Privacy Policy

Data Controller (Operator): Agent CS sp. z o.o. Registered office: ul. Chelmska 19/21, 00-724 Warsaw KRS: 0001257455 NIP: 5214175194 REGON: 545394221

Contact: [email protected] Website: www.casting.studio

The Operator is a technology company: it runs the Application and is the controller of Users’ personal data processed in the Application. The Operator is not an agency. Representation of Artists by the agencies they choose is described in Section 6 of the Terms & Conditions.

This Privacy Policy complies with the requirements of: Regulation (EU) 2016/679 (GDPR), the Polish Act on Personal Data Protection of 10 May 2018, UK GDPR and Data Protection Act 2018, CCPA/CPRA, Apple App Store Review Guidelines (Section 5.1), Google Play Developer Program Policy, ePrivacy Directive 2002/58/EC, COPPA, UK AADC (Children’s Code), and other applicable data protection regulations.

1. General provisions and definitions

1.1. This Privacy Policy (hereinafter: Policy) sets out the rules for the processing and protection of personal data of Users of the Casting Studio mobile application (hereinafter: Application), available on the Apple App Store and Google Play Store, as well as the related web application at www.casting.studio.

1.2. The Application is a professional casting platform connecting talent (actors, actresses, influencers, content creators) with entities from the film, advertising and production industries (directors, producers, production companies). The Application is a multi-agency platform: Artists are represented by the agencies they choose, and the Operator provides the technology and is not an agency.

1.3. Use of the Application constitutes acceptance of this Policy in its entirety. A User who does not accept any provision of the Policy should refrain from using the Application and promptly delete their account.

1.4. Definitions used in this Policy:

• Operator / Controller – Agent CS sp. z o.o. with its registered office in Warsaw, ul. Chelmska 19/21, 00-724 Warsaw, KRS 0001257455, NIP 5214175194, REGON 545394221, a technology company which operates the Application and is the controller of Users’ personal data processed in the Application;
• Agency – the entity chosen by the Artist in the Application or in the application form, which represents the Artist under an agreement concluded with the Artist (Section 6 of the Terms & Conditions). The Operator is not an Agency;
• User – any natural person using the Application, including Artists, Bookers, and Clients;
• Personal Data – any information relating to an identified or identifiable natural person (Article 4(1) GDPR);
• Profile – a User’s account in the Application containing identification data, portfolio materials and casting activity history;
• Service – any functionalities made available by the Operator through the Application, provided on an “as-is” basis;
• GDPR – Regulation (EU) 2016/679 of 27 April 2016;
• UK GDPR – the GDPR as retained in UK law, supplemented by the Data Protection Act 2018;
• CCPA/CPRA – California Consumer Privacy Act / California Privacy Rights Act.

2. Data Controller

2.1. The controller of personal data is the Operator — Agent CS sp. z o.o. with its registered office in Warsaw (00-724), ul. Chelmska 19/21, KRS 0001257455, NIP 5214175194, REGON 545394221. The Agency chosen by the Artist processes the Artist’s personal data in the scope of the Agency Services on the terms set out in its agreement with the Artist.

2.2. The Controller processes data in accordance with the GDPR, the Polish Act on Personal Data Protection, UK GDPR and Data Protection Act 2018, CCPA/CPRA, and other applicable regulations.

2.3. Contact: [email protected] or in writing to the registered office address.

3. Data Protection Officer (DPO)

3.1. The Controller has appointed a Data Protection Officer, who may be contacted at: [email protected].

3.2. The DPO may be contacted regarding all matters relating to data processing and the exercise of rights under the GDPR, UK GDPR, and CCPA/CPRA.

4. Categories of personal data collected

4.1. The Controller collects and processes the following categories of data:

4.2. Special categories of data (Article 9 GDPR). Photographs and video recordings processed by AI systems may constitute biometric data within the meaning of Article 9(1) GDPR. Processing is carried out solely on the basis of the User’s explicit consent (Article 9(2)(a) GDPR). The User acknowledges and accepts that withdrawal of consent to the processing of image data by AI will prevent the use of intelligent matching features, which may significantly reduce the visibility of the User’s profile in casting search results.

