1. Introduction

This Privacy Policy sets out how Casting Crowd Limited ("we," "us," "our") collects, uses, stores, and protects your personal data when you use our Platform. It applies to all users — casting agents, agencies, production companies, and background actors — operating in the United Kingdom, the United States, Canada, India, and any other jurisdiction in which the Platform is available.

Data Controller: Casting Crowd Limited, registered at 3rd Floor, 86-90 Paul Street, London, England, EC2A 4NE (company number 16975080). We act as data controller for the purposes of the UK GDPR, the EU GDPR where applicable, and as Data Fiduciary under India's Digital Personal Data Protection Act, 2023.

2. Strictly 18+ Only — No Data From Persons Under 18

The Platform does not knowingly collect, process, or store personal data from any person under the age of 18. We do not offer accounts, services, or features for persons under 18, and no parental or guardian consent mechanism exists or is recognised.

If we discover that we have inadvertently collected personal data from a person under 18, we will delete that data from our active systems without delay and purge it from backups within a reasonable period. If you believe a minor's data has been collected, contact us immediately at privacy@castingcrowd.com and we will investigate and purge the data as a priority.

Any attempt to register or submit data on behalf of a person under 18 is a breach of these Terms and will result in immediate account termination and data deletion.

3. Information We Collect

3.1 Information You Provide Directly

All Users:

• Full name and email address
• User type (agent or actor) and language preference

Background Actors and Supporting Artists:

• Personal details: name, mobile phone, date of birth, age, gender, nationality, country of residence
• Emergency contact information
• Physical characteristics: height, head size, collar size, chest size, sleeve size, trouser waist, waist, inside leg, shoe size
• Appearance: ethnic origin, ethnic look, hair colour, hair length, facial hair, eye colour, skin tone, piercings, tattoos
• Professional information: acting credits and specialisations
• Media files: headshots, profile photos (side, back, full-length), showreels, CVs
• Availability: calendar of unavailable dates and reasons
• Vehicle ownership and disclosed physical disabilities, where relevant

Casting Agents and Agencies:

• Agency name, email, and location
• Agency branding: logo, banner image, brand colours
• Mission statement, description, and specialisations
• Portfolio images of prior castings
• Contact persons (main, billing, emergency) and team member email addresses
• Social media links and preferred communication method

3.2 Information Collected Automatically

• IP address and device information
• Browser type and version
• Pages visited and time spent on the Platform
• Referring website addresses and navigation paths
• Date and time stamps of platform activity

3.3 Communications Data

• Messages exchanged between agents and actors via the Platform
• Availability check responses and booking confirmations
• Photo, self-tape, and digital fitting requests and submissions

3.4 Live Map Location Data

Actor locations displayed on the Live Map are estimated to city/region level only. We do not collect, store, or display precise home addresses or real-time location data. Markers represent the general area where a supporting artist or extra is based, not their exact address.

4. Lawful Basis and Purpose for Processing

We process your personal data only where a lawful basis exists. The bases on which we rely differ by jurisdiction but can be summarised as follows:

UK and EU — GDPR

• Contractual necessity (Article 6(1)(b)) — providing the casting platform, managing bookings, and enabling communications between users
• Legitimate interests (Article 6(1)(f)) — service improvement, analytics, fraud prevention, and platform security, balanced against your privacy rights
• Consent (Article 6(1)(a)) — marketing communications and non-essential cookies, withdrawable at any time
• Legal obligation (Article 6(1)(c)) — responding to lawful requests from authorities and meeting record-keeping duties

India — DPDP Act, 2023

For users in India, referred to as Data Principals under the DPDP Act, we act as your Data Fiduciary. We process your personal data for the following lawful purposes:

• Providing and maintaining the Platform's casting and booking services
• Facilitating communications between casting professionals and actors
• Verifying identity where biometric verification is purchased
• Complying with legal obligations under applicable Indian law
• Operating, securing, and improving the Platform's functionality

5. Data Retention

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, including any legal, accounting, or reporting requirements.

5.1 Contract and Signature Audit Records

When you electronically sign a contract through the Platform, we create an immutable audit record containing your name, email, IP address, user agent, server-synchronised timestamp, signature data, and a SHA-256 cryptographic integrity hash. This record is retained for the contract term plus 7 years, in line with UK limitation periods under the Limitation Act 1980 and HMRC record-keeping requirements.

The right to erasure does not apply where retention is necessary for compliance with a legal obligation.

5.2 General Account Data

Account profiles, messages, booking records, and availability data are retained for the duration of your active account and for 3 years after closure or last activity, after which they are permanently deleted unless a legal hold applies.

