Data processing agreement

Parties, roles and order of precedence

You are the controller (Art. 4(7) GDPR; Art. 5(j) of the Swiss Federal Act on Data Protection, DSG) for the personal data that reaches you via your application mailbox and via direct messages to your Instagram account. The mailbox and the account belong to you; you decide whether and for how long the platform accesses them.

Castgigs is your processor (Art. 28 GDPR; Art. 9 DSG, whose German wording is “Auftragsbearbeiter” — the German privacy policy and terms of use use that term; the meaning is the same) — exclusively for reading, storing, classifying, matching (section “Nature and purpose of processing”) and answering these messages on your behalf, as described in this agreement. Not covered by this agreement is what Castgigs does under its own responsibility: the creator profile that an applicant creates and owns via the link in the reply, and the connection between a creator profile and your company that the creator confirms via this link themselves. For this, Castgigs is itself the controller; the details are in the privacy policy. Creators are not parties to this agreement; the privacy policy applies to them.

This agreement supplements the terms of use. Insofar as it concerns processing on behalf, it takes precedence over them in the event of contradictions. It is concluded electronically: when applying as a company, by the person applying confirming that they may act for the company and ticking the agreement — it then applies from the approval of the application —, or by a person with the role ‘Owner’ or ‘Admin’ in your account under “Einstellungen → Auftragsverarbeitung” (settings → data processing). A person in one of these two roles confirms a new version in the account. Castgigs records who concluded it, when and in which version, and shows you this in the account. The written form is not required (Art. 28(9) GDPR); at your request, Castgigs can note a copy signed on paper in the account.

Your obligations

Only connect mailboxes and folders you are authorised to use. Inform affected employees and respect co-determination rights. Private messages or messages unrelated to campaigns must not be imported. Consent by the administrator of your Microsoft 365 organisation (for example “approve for the whole organisation”) does not replace a review under employee data protection law.

You only choose the inbox or the archive if the mailbox receives nothing but applications and collaboration requests — you confirm this when choosing with the sentence “This mailbox is used only for applications and collaboration requests” („Dieses Postfach dient nur Bewerbungen und Kooperationsanfragen.“). Anything that still does not belong here you remove with “Remove from Castgigs” („Aus Castgigs entfernen“).

As the controller, you are responsible for the lawfulness of the processing, in particular for the legal basis vis-à-vis the senders (Art. 6 GDPR) and for informing them (Art. 13 and 14 GDPR; Art. 19 DSG). The Instagram reply via the platform — automatic or approved by you — states in its header and footer that it is sent via Castgigs and links to the Castgigs privacy policy; your email replies are sent with the templates you determine — you add your own notices for your applicants there. You ensure that the mailbox and the Instagram account belong to you and that you may grant Castgigs access; that your instructions are lawful and given in good time; and that the people with the roles ‘Owner’ and ‘Admin’ in your account can be reached — the notifications under this agreement (breaches, new sub-processors, new versions) are sent to their email addresses.

Subject matter and duration

The subject matter is the processing of the messages arriving in the folders you have chosen in your connected application mailbox and of the direct messages to your connected Instagram account — for the purpose of recognising collaboration requests from creators, matching them to creators who are connected with you or whom you have blocked, and answering them on your behalf.

The agreement applies from its conclusion — if concluded when applying, from the approval of the application — for the duration of your user relationship with Castgigs. Processing on your behalf begins as soon as you connect the first channel (mailbox or Instagram account) and ends when you disconnect the last channel or the user relationship ends. After the end, only the obligations from the section “Deletion and return” remain. You can disconnect or pause any channel at any time in the settings; retrieval then ends immediately. Access tokens (Microsoft 365, Instagram) are deleted when disconnecting. You can change a stored mailbox password with your provider at any time — access then ends; Castgigs deletes the stored ciphertext on request and at the latest with the deletion under the section “Deletion and return”.