4.3. The User represents that all personal data entered into the Application is truthful, current and complete. The Operator shall not be liable for any damage resulting from the provision of untrue, outdated or incomplete data by the User.

4.4. Data from Facebook, Instagram and Messenger (Meta). Agent CS, the Operator’s customer-communication tool, is connected to Facebook Pages and Instagram business accounts only by the administrators of those Pages, who grant access through Facebook Login. Through the Meta APIs we then process: the names, IDs and profile pictures of the connected Pages and Instagram accounts; the content and time of messages a person sends to such a Page in Messenger or Instagram Direct, together with that person’s Meta user ID (page-scoped ID) and public name; comments under the Page’s posts; and engagement counts of its posts. We use this data only to answer the person who wrote, to publish and manage the posts the Page administrator approved, and to report post results to that administrator (legal basis: Article 6(1)(b) and (f) GDPR). We do not use it for advertising, do not sell it and do not share it with anyone except the Page owner and the processors listed in Section 8. Message content may be processed by the AI providers in Section 8.1 to draft a reply, without training. Messages and comments are kept for as long as the Page stays connected and for at most 12 months after the last message; access tokens are deleted when the Page is disconnected. Deletion of this data is described in Section 19.4.

5. Purposes and legal bases for processing

5.2. The User has the right to withdraw consent at any time (Article 7(3) GDPR), without affecting the lawfulness of processing carried out prior to the withdrawal.

Consent mechanisms

• At registration – separate, unchecked checkboxes (opt-in) for: (i) processing of image data by AI (Article 9(2)(a) GDPR), (ii) marketing communications, (iii) analytics. Each purpose = separate checkbox;
• On first AI use – a modal with information about AI providers and the scope of processing;
• System permissions – just-in-time dialogues (camera, microphone, gallery). Refusal does not block core functionality;
• Management – Settings > Privacy. Withdrawal = as simple as granting consent.

6. Automated decision-making and profiling

6.1. The Application uses AI algorithms to match candidates to casting briefs. The system analyses physical features, experience, skills and availability.

6.2. Processing serves an assistive function – every decision is ultimately made by a human (human-in-the-loop model). The User acknowledges that results generated by AI are of a purely recommendatory nature and do not constitute a guarantee of obtaining a role, employment or any other outcome.

6.3. The User has the right to: (a) information about the logic of processing (Articles 13(2)(f), 14(2)(g) GDPR), (b) express their point of view, (c) contest the decision, (d) request human intervention (Article 22 GDPR).

7. Use of artificial intelligence (AI)

7.1. The Application uses AI in the following areas:

• AI Assistant – a conversational agent based on knowledge bases;

• Intelligent matching – automated matching of profiles to casting briefs;

• Description generation – AI-assisted creation of casting descriptions;

• Engagement analysis – identification of active community members;

• Digital twin – generation of a stylised AI portrait (the “digital twin”) from the User’s face captures.

  7.2. AI technology providers. The Controller uses the services of the following AI providers, exclusively in inference mode (without sharing data for model training):

• OpenRouter, Inc. (USA) – the intermediary through which every AI model call passes; it forwards them to the model providers listed below;

• OpenAI, Inc. (San Francisco, USA) – GPT models, served directly or through Microsoft Corporation (Azure OpenAI, USA), and the GPT Image model for image generation, including the User’s “digital twin” portrait from face captures;

• Anthropic, PBC (San Francisco, USA) – Claude models;

  7.3. The User acknowledges that results generated by AI systems (including matching recommendations, AI Assistant responses, generated descriptions) may contain inaccuracies, errors or imprecisions. The Operator will make reasonable efforts to ensure the quality of AI outputs; however, it does not guarantee their accuracy, completeness, or fitness for a particular purpose. The Operator shall not be liable for decisions made by the User on the basis of results generated by AI systems.

