Privacy policy.

For all users

• First name, last name, email, phone
• Date of birth, gender
• Password (stored as a hash, never in clear)
• IP address, browser information

For talents

• Physical characteristics (height, weight, hair / eye colour)
• Skills (sports, dance, foreign languages, instruments)
• Photos and videos
• Identity documents (only for contracts)
• Banking information (IBAN, for contract payments)

For minors (under 18)

• Data of the legal guardian
• Written consent of the guardian

Purpose	Legal basis
Account creation and management	Contract (Art. 6.1.b GDPR)
Talent–casting matching and sharing of data (photos, name, phone, email) with clients	Contract (Art. 6.1.b GDPR)
Photos and videos	Explicit consent (Art. 9.2.a GDPR)
Payment processing and banking information	Contract (Art. 6.1.b GDPR)
Ethnicity (optional)	Explicit consent (Art. 9.2.a GDPR)
Identity documents, age verification	Legal obligation (Art. 6.1.c GDPR)
Protection of minors (guardian consent)	Legal obligation (Art. 6.1.c GDPR)
Maintaining the talent database for future casting calls	Legitimate interest (Art. 6.1.f GDPR)
Security, fraud prevention	Legitimate interest (Art. 6.1.f GDPR)
Traffic analysis and platform improvement (Google Analytics)	Consent (Art. 6.1.a GDPR)

We use the following third-party processors to operate the platform:

• Resend (Email): Transactional email delivery. Location: EU (Ireland).
• AWS S3 (Document storage): Identity documents. Location: EU (Frankfurt).
• Cloudinary (Media): Photos and videos. Location: US + global CDN.
• Google Analytics: Traffic statistics. Location: US.

For casting purposes, we share the following with clients and production partners:

• Photos and videos
• First name and last name
• Phone — for direct contact by the production
• Email — for sending the wardrobe brief and other technical details

Banking information is NOT shared with clients or partners. It is used exclusively internally for processing contract payments.

Data type	Location
Accounts, profiles	PostgreSQL self-hosted (EU)
Identity documents	AWS S3 eu-central-1 (Frankfurt)
Photos, videos	Cloudinary (US + global CDN)
Emails	Resend eu-west-1 (Ireland)
Traffic statistics	Google Analytics (US)

We are a casting agency that maintains an active talent database. Profiles are kept so that we can contact you when a suitable casting comes up, even if you haven't actively applied recently.

• Talent profiles: Until deletion is requested or maximum 10 years of complete inactivity
• Sessions: Maximum 7 days
• Identity documents: Until account deletion or maximum 5 years from the last contract
• Audition applications: Maximum 120 days (without contract) or 5 years (with a signed contract)
• Banking information: Until account deletion or maximum 5 years from the last contract
• Google Analytics data: Maximum 14 months

Under GDPR, you have the following rights:

• Right of access: You may request a copy of your personal data
• Right of rectification: You may correct inaccurate or incomplete data
• Right to erasure: You may request deletion of your personal data
• Right to restriction: You may request limitation of data processing
• Right to portability: You may receive your data in a structured format
• Right to object: You may object to certain processing activities
• Withdrawal of consent: You may withdraw consent at any time

To exercise your rights: Email us at office@agentiadecasting.ro. We respond within 30 days.

You may lodge a complaint with the Romanian National Authority for the Supervision of Personal Data Processing (ANSPDCP):

• Website: www.dataprotection.ro
• Email: anspdcp@dataprotection.ro
• Phone: +40 31 805 9211

For users under 18, involvement of the legal guardian is required according to applicable law. The legal guardian expresses consent for the processing of the minor's data and may withdraw consent at any time.

Verification of the guardian's identity and consent takes place before the minor's actual participation in auditions.

We use the following types of cookies:

• Essential cookies: Authentication and security
• Analytics cookies: Google Analytics for traffic statistics

We do not use advertising cookies. Full details in the Cookie Policy.

We reserve the right to update this policy. The date of the last update is shown in the header. Continued use of the platform after modifications constitutes acceptance of the new policy.

For questions about this policy or for exercising your rights:

• Email: office@agentiadecasting.ro
• Company: CRI-MA PRODUCTION SRL
• Reg. no.: 47822229
• Address: 31 Gheorghe Manu Street, Floor G, Ap. 1, Sector 1, Bucharest

In accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law 190/2018.