Privacy Policy

1. Introduction and Data Controller Details

CastFast (cast-fast.com) is a fashion and photo casting marketplace that connects casting directors, models, talent, agencies, and clients to facilitate professional booking and talent selection. CastFast is operated by Smart Associates Limited, a limited company registered in the United Kingdom.

This Privacy Policy explains how we collect, use, disclose, and otherwise process personal data and special category data through the CastFast platform, website, mobile applications, and all associated tools and services (collectively, “the Platform”).

Smart Associates Limited is the data controller for the personal information collected through the Platform, unless otherwise stated. We are committed to processing your personal data lawfully, fairly, and transparently, in compliance with:

• The UK General Data Protection Regulation (UK GDPR)
• The Data Protection Act 2018 (DPA 2018)
• The Privacy Act 2020 (NZ) (for users in New Zealand)

2. Information We Collect

We collect personal data and special category data from various sources. The specific information collected depends on how you use the Platform and your role (Talent, Client, Casting Director, Agency, or Administrator).

2.1 Account Registration Data

When you register an account, we collect:

• Full name, email address, and phone number
• Date of birth (where provided)
• Postal address and geographic location
• Username and password (securely hashed)
• Account type and role
• Professional title or business name

2.2 Profile Data and Special Category Information

If you register as Talent or submit a casting profile, we collect:

• Professional headshots and portfolio photographs
• Physical attributes and measurements (height, weight, dress size, shoe size)
• Hair colour and eye colour
• Ethnicity and cultural background
• Special skills and talents
• Professional experience and credentials
• Union membership

2.3 Booking and Transaction Data

When you create, respond to, or complete a booking or casting call, we collect booking dates, casting call details, rate and compensation agreed, and booking status information.

2.4 Payment and Financial Information

We collect financial information necessary to process payments, including bank account details, payment method information, and invoice history. Payment processing is handled by third-party payment service providers. We do not store full payment card details on our servers.

2.5 Usage Data and Analytics

We automatically collect information about your interactions with the Platform, including IP address, browser type, pages visited, and geographic location derived from IP address.

3. How We Use Your Information

3.1 To Perform Our Contract with You

We process your data to create and manage your account, process bookings and casting calls, process payments, and provide customer support.

3.2 For Our Legitimate Interests

We process your data to improve the Platform, conduct analytics, prevent fraud, enforce our Terms of Service, and protect against legal liability.

3.3 Based on Your Explicit Consent

We process special category data (ethnicity, physical attributes, photographs) based on your explicit consent under Article 9(2)(a) UK GDPR. You may withdraw consent at any time.

3.4 To Comply with Legal Obligations

We process data for tax reporting and compliance, with a 6-year retention period for business records under UK tax law.

4. Special Category Data

The Platform processes special category data as defined by Article 9 UK GDPR, including ethnicity, photographs that may reveal racial or ethnic origin, and physical measurements processed in combination with ethnicity information.

The legal basis for processing special category data is explicit consent (Article 9(2)(a) UK GDPR). This consent is obtained at the point of profile creation and can be withdrawn at any time.

5. Data Sharing and Disclosure

We may share your personal data with:

• Other Users of the Platform (e.g., casting directors viewing talent profiles)
• Agencies that represent you
• Payment processors
• Service providers who assist in operating the Platform
• Law enforcement or regulatory authorities when required by law

When agencies receive talent data through the Platform, they become independent data controllers for that data, subject to their own obligations under data protection law.

6. Data Retention

We retain your personal data for as long as necessary to fulfil the purposes set out in this Privacy Policy. Specific retention periods include:

• Account data: retained for the lifetime of your account plus 6 years after closure
• Booking and transaction records: 6 years (UK tax law compliance)
• Marketing consent records: retained until consent is withdrawn
• Usage data and analytics: 2 years

After the applicable retention period, personal data will be securely deleted or anonymised. Business records (including agency names and transaction records) are retained as a matter of permanent business record.

7. International Data Transfers

Where we transfer personal data outside the UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the ICO, adequacy decisions, or binding corporate rules.

8. Your Rights

Under the UK GDPR, you have the following rights:

• Right of access — request a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data (subject to legal retention obligations)
• Right to restriction — limit how we process your data
• Right to data portability — receive your data in a structured format
• Right to object — object to processing based on legitimate interests
• Right to withdraw consent — withdraw consent for special category data processing

The right to erasure is subject to exemptions for data retained for legal or tax obligations (6-year retention period under UK tax law).

9. Cookies and Tracking Technologies

We use cookies and similar technologies to provide and improve the Platform. These include strictly necessary cookies, performance cookies, and functionality cookies. You can manage your cookie preferences through your browser settings.

10. Security

We implement appropriate technical and organisational measures to protect your personal data, including encryption in transit and at rest, access controls, regular security assessments, and incident response procedures. In the event of a personal data breach, we will notify the ICO within 72 hours where required.

11. Children and Young People

Users under 16 are not permitted to create accounts. Users aged 16–17 may register with parental or guardian consent. Enhanced protections apply to under-18 accounts.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email and by posting a notice on the Platform. Continued use of the Platform after changes take effect constitutes acceptance of the updated policy.

13. Contact Details

Data Controller: Smart Associates Limited

To exercise your data protection rights or raise a concern, please contact us at: privacy@cast-fast.com

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

• Website: ico.org.uk
• Telephone: 0303 123 1113