Nature and purpose of processing, data, data subjects

Nature and purpose

1. Retrieval and storage. From the connected mailbox (IMAP or Microsoft 365), the platform reads only the folders you choose. It retrieves the messages of the last 12 months from each chosen folder — or the shorter period you choose for that folder —, and after that every message that newly arrives in a chosen folder; it does not retrieve older messages. If you choose further folders or the platform has to re-read a folder, the same limit applies. You cannot choose folders for sent messages, drafts, trash or spam — those that the mail server marks as such or that are named so at the top level. The platform receives new direct messages to the connected Instagram account via Meta’s interface. It stores sender, recipients, subject, text, times (sending and receipt by the mail server), folder and attachments; the unaltered raw version of an email is kept in object storage. For automatic replies, delivery reports and spam only until deletion under point 2.
2. Classification. Rules recognise whether a message is an application or collaboration request. Messages that they do not classify as a request (such as automatic replies, emails from your own company, Instagram messages without a request) are not processed further by the platform — no reply and, except in the conversation with a connected creator (point 4), no matching. For automatic replies (out-of-office notices, emails marked as bulk mail), delivery reports and emails that your mail server has marked as spam, the platform deletes the content (sender name, recipients, subject, text, attachments, raw version) at the latest 24 hours after retrieval; a technical identifier remains (message identifiers, mailbox and folder, times, classification, sender address, sender verification, checksum) so that you can correct a misclassification. If you classify such an email as a request, the platform retrieves it again from your mailbox, provided it is still in the folder from which it was retrieved — even if you have since deselected that folder; it never alters, moves or deletes the original. Other messages that are not requests (replies to earlier messages, emails with very little text, emails via a distribution list, forwards from your company) are often applications after all and remain stored like application emails. Likewise, emails that belong to an application remain stored (emails from a sender whose application has not yet been matched to a creator profile, messages in a thread with an application, emails in the conversation with a connected creator). Deletion after 24 hours applies to emails retrieved on or after 29 September 2026.
3. No content analysis. The text of a message is stored and shown to you, but no program analyses its content: no values, no profile, no language model — the classification (point 2) only checks whether it is a request. No service provider reads application emails or direct messages, no creator profile is created or prefilled from a message, and the content of a message is not passed to any service provider for analysis.
4. Matching within your company. The platform only checks whether a sender is a creator who is connected with you or whom you have blocked — for emails via the confirmed address of this creator or the address with which they redeemed your link, together with the result of your mail server’s sender verification (SPF, DKIM, DMARC); for Instagram via the sender identifier from such a redemption or from an earlier message in the conversation. It does not compare against any other creator profiles on the platform. It shows you emails from connected creators in the conversation with them; it does not answer messages from blocked creators.
5. Reply according to your instructions. Depending on the mode set, no automatic reply is sent (“Aus” — off), the platform suggests a reply that a member of your account approves with one click (“Vorschlag” — suggestion), or sends it automatically (“Automatisch” — automatic) — from your mailbox or your Instagram account, with the templates you determine. The reply contains a link via which the sender can log in or register themselves and agree to the connection with your company (without a secret, valid for 14 days) — including a sender who already has a creator profile. When connecting your mailbox or Instagram account, you confirm that the automatic replies to applicants contain this link; whoever uses it and agrees connects their profile with you. A click by you does not connect anyone. Email replies are sent with your sender name from your mailbox; automatic Instagram replies state that they were sent automatically on your behalf.
6. Removing from Castgigs. You remove an individual email that does not belong here yourselves with “Remove from Castgigs” („Aus Castgigs entfernen“): the platform immediately deletes the text, attachments and raw version, any replies to it not yet sent, the same email in a second mailbox of your company and a forward that it recognises as a forward of this message (if that forward is itself a separate message, for example a request or in a conversation, only its raw version). If the email is in a conversation with a creator or a creator has connected via its link, a row without content remains with the sender address and identifier, because it carries the connection; you and the creator see “Removed from Castgigs by the company” („Vom Unternehmen aus Castgigs entfernt“) there. Nothing changes in your mailbox. Castgigs deletes an Instagram direct message that does not belong here on your instruction (section “Instructions”).
7. Deletion according to the periods in the section “Deletion and return”.

Types of data

• sender name, email address, Instagram identifier and username;
• subject, message text, times; for emails also recipients, receipt by the mail server, folder and attachments;
• information that the sender provides in the message text (channels, reach, audiences, location, topics, terms, links) — as part of the text, not as extracted values;
• technical email headers (message identifier, sending server, route, result of the sender verification SPF/DKIM/DMARC);
• your replies and the time they were sent.

Special categories of personal data (Art. 9 GDPR) are not the subject of the processing. If a message contains such information because the sender provides it voluntarily, it is treated like the rest of the text and deleted according to the same periods. Private messages, health data and personnel files of third parties must not be imported: choose folders in which such messages are not kept, and use “Remove from Castgigs” for any email that still comes in; Castgigs deletes such an Instagram message on your instruction.

Data subjects

• applicants and creators who write to you;
• employees of your company whose messages are in the mailbox or who forward messages;
• other senders to the mailbox or the Instagram account.

Instructions

Castgigs processes the data only on your documented instructions. This agreement is the first instruction; you give further instructions via the settings of your account, which Castgigs logs:

• connecting and disconnecting a mailbox or Instagram account, for a mailbox with the chosen folders and periods and every later change to them (for the inbox or archive, with your confirmation that the mailbox is used only for applications and collaboration requests), and stating from which point in time messages are answered;
• your confirmation when connecting that automatic replies to applicants contain a Castgigs link;
• the mode per channel — “Aus” (off), “Vorschlag” (suggestion) or “Automatisch” (automatic);
• the templates for automatic replies (email templates, Instagram reply text) and the sender details;
• approving or discarding an individual suggestion, blocking a sender and removing an individual email from Castgigs.

