Privacy Policy

This Privacy Policy describes how CASTD Europe ("we", "us", or "our") collects, uses, and handles your personal data when you use our website, platform, and services (collectively, the "Service"). We are committed to protecting your privacy and processing your data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the EU General Data Protection Regulation (EU GDPR). This policy is intended to be comprehensive, transparent, and easy to understand. Please read it carefully to understand our practices regarding your personal data and how we will treat it.

1. Who We Are (The Data Controller)

For the purpose of the UK GDPR and EU GDPR, the data controller is [Company legal name], a company registered in England and Wales.

• Company Number: [Company number]
• Registered Address: [Registered address]
• Contact Email: [Contact email]

We are responsible for your personal data collected through the CASTD Europe platform.

2. The Data We Collect About You

We collect and process different kinds of personal data about you which we have grouped together as follows. The data we collect depends on whether you are a "Talent" (e.g., model, creator, photographer) or a "Brand" (a client seeking talent).

• Account and Identity Data:

  • When you register for an account, we collect your first and last name, email address, and a securely hashed password.
  • If you choose to sign in using Google, we receive your name, email address, and profile picture from Google to authenticate your identity.
  • For Brand accounts, we may also collect your company name and job title.

• Profile and Portfolio Data (Talent Users):

  • This is data you voluntarily provide to create your public-facing profile. This may include:
    • Profile pictures and a portfolio of professional photographs and videos.
    • Physical characteristics such as height, hair colour, eye colour, and other measurements relevant to casting.
    • Skills, specialisms, and professional experience.
    • Your general location (e.g., city, country) to facilitate local bookings.
    • Links to your professional social media profiles or personal website.
    • Your biography or professional summary.
  • You have control over what information you include in your profile. Please be aware that this information is visible to registered Brand users on the platform.

• Media Data:

  • Any images, videos, audio files, or documents you upload to your profile, portfolio, or send via our in-platform messaging system.

• Communications Data:

  • When you use our secure in-platform messaging service, we process the content of your messages, enquiries, campaign proposals, applications, and any attachments sent between you and other users.
  • We do this to deliver the messages and to provide a record of your communications. Our administrators may access this data to investigate technical issues, user reports, or suspected breaches of our Terms of Service.

• Contract Data:

  • We process data related to contracts between Brands and Talent. This includes:
    • Information you input into our AI Contract Advisor/Checker/Creator, such as project scope, deliverables, payment terms, and usage rights.
    • The final versions of contracts generated or checked using the tool.
    • Contracts that you upload directly to our platform for storage.
  • This data is processed to provide the contract management features of our service.

• Social Media Data:

  • If you choose to connect your social media accounts (e.g., Instagram, TikTok) via the official OAuth API, we securely store an access token provided by the social media platform. This token allows us to periodically and automatically fetch your public follower count to display on your profile.
  • We never ask for, see, or store your social media passwords.
  • You can also choose to manually provide and update your follower counts.
  • We only collect the follower numbers and do not scrape or collect any other data, such as your posts or follower lists.

• Financial and Transaction Data:

  • Our subscriptions are managed by our third-party payment processor, Stripe. When you subscribe, you provide payment details directly to Stripe.
  • We do not collect or store your full credit card number.
  • We receive data from Stripe to manage your subscription, including a unique transaction ID, your subscription plan (Brand or Talent), subscription status (active, cancelled, past due), the last four digits of your card, card expiry date, and card type. This allows us to manage your access and handle billing enquiries.

• Technical and Usage Data:

  • We automatically collect data about your device and your interaction with our Service. This includes your IP address, browser type and version, operating system, time zone setting, login data, pages you visited, search queries you performed, and the duration of your visit. This helps us to improve our platform, maintain security, and diagnose technical issues.

• Support and Feedback Data:

  • If you report a technical issue, make a complaint, or contact our support team for any reason, we will collect your name, email address, and the content of your communications with us.

3. Our Lawful Bases for Processing Your Data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Performance of a Contract: Where we need to process your data to perform the service contract we are about to enter into or have entered into with you. This is our primary basis for processing. This includes creating your account, displaying your profile, enabling messaging and applications, processing your subscription, and providing the AI Contract Advisor tool.

• Legitimate Interests: Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. This includes:

  • Improving and developing our platform and services by analysing usage data.
  • Keeping our platform and your account secure.
  • Sending you important service-related announcements (e.g., changes to our terms or a data breach notification).
  • Tracking social follower counts to provide an up-to-date and valuable profile for Talent users.
  • Handling user complaints and enforcing our Terms of Service.

• Legal Obligation: Where we need to comply with a legal or regulatory obligation. For example, keeping financial records for tax purposes or responding to a lawful request from a government or law enforcement agency.

• Consent: We generally do not rely on consent as a legal basis for processing your personal data, other than in relation to allowing you to connect social media accounts via OAuth or, in the future, sending direct marketing communications. Where we do rely on consent, you have the right to withdraw it at any time.

4. How We Use Your Personal Data (Purposes of Processing)

We have set out below, in a table format, a description of the main ways we use your personal data, and which of the legal bases we rely on to do so.

5. AI Contract Advisor Processing

Our AI Contract Advisor is a feature designed to assist you in creating, checking, and understanding contracts.

• How it works: When you use this tool, the information you provide (such as party names, project details, fees, and clauses) is sent to a third-party AI service provider for processing. The AI model analyses this text and generates or reviews contract language based on your inputs.
• Disclaimer: The output of the AI Contract Advisor is provided for informational purposes only and does not constitute legal advice. You are solely responsible for the final contract and should consult with a qualified legal professional before entering into any binding agreement.
• Data Usage: The data you input is used solely to provide the service and is processed in accordance with the data processing agreements we have in place with our AI providers. We do not use your contract data to train AI models for other customers.
• Lawful Basis: The processing of this data is based on the Performance of a Contract, as it is a core feature of the service you subscribe to.