5.3 Media Files

Headshots, showreels, and uploaded documents are retained during your active account period. Upon account deletion, media files are removed within 30 days, except where they form part of a completed contract record retained under Section 5.1.

6. Data Sharing and Cross-Border Transfers

We do not sell your personal data. We share it only where necessary to operate the Platform, comply with the law, or protect our rights.

Service providers: Third-party processors (including payment infrastructure, email delivery, and cloud hosting) access your data under written contracts requiring equivalent data protection standards.

Legal compliance: We may disclose data where required by law, court order, or legitimate government request in any jurisdiction where we operate.

Cross-border transfers: Your data may be processed in countries other than your country of residence, including the United Kingdom, the United States, and India. Where data leaves the UK or EU, we rely on adequacy decisions, standard contractual clauses, or other lawful transfer mechanisms.

Notice to Canadian users: Sensitive physical metrics, visual portfolios, and profile details submitted by Canadian background actors are transferred to and securely hosted on infrastructure located outside of Canada, including the United Kingdom and the United States. This data becomes subject to the access and disclosure laws of those foreign jurisdictions, which may differ from Canadian privacy standards under PIPEDA and Quebec's Law 25.

7. Your Privacy Rights

United States — CCPA and CPRA

Residents of California and other states with active privacy laws have the right to know and access the personal information we collect, request deletion, opt out of the sale or sharing of data for targeted advertising, limit the use of sensitive personal information, and be free from discrimination for exercising these rights. We do not sell personal information.

Voluntary physical data: The collection of physical dimensions, appearance metrics, and talent headshots is entirely voluntary and user-directed. You choose what to provide, and this data is used solely for casting match optimisation.

Biometric processing: The Platform does not use automated biometric mathematical facial geometric mapping to scan, index, or track faces. If any biometric processing is introduced, it will require a separate, explicit notice and standalone consent before activation.

To submit a CCPA/CPRA rights request, contact privacy@castingcrowd.com.

Canada — PIPEDA and Quebec Law 25

Canadian users are entitled to clear, meaningful consent and may access, correct, and withdraw consent for the processing of their personal information, and receive notification of any data breach affecting that information.

Sensitive physical metrics, visual portfolios, and profile details submitted by Canadian background actors are transferred to and securely hosted on cross-border infrastructure outside of Canada, including the UK and the US, making the data subject to local access laws in those foreign jurisdictions. Where consent is required, it is obtained separately and is not a condition of service beyond what is necessary to provide the Platform's core features.

India — DPDP Act, 2023

As Data Principals, users in India have the right to:

• Obtain information about personal data processed and the purposes of processing
• Request correction of inaccurate or incomplete personal data
• Request erasure of personal data, subject to lawful retention requirements
• Appoint a nominee to exercise these rights in the event of death or incapacity
• File a grievance with the Grievance Officer and receive a response within the statutory period

United Kingdom and EU — UK GDPR / EU GDPR

• Access — obtain a copy of your personal data and associated information
• Rectification — request correction of inaccurate data
• Erasure — request deletion, subject to legal retention obligations
• Restriction — limit processing in specific circumstances
• Portability — receive your data in a structured, machine-readable format
• Objection — object to processing based on legitimate interests or for direct marketing

To exercise any of these rights, contact privacy@castingcrowd.com. You also have the right to lodge a complaint with the Information Commissioner's Office (UK) or your local data protection authority.

8. Data Security

We implement technical and organisational measures designed to protect your personal data against unauthorised access, alteration, disclosure, or loss. These include encrypted data transmission, access controls, and regular security reviews.

No system is entirely secure. In the event of a personal data breach that is likely to result in a risk to your rights or freedoms, we will notify the relevant supervisory authority and, where required, affected users without undue delay.

For Canadian users, breach notification follows the requirements of PIPEDA and Quebec's Law 25, including assessment of the risk of significant harm and notification to the Privacy Commissioner of Canada where applicable.

9. Data Protection Officer and Grievance Redressal

Privacy and Data Protection Contact

For all general privacy enquiries, GDPR rights requests (UK/EU), CCPA/CPRA requests (US), and PIPEDA/Law 25 notices (Canada), contact our designated Privacy Officer: Adam Darlington at privacy@castingcrowd.com.

Grievance Redressal Mechanism (India — DPDP Act)

Data Principals in India may file a grievance regarding the processing of their personal data by contacting our designated Grievance Officer: Adam Darlington at grievance@castingcrowd.com. We will acknowledge every grievance within 48 hours of receipt and resolve it within 30 days.

If you are not satisfied with our response, you have the right to escalate the matter to the Data Protection Board of India established under the DPDP Act.

India Regional Provisions (DPDP Act Compliance)

10. Contact Information