You send instructions outside the account in text form to datenschutz@castgigs.com. If Castgigs considers an instruction to be unlawful, we inform you without delay and may suspend its execution until you confirm or change the instruction. Castgigs does not process the data for its own purposes — with the one exception named in the section “Parties” and described in the privacy policy (creator profile and the connection confirmed by the creator themselves under its own responsibility).

Without your instruction, Castgigs only processes the data to the extent that the law of the Union, a Member State or Switzerland obliges Castgigs to do so — for example in the case of a disclosure to authorities or courts that Castgigs is legally obliged to make. In this case, Castgigs informs you of the legal requirement before processing, unless the law in question prohibits such information on important grounds of public interest (Art. 28(3)(a) GDPR).

Confidentiality

Castgigs treats the data confidentially. Only persons who need access for the service and who are bound to confidentiality have access; this obligation continues beyond the end of their activity. The operator only sees message content to the extent necessary to review an uncertain match, to fix a fault, to handle reported misuse or to provide support you have requested; operator access is only possible with a second factor, and its interventions are recorded in your company’s audit log (Annex 1).

Technical and organisational measures

Castgigs takes the measures under Art. 32 GDPR and Art. 8 DSG described in Annex 1 and keeps them state of the art. Castgigs may develop them further as long as the level of protection does not decrease; material changes are reflected in the privacy policy and in Annex 1.

Sub-processors

You authorise the sub-processors named in Annex 2. They are the only service providers that touch data from your mailbox or your direct messages. Castgigs concludes a contract with each of them that imposes the same data protection obligations on them as this agreement imposes on Castgigs, and remains responsible to you for them.

Not sub-processors of Castgigs are Microsoft (Microsoft Ireland Operations Limited) and Meta (Meta Platforms Ireland Limited): the mailbox at Microsoft 365 and the Instagram account belong to you, and you have granted Castgigs access to them. Both act on the basis of your own contracts with them — Microsoft as your processor, Meta under its platform terms and privacy notices —, not on our behalf.

If Castgigs wants to add or replace a sub-processor, we announce this at least 30 days in advance in the account and by email to the people with the roles ‘Owner’ and ‘Admin’ in your account. Within this period, you can object for an important reason under data protection law; if we then find no remedy, you can disconnect the channel concerned or end the user relationship.

Assistance: data subject rights, breaches, impact assessment

Data subject rights

If a sender requests access, rectification, erasure or restriction, Castgigs supports you with the information and functions of the platform: you see every message and every reply in the inbox, can block a sender, remove an individual email from Castgigs yourselves and request deletion. If a data subject contacts Castgigs directly, we forward the request to you without delay insofar as it concerns your processing — and answer it ourselves insofar as it concerns processing under our own responsibility.

Personal data breaches

Castgigs notifies you of any breach of the protection of the data processed on your behalf without delay, at the latest 48 hours after becoming aware of it, to the email addresses of the people with the roles ‘Owner’ and ‘Admin’ in your account — with the information required by Art. 33(3) GDPR insofar as it is known at that time, and supplements it as soon as further information is available. Castgigs supports you in notifying the supervisory authority and in informing the data subjects.

Data protection impact assessment

If you need a data protection impact assessment (Art. 35 GDPR; Art. 22 DSG) or a prior consultation for the processing, Castgigs provides the information on the processing that can be found in this agreement, the privacy policy and the annexes, and answers further questions within a reasonable period.

Evidence and audits

Castgigs makes available to you all information you need to verify compliance with this agreement: Annexes 1 and 2 in the version in force, the privacy policy, on request the contracts with the sub-processors (insofar as they do not contain trade secrets of third parties) and extracts from the audit log that concern your company.

You can check compliance yourself or through an auditor bound to confidentiality — after announcement with reasonable notice (usually 14 days), at most once a year, unless a specific reason requires more. The audit takes place during normal business hours, does not disrupt operations and is limited to processing on your behalf. Castgigs may replace an audit with proof of a recognised certification or a current audit report, insofar as it answers the questions of the audit.