6. Data Sharing and Third-Party Processors

We do not sell your personal data. We only share it in the following circumstances:

• With Other Platform Users: The core purpose of CASTD is to connect Brands and Talent. Your Profile and Portfolio Data will be visible to registered Brands. When you apply for a campaign or message a Brand, they will see the information you share.
• With Third-Party Service Providers (Processors): We use carefully selected third-party companies to help us operate our platform. These companies are our "processors" and are contractually obligated to protect your data and only use it to provide services to us. These include:
  • Cloud Hosting Providers: We host our platform and data with major cloud infrastructure providers (e.g., Amazon Web Services, Google Cloud). Your data is encrypted at rest and in transit.
  • Payment Processor: We use Stripe for secure payment processing. We do not handle your full payment card details.
  • Authentication Providers: If you use Google Sign-in, we share your request with Google to authenticate you.
  • AI Service Providers: We use third-party AI platforms (e.g., OpenAI, Anthropic) to power our AI Contract Advisor.
  • Analytics Providers: We may use analytics services to understand how users interact with our platform to help us improve it. This data is often aggregated or pseudonymised.
• For Legal Reasons: We may disclose your information to a third party if we are required to do so by law, regulation, or a valid legal process (such as a court order or subpoena), or to protect the rights, property, or safety of CASTD Europe, our users, or the public.

7. International Data Transfers

Your personal data may be transferred to, and stored at, a destination outside the UK and the European Economic Area (EEA), for example, where our third-party processors are based (such as in the United States).

When we transfer your personal data out of the UK or EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• The transfer is to a country that has been deemed to provide an adequate level of protection for personal data by the UK Government or the European Commission (an "adequacy decision").
• For transfers to the US, we may rely on processors who are certified under the EU-U.S. Data Privacy Framework and the UK Extension to it, which provides an adequate level of protection.
• Where we use certain service providers, we may use specific contracts approved for use in the UK and EU which give personal data the same protection it has in Europe. These are known as Standard Contractual Clauses (SCCs).

8. Data Retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

• Active Accounts: We retain your data for as long as you have an active account and subscription with us.
• Cancelled Subscriptions: If you cancel your subscription, your account remains active and you retain access until the end of the paid billing period. Your data is preserved in case you choose to resubscribe.
• Lapsed Talent Profiles: As stated in our features, if a Talent user's subscription lapses due to non-payment after a short grace period, their profile will be hidden from public view by Brands but the data will be retained for a reasonable period to allow for easy reactivation.
• Account Deletion: If you request to delete your account, we will permanently delete or fully anonymise your personal data within a reasonable timeframe (e.g., [90 days]) from our active systems. Some data may persist in our secure backups for a limited period before being overwritten.
• Legal Retention Periods: We are required by law to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for UK tax and legal purposes.

9. Data Security

We have put in place appropriate technical and organisational security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorised way, altered, or disclosed. These measures include:

• Encryption of data both in transit (using TLS/SSL) and at rest.
• Hashing of all user passwords.
• Strict access controls, ensuring that only authorised personnel have access to your data, and only for the purposes outlined in this policy.
• Using reputable and secure third-party processors like Stripe and major cloud providers.
• Procedures to deal with any suspected personal data breach. We will notify you and any applicable regulator (such as the ICO) of a breach where we are legally required to do so.

10. Your Legal Rights

Under data protection law, you have rights including:

• Right of access: You have the right to request a copy of the personal data we hold about you.
• Right to rectification: You have the right to request that we correct any inaccurate or incomplete personal data we hold about you. You can update most of your profile information directly in your account settings.
• Right to erasure (the 'right to be forgotten'): You have the right to request that we delete your personal data, under certain conditions.
• Right to restrict processing: You have the right to request that we restrict the processing of your personal data, under certain conditions.
• Right to data portability: You have the right to request that we transfer the data that we have collected to another organization, or directly to you, in a structured, commonly used, machine-readable format.
• Right to object: You have the right to object to our processing of your personal data where we are relying on a legitimate interest.
• Rights related to automated decision-making: You have the right not to be subject to a decision based solely on automated processing which produces legal or similarly significant effects on you. Our AI Contract Advisor assists you but does not make automated decisions about you.

To exercise any of these rights, please contact us at [Contact email]. We may need to request specific information from you to help us confirm your identity.

11. Children's Privacy

Our service is not intended for and may not be used by individuals under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information.

12. Cookies and Similar Technologies

We use cookies and similar technologies like local storage to operate and improve our service. For full details on the cookies we use, their purpose, and how you can manage them, please see our separate Cookie Policy. In summary, we use:

• Essential Cookies: For security, authentication (remembering you are logged in), and session storage.
• Functionality Cookies/Storage: To remember your preferences, such as your chosen language, which we store in your browser's local storage.
• Third-Party Cookies: Our payment provider, Stripe, uses cookies to enable and secure its checkout process.

We do not currently use any cookies from third-party advertising networks.

13. Changes to This Privacy Policy

We may update this privacy policy from time to time. We will notify you of any significant changes by posting the new policy on this page and, where appropriate, by notifying you via email or a prominent notice on our platform. The "Effective Date" at the top of this policy indicates when it was last revised.

14. Contact Us and Your Right to Complain

If you have any questions about this privacy policy or our privacy practices, please contact us at:

Email: [Contact email] Address: [Registered address]

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues. We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please contact us in the first instance.

Information Commissioner's Office (ICO): Website: https://www.ico.org.uk Phone: 0303 123 1113

Effective date: [Effective date]