  7.4. AI providers do not use User data to train models. OpenRouter keeps the content of requests and responses in its logs for at least 3 months, and the providers of GPT models may keep data for up to 30 days for abuse monitoring. The Controller keeps copies of the content of AI requests and responses (without images) in Cloudflare R2 (EU jurisdiction) for diagnostics, quality control and the development of AI features, for the period stated in Section 10.

  7.5. Face data (the “digital twin” feature). The “digital twin” is an optional feature that a User may enable only after granting separate, explicit consent to biometric processing (Article 9(2)(a) GDPR). When enabled, the Application captures several photographs of the User’s face (front and semi-profile).

(a) Why face data is stored. The face captures are stored solely to generate a stylised AI portrait (the “digital twin”) displayed on the User’s own profile. The Controller does not run facial-recognition processing on the captures and does not create, extract or store any facial-recognition template or “faceprint”. The Controller does not use face data for identification, authentication, matching or surveillance.

(b) Third parties with whom face data is shared. To generate the digital twin, the face captures are transmitted to our image-generation provider OpenRouter, Inc. (USA), which passes them to the GPT Image model of OpenAI, Inc. (USA). The face captures (and the generated portrait) are stored by our cloud storage provider Cloudflare, Inc. (USA), acting as our processor under Article 28 GDPR.

(c) Whether these third parties store face data. OpenAI receives the face captures to perform the individual generation request and does not use them to train models; it may keep them for up to 30 days for abuse monitoring (Section 7.4), after which they are deleted. OpenRouter may keep a record of the request, including the transmitted captures, in its logs for at least 3 months (Section 7.4) and does not use it to train models. The copies of requests kept by the Controller contain no images. Cloudflare stores the face captures and the generated portrait only for as long as the User keeps the digital-twin feature enabled; they are deleted within 30 days after the User disables the feature or deletes their account (Section 10).

8. Sharing data with third parties

8.1. Data may be shared with the following categories of recipients:

• The Agency chosen by the Artist – within the scope of the Agency Services;

• Casting Clients (e.g. the producer or production company running a casting) – only applications to their casting, to the extent necessary for the casting process;

• IT providers – hosting, cloud (Article 28 GDPR);

• AI providers – OpenRouter as the intermediary, and OpenAI (also through Microsoft Azure; including image generation and the “digital twin”) and Anthropic; inference, no training (see Sections 7.2, 7.4 and 7.5);

• Communication providers – push, e-mail, SMS;

• Image/voice licensees – on the basis of separate licence agreements;

• Public authorities – on the basis of applicable law.

  8.2. The Controller does not sell personal data within the meaning of the GDPR or CCPA/CPRA. The Controller does not share data for the purposes of third-party behavioural advertising.

  8.3. The User acknowledges that after personal data has been shared with the Agency or with Casting Clients as part of the casting process, those entities become separate controllers of such data and bear independent responsibility for its further processing. The Operator shall not be liable for the actions of the Agency or Casting Clients acting as separate data controllers.

  8.4. An Agency sees only the Artists assigned to it. The materials of an application are not shared with an Agency the Artist did not name in that application. No Agency is a processor acting on the Operator’s behalf.

  8.5. Access to the data of all Users in the Application is limited to persons authorised by the Operator, acting on its instructions (Article 29 GDPR). Membership in an Agency does not by itself give such access.

9. International data transfers

9.1. Data may be transferred outside the EEA (including to the USA) in connection with the use of AI provider services. Safeguards:

• European Commission adequacy decisions (Article 45 GDPR), including the EU-US Data Privacy Framework;

• Standard Contractual Clauses (SCCs) pursuant to Decision 2021/914;

• Additional safeguards (Schrems II): encryption, pseudonymisation, Transfer Impact Assessment;

• For UK transfers: UK IDTA or UK Addendum to the SCCs as approved by the ICO.

