

• The standard briefing estimator does not send briefs to an external AI service. Any external AI service proposed for client material must be identified here, with its purpose and applicable processing and transfer terms, before that use is agreed and begins.

2. Client-controlled services we work inside

Blackmagic Cloud

• What it is: Blackmagic Design’s cloud service for collaboration in DaVinci Resolve. In the cloud workflow, you create a project library in your own Blackmagic Cloud account and invite us. We provide the folder structure.

• Why it is not our sub-processor: you choose the service, hold the account, and decide who has access and how long the library is kept. Your own agreement with Blackmagic Design applies.

• What happens inside it: with the library set to sync proxies only (Proxy Only), your original footage stays on your own storage and only lightweight proxy files sync to our editors. The assets our editors use sync back to your library. When the edit is approved, you render the final version from your source footage.

• Location and transfer mechanism: as agreed between you and Blackmagic Design under your account. Our editors’ access to your library from Indonesia is part of our processing and is covered by the safeguards for PT Starianti in section 1.

A Mac mini at your office (optional)

• What it is: a Mac mini at your premises that holds your source footage. Our editors connect to it remotely and render the finals from the originals into a folder for you.

• Status: this is your own environment, not a service provider. The footage never leaves your building.

• Remote access: the arrangement is agreed for the project. Where our self-hosted RustDesk relay is used, MediaTuig operates the relay on its rented infrastructure. If a separate network service such as Tailscale is proposed, we identify its role and applicable terms before using it for the project.

• Location and transfer mechanism: the footage stays at your premises. What our editors see on screen is processed from Indonesia, under the safeguards for PT Starianti in section 1.

3. Providers for our own business data

These providers process data for which we are controller. They do not process client project data. More information is in our Privacy Policy.

Framer B.V.

• What it does for us: hosting of our website, www.newwaywork.nl, and Framer’s built-in site analytics, which are cookieless and aggregate.

• What data: technical data of website visitors, such as IP addresses, which Framer can see when pages, videos and images load from its servers. We do not build personal profiles of visitors.

• Location: Amsterdam, the Netherlands. Framer’s infrastructure is also located outside the EU.

• Transfer mechanism: section 7 and Appendix 1 of Framer’s Data Processing Addendum provide for an adequacy decision, including the Data Privacy Framework for a certified recipient, or SCCs or another applicable safeguard. These terms must apply to the Framer service and account used for our website.

Google (Google Ireland Ltd)

• What it does for us: calendar and Google Meet video calls. Intro and sales calls are booked through our own scheduling tool and held on Google Meet.

• What data: names and email addresses of participants, meeting details, and what is said and shown during a call. Footage and project files are not exchanged through Google services.

• Location: Ireland (EU). Google may process data in other countries, including the United States.

• Account and transfer terms: we do not have Google Workspace. Calendar and Meet are subject to the terms of the account used; we do not claim that Google Workspace data processing terms apply. We do not exchange client footage or project files through these services.

WeFact B.V.

• What it does for us: invoicing and bookkeeping administration.

• What data: company and contact details of clients, and invoice and payment details.

• Location: the Netherlands (EU).

• Transfer mechanism: not applicable, because WeFact is based in the EU.

Mollie B.V.

• What it does for us: a separate Mollie checkout is not part of the current direct-order flow, which uses the WeFact invoice payment link. If Mollie is used as the payment provider for that link, we identify that arrangement before activation; this entry does not confirm that such processing is already active.

• What data: the payer’s name, payment details and transaction data.

• Location: the Netherlands (EU).

• Transfer mechanism: not applicable, because Mollie is based in the EU.

Our self-hosted tools and recruitment

• Our CRM, scheduling tool, e-signing, mailing and automation are self-hosted: they run on our own servers at Hostinger (section 1), not on the platforms of other providers.

• How we handle the data of people who apply to join our team, including the tools we use for recruitment, is described in our Privacy Policy.

Changes to this list

• We inform our clients at least 30 days before we add or replace a sub-processor in section 1. We do so by email to the client’s contact person or through My NWW, and we update this page.

• A client can object within those 30 days on reasonable grounds relating to data protection. If we cannot resolve the objection before the change takes effect, the client can terminate the affected services free of charge, as set out in article 8 of the DPA.

• Anyone who wants to receive these notices, such as a client’s privacy officer, can subscribe by emailing info@newwaywork.nl.

• We update sections 2 and 3 when the services or providers concerned change.

Questions

For questions about our sub-processors, or for more information about the data protection terms we have agreed with one of them, email info@newwaywork.nl.