Data processing agreement

Status

This draft follows the structure of Art. 28(3) GDPR and describes what CastTool actually processes today. It forms part of the terms and applies from the creation of the account once it has been reviewed. Its annex is the page on technical and organisational measures (TOMs).

1. Parties

The controller is the customer, meaning the agency or casting office. The processor is the operator named above. open: company

2. Subject matter and duration

The subject matter is running the platform for the customer. The DPA applies for as long as the contract runs and beyond that until the data has been deleted under section 11.

3. Nature and purpose of processing

• Storing and showing data in the dashboard, the model portal and client accounts
• Publishing approved profiles and images on the customer's website
• Processing uploaded images and videos: checking the content, removing metadata such as GPS, generating image sizes
• Generating PDFs: comp cards, offers, invoices
• Sending email on the customer's behalf
• Receiving applications, inquiries and approvals through forms and links
• Export and deletion on the customer's instruction
• Backups and troubleshooting

4. Types of personal data

The customer decides which fields to use. Possible data:

• Models and applicants: name, contact details, date of birth, gender, measurements, location, languages, talents, photos and videos, availability, bookings, consents with version and time
• Identity documents of models: ID card, passport, driving licence, visa and residence permit
• Ethnic origin, if the customer uses these fields. These are special categories under Art. 9 GDPR. open: whether and how these fields remain
• Parents of minors: name, email address and the proof of approval with typed name, time, browser and a key derived from the IP address
• Clients and contact persons: name, company, contact details, inquiries, offers, bookings, invoices, access to the client account
• The customer's staff: name, email address, role, sign-in log with time, IP address and browser
• Website visitors: details entered in forms, contents of cart and saved list

5. Data subjects

Models and applicants including minors, their parents, the customer's clients and contact persons, the customer's staff and visitors to the customer's website.

6. Instructions

CastTool only processes the data on the customer's instructions. The instructions follow from this agreement and from using the features. The customer gives further instructions in text form. open: channel for instructions If CastTool considers an instruction unlawful, CastTool tells the customer.

7. Confidentiality

Everyone at CastTool with access to the data is bound to confidentiality. The platform only accesses a customer's account through a dedicated feature that is limited to one hour, requires a second factor and is visible in the account. Every intervention by the platform is logged with the person and the target. open: who at CastTool has access and how the commitment is made

8. Technical and organisational measures

The measures are set out in the TOMs annex. CastTool may adapt them as long as the level of protection doesn't fall.

9. Sub-processors

The customer agrees to the following sub-processors. CastTool informs the customer in advance about new ones, and the customer can object. open: notice and objection period, review of the contract with each provider

This doesn't include Stripe for online payments by an agency's clients. Those run through the agency's own Stripe account and its own contract with Stripe.

• Server and database: open: provider and location of the server
• Backups of the database and files: Hetzner Storage Box according to the operations documentation, open: location
• Delivery, DNS, protection against attacks, Turnstile and custom domains: Cloudflare
• Sending email: Mailgun, EU region
• Error tracking: GlitchTip, open: who runs it and where
• Suggestions when entering addresses in website forms, only with the visitor's consent: Google Maps. open: processing on behalf or Google's own responsibility

10. Supporting the customer

CastTool supports the customer with requests from data subjects. The product offers an export of all data, deletion of models, clients and the whole account, and the consent log with versions. CastTool also supports the customer with security, breach notifications and impact assessments. open: payment for support beyond the product

11. Deletion and return

Before the end, the customer can export all data. If the customer requests deletion, CastTool deletes the account with all data and files 30 days after the request. If the account is suspended for non-payment, this period starts by itself 60 days after the suspension.

Data only disappears from backups once the backup is overwritten. open: retention of backups An account with invoices can't be deleted until the retention of invoices has been settled. open: retention of invoices

12. Personal data breaches

CastTool notifies the customer of a personal data breach without undue delay after becoming aware of it, with the details the customer needs for their own notification. open: deadline and channel

13. Evidence and audits

CastTool makes available to the customer the information needed to demonstrate compliance with this agreement. open: on-site audits, costs, third-party reports

14. Minors and marketplace

Profiles of minors are not public by default and need parental approval. Whether this process is legally sufficient still has to be reviewed.

The marketplace is switched off. Before it opens, it has to be settled who is responsible there and what this agreement needs to say about it. open: responsibility in the marketplace