  9.2. Copies of the safeguards are available upon request: [email protected].

10. Data retention periods

• Account and profile – duration of the account; erased within 30 days of an erasure request;

• Casting data – 12 months after the completion of the casting;

• Image licences – duration of the licence + 24 months;

• Face captures and generated “digital twin” portrait – while the digital-twin feature is enabled; deleted within 30 days of disabling the feature or account deletion;

• AI conversations – 12 months from the last interaction;

• Copies of AI request and response content (logs, without images) – 24 months;

• Technical data – 24 months;

• Accounting records – 5 years (statutory obligation);

• Data for pursuing claims – duration of the limitation period.

  10.2. Upon expiry of the retention period, data is permanently deleted or anonymised.

11. User rights (GDPR)

• Right of access (Article 15) – a copy of data + information about processing;

• Right to rectification (Article 16);

• Right to erasure (Article 17) – “right to be forgotten”;

• Right to restriction (Article 18);

• Right to data portability (Article 20) – JSON/CSV format;

• Right to object (Article 21);

• Right to withdraw consent (Article 7(3));

• Right to lodge a complaint – with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.

  11.2. Contact: [email protected]. Response within 30 days (Article 12(3) GDPR). The Controller may request identity verification.

12. Rights of US residents (CCPA/CPRA and state regulations)

12.1. This section applies to US residents. It supplements the Policy with rights under the CCPA/CPRA as well as VCDPA, CPA, CTDPA, UCPA, and TDPSA.

• Right to Know – information about categories and purposes of collection;

• Right to Delete – request for deletion of data;

• Right to Correct – correction of data;

• Right to Opt-Out – the Controller does not sell data and does not share it for behavioural advertising;

• Right to Limit Use of Sensitive PI – limitation to necessary purposes;

• Right to Non-Discrimination.

  12.3. CCPA requests: [email protected] with the subject line “CCPA/Privacy Request”. Response within 45 days.

13. Rights of UK residents (UK GDPR)

13.1. Supervisory authority: Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, SK9 5AF, www.ico.org.uk.

13.2. UK AADC (Children’s Code). For persons aged 13–17: default highest privacy protection, no marketing profiling, geolocation disabled, an age check based on date of birth, and parental/guardian consent obtained via a consent checkbox at sign-up.

13.3. Transfers from the UK: UK IDTA or UK Addendum to the SCCs as approved by the ICO.

14. Data security

• Encryption: TLS 1.3 (in transit) and AES-256 (at rest);

• RBAC – different access levels for Artists, Bookers, Clients;

• Regular security audits and penetration tests;

• Access monitoring (who, when, which data);

• Confidentiality clauses (NDA) for community members;

• Employee training on data protection.

  14.2. Data breach. The Controller will notify the President of UODO within 72 hours (Article 33) and Users where the breach results in a high risk (Article 34). The User acknowledges that no IT system can guarantee 100% security of data transmitted over the Internet, and uses the Application at their own risk in this regard.

15. Data Protection Impact Assessment (DPIA)

15.1. The Controller has conducted a DPIA (Article 35 GDPR) for: processing of image data by AI (potential biometric data), profiling of candidates, transfers to the USA.

15.2. Implemented measures: pseudonymisation of AI data, data minimisation, encryption, human-in-the-loop, consent withdrawal mechanism. The DPIA is updated at least once a year.

16. Children’s and minors’ privacy

16.1. Persons under 13 years of age may not create their own account. The system blocks self-registration based on date of birth. Where a child under 13 is represented on the platform, their profile is created and operated by a parent or legal guardian, who accepts this Policy on the child’s behalf; the child does not use the Application directly.

16.2. Persons aged 13–17 may use the Application only with the consent of a parent or legal guardian. This consent is obtained through a dedicated consent checkbox at sign-up (and when applying to castings). The Application does not currently carry out separate e-mail verification of guardian consent; responsibility for supervising the minor’s use rests with the consenting parent or guardian (see 16.3).

16.3. Parents/guardians who have given consent for the use of the Application by a person between 13 and 18 years of age bear responsibility for supervising the minor’s activity in the Application and accept this Policy on their behalf.

16.4. Contact: [email protected]. Compliant with COPPA (USA) and UK AADC (Section 13.2).

17. Cookies, tracking technologies, ATT / Privacy Sandbox

• Essential cookies – session, preferences (Article 6(1)(f) GDPR);

• The casting.studio website: we count visits with Plausible, without cookies and without identifying anyone; YouTube videos load only after a click, from the youtube-nocookie.com domain;

• Mobile identifiers – IDFA/GAID collected only with explicit consent.

  17.2. Apple ATT: The Application does not track Users (IDFA not collected). In the event of a change: a system ATT dialogue before tracking activation.

  17.3. Google Privacy Sandbox: GAID not used for tracking. Local analytics, compliant with Privacy Sandbox.

18. Application system permissions

18.2. The Application does not access contacts, location, calendar, or health data.

19. Account and data deletion

19.1. Erasure request: in the Application, Settings > Privacy Settings > Delete Account. Confirming sends us an erasure request. If the User cannot access the Application, the request may also be sent by e-mail to [email protected].

19.2. We carry out the request manually and permanently within 30 days of receiving it: the account, profile, portfolio, photos, videos and casting history are irreversibly removed from our databases and from our file and video storage providers. Exception: data required by law (for example accounting data, kept for 5 years). We send a confirmation e-mail once the deletion has been carried out.

19.3. The User acknowledges that the deletion is irreversible once performed and results in the permanent loss of access to all materials, casting history and associated data. There is no restoration period: a deleted account cannot be recovered. Until the request is carried out the account remains active and the User may continue to use it. The Operator shall not be liable for data loss resulting from account deletion at the User’s request.

19.4. Data from Facebook, Instagram and Messenger. A person who wrote to a Page served by Agent CS may request deletion of their messages and Meta identifiers by e-mail to [email protected], giving the Page and their name or Instagram handle; the instructions are at www.casting.studio/en/delete-account. A Page administrator can disconnect the Page at any time in Facebook Settings > Business Integrations, after which we delete the Page’s access tokens at once and its messages and comments within 30 days. We confirm every completed deletion by e-mail.

20. Limitation of the Operator’s liability

20.1. Services provided through the Application are made available on an “as-is” and “as-available” basis. To the fullest extent permitted by applicable law, the Operator makes no warranties, express or implied, including warranties of merchantability, fitness for a particular purpose, non-infringement of third-party rights, continuity of operation, freedom from errors, or completeness of data.

20.2. The Operator shall not be liable for:

• Damage resulting from acts or omissions of the User, including provision of untrue data, infringement of third-party rights, or failure to comply with this Policy;

• Damage resulting from the actions of Casting Clients, producers, directors, or other third parties to whom data was disclosed as part of the casting process;

• Lost profits, lost professional opportunities, lost remuneration, loss of reputation, or other indirect, consequential, incidental, or special damages, regardless of their legal basis (contract, tort, strict liability);

• Inaccuracies, errors, or imprecisions in results generated by AI systems, including matching recommendations, AI Assistant responses, and casting descriptions;

• Interruptions in the operation of the Application, data loss caused by technical failure, force majeure, or circumstances beyond the Operator’s control;

• Data security breaches caused by factors beyond the Operator’s control (hacker attacks, zero-day vulnerabilities, provider failures);

• Decisions made by the User on the basis of information obtained through the Application, including professional, financial, or personal decisions.

  20.3. The Operator’s total liability to the User on any basis related to the use of the Application is limited to the amount actually paid by the User to the Operator in the 12 months preceding the event giving rise to the damage, and in the absence of payment – to PLN 100 (one hundred zlotys).

  20.4. The User waives all claims against the Operator in respect of indirect, consequential, incidental, special, punitive, or exemplary damages (punitive damages). The above waiver applies to the fullest extent permitted by applicable law.

  20.5. Nothing in this Policy excludes or limits the Operator’s liability that cannot be excluded or limited under mandatory provisions of law, including liability for: (a) intentional infliction of damage, (b) death or personal injury caused by gross negligence, (c) breach of mandatory data protection regulations (GDPR, UK GDPR, CCPA/CPRA) to the extent that such regulations do not permit limitation of liability.

  20.6. The User undertakes to indemnify and hold harmless the Operator from and against all claims, demands, lawsuits, costs (including reasonable legal fees) arising from: (a) the User’s breach of this Policy, (b) infringement of third-party rights by materials uploaded by the User, (c) use of the Application in a manner inconsistent with its intended purpose.

21. Dispute resolution and jurisdiction

21.1. Pre-litigation mediation. Before initiating any court proceedings, the User undertakes to attempt to resolve the dispute amicably with the Operator. To this end, the User is required to send a written complaint to: [email protected], describing the claim, its factual basis, and the requested form of redress. The Operator will respond to the complaint within 30 days. The parties will negotiate in good faith for a period of at least 60 days from the date of delivery of the complaint.

21.2. Institutional mediation. If the dispute has not been resolved through negotiation (Section 21.1), either party may, before filing a lawsuit, refer the matter to mediation conducted by the Mediation Centre at the Court of Arbitration at the Polish Chamber of Commerce (Krajowa Izba Gospodarcza) in Warsaw, in accordance with its Rules. The costs of mediation shall be borne equally by the parties.

21.3. Jurisdiction. All disputes arising from this Policy or related to the use of the Application shall be governed by Polish law and subject to the jurisdiction of the common courts competent for the Operator’s registered office (Warsaw), subject to mandatory consumer protection provisions that may grant the User the right to bring proceedings before the court competent for their place of residence.

21.4. Time limit for claims. All claims of the User against the Operator related to the use of the Application or the processing of personal data must be submitted in writing within 12 months from the date on which the User became aware, or should have become aware with due diligence, of the circumstances giving rise to the claim. After this period, claims shall expire to the fullest extent permitted by applicable law.

21.5. Class action waiver. To the fullest extent permitted by applicable law, the User agrees that all claims against the Operator shall be pursued on an individual basis only. The User waives the right to participate in class actions, group actions, or representative actions against the Operator.

21.6. Severability. If any provision of this section is held to be invalid or unenforceable, the remaining provisions shall remain in full force and effect. The invalid provision shall be replaced by a provision closest to its economic purpose, to the extent permitted by law.

22. Changes to the Privacy Policy

22.1. The Controller reserves the right to amend the Policy in the event of changes to the law, Application functionality, supervisory authority recommendations, or technological developments.

22.2. Notification of material changes: push + e-mail + in-app banner, with 14 days’ advance notice.

22.3. Continued use of the Application after the changes take effect constitutes acceptance of the amended Policy. If the User does not accept the changes, they have the right to delete their account before the changes take effect.

23. Contact information and complaints

23.1. Agent CS sp. z o.o. (the Operator, the data controller), ul. Chelmska 19/21, 00-724 Warsaw. E-mail: [email protected], www: www.casting.studio.

23.2. Supervisory authorities:

• Poland/EU: President of UODO, ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl;
• UK: ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF, www.ico.org.uk;
• Other EU: the supervisory authority of the Member State of habitual residence (Article 77 GDPR).

24. Final provisions

24.1. This Policy enters into force on 19 September 2026.

24.2. Governing law: GDPR, the Polish Act on Personal Data Protection, UK GDPR, CCPA/CPRA, and other applicable regulations.

24.3. The Policy is available within the Application (Settings > Privacy) and at www.casting.studio/privacy.

24.4. The Polish version shall prevail in the event of any discrepancies with other language versions.

24.5. This Policy applies equally to the iOS and Android versions.

24.6. This Policy, together with the Application Terms & Conditions and any licence agreements, constitutes the entire agreement between the Operator and the User regarding the processing of personal data. All prior arrangements, representations, or agreements (oral or written) in this regard shall cease to apply as of the effective date of this Policy.

24.7. Failure or delay by the Operator in exercising any right under this Policy shall not constitute a waiver of that right.