Deletion and return

The data is deleted according to the periods of the privacy policy — they also apply unchanged to processing on your behalf:

• Application emails including raw version and attachments: at most 24 months after receipt. Deletion under this period currently takes place on request and in the operator’s review runs; an automatic run is planned.
• Automatic replies, delivery reports and spam: the content (sender name, recipients, subject, text, attachments, raw version) at the latest 24 hours after retrieval, automatically (run every 10 minutes); the identifier like application emails. Applies to emails retrieved on or after 29 September 2026. The other emails that are not requests like application emails.
• Emails removed from Castgigs: text, attachments, raw version and replies not yet sent immediately on removal; of replies already sent, only the recipient, time and delivery status remain. Outside a conversation and without a connection via its link, a checksum of the message identifier remains so that the email is not stored again, until twelve months and one day after its receipt; otherwise a row without content like an application email. The email in your mailbox is not affected.
• Instagram direct messages: messages that are not requests after 24 hours; requests without a connection to a creator profile: text, username and matching after 90 days, the sender identifier is replaced by its hash; the record (message identifier, hash, times) after 12 months; messages that have become part of a connection with a creator profile after 24 months; the log of deliveries after 14 days. An hourly run applies these periods automatically.
• Access tokens (Microsoft 365, Instagram): immediately when the channel is disconnected. A stored mailbox password on request, at the latest with the deletion after the end of the user relationship; until then, you can change it with your provider, which ends access.
• Database backups: 30 days rolling; deleted information may still be contained in a backup for up to 30 days after deletion. Backups are not analysed but only used to restore after an outage.

If you disconnect a channel, retrieval ends immediately; messages already stored remain readable in the inbox and are deleted at the latest when the periods named expire (Instagram automatically, application emails in the operator’s review runs) — earlier if you request it.

If the user relationship ends, Castgigs deletes all data processed on your behalf within 30 days of the end — without you having to request it separately —, except to the extent that a statutory retention obligation prevents this, and confirms the deletion to you on request. If you would rather receive the data beforehand, tell us before the end: Castgigs then provides a copy of the stored messages and replies and deletes afterwards. Any other return is not necessary because the originals remain with you: Castgigs reads the emails in your mailbox and the messages in your Instagram account, but does not move or delete them there.

The deletion does not cover the data that Castgigs holds under its own responsibility (creator profiles and the connections confirmed by creators); the privacy policy applies to it.

Transfers to third countries

The data is located in Germany (servers and database) and in the EU (object storage with binding EU jurisdiction). Castgigs processes it from Switzerland, which from the perspective of the GDPR is a country with an adequate level of protection; from the perspective of the DSG, this applies to the EU and EEA states.

Data from your mailbox only reaches the USA via one sub-processor: Cloudflare (management of the object storage; the objects themselves — raw emails, attachments, backups — remain in the EU). No service provider receives the content of a message for analysis. The basis is the EU-U.S. Data Privacy Framework or the Swiss-U.S. Data Privacy Framework, insofar as the service provider is certified there, and in addition the standard contractual clauses of the European Commission in the version recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) for Switzerland. No other transfer to a third country takes place without your instruction — subject to a legal obligation as described in the section “Instructions”.

Liability

The section “Liability” of the terms of use applies to liability. Liability towards data subjects under Art. 82 GDPR remains unaffected: Castgigs is liable to them for damage caused by processing in which Castgigs has not fulfilled its obligations as a processor or has acted contrary to your lawful instructions. Internally, each party is liable for the share attributable to it.

Applicable law, place of jurisdiction, final provisions

Swiss law applies, excluding the conflict-of-law rules. The place of jurisdiction is Zurich, Switzerland. Mandatory provisions of the data protection law applicable to your processing — namely the GDPR for companies in the EU and the EEA — remain unaffected by this choice of law; where they require more than this agreement, they apply.

Castgigs may amend this agreement if the processing, the service providers or the legal situation change. A new version is shown in the account; your existing conclusion remains valid, and a person with the role ‘Owner’ or ‘Admin’ confirms the new version in the account. If a change mandatorily requires your renewed consent, Castgigs says so when announcing it and sets a deadline.

Should a provision be invalid, the rest of the agreement remains valid; the invalid provision is replaced by the provision that comes closest to the requirements of Art. 28 GDPR and Art. 9 DSG. The German version is authoritative; this English version is a translation. We answer questions about this agreement at datenschutz@castgigs.com.

Annex 1: Technical and organisational measures

The measures correspond to the section “Data security” of the privacy policy:

• Encrypted transmission. All connections to the platform run over HTTPS; retrieval and sending via your mailbox over TLS according to your setting (default: on; always for Microsoft 365); the interfaces of Microsoft and Meta are addressed exclusively over HTTPS.
• Encrypted access data. Mailbox passwords, access tokens (Microsoft, Instagram) and second-factor secrets are stored in the database with envelope encryption; the key for this is not stored in the database. They are only read by the retrieval and sending process and never shown in the interface.
• Tenant separation in the database. Every query runs under the role of the acting person with row-level security rules. Your messages cannot be read by other companies even in the event of an application error; operator access runs via a separate database role with justification.
• Role-based permissions. Within your company, fixed roles determine who may connect the mailbox and Instagram account, set the mode, approve suggestions, manage the team or only read.
• Second factor. Operator access is only possible with a second factor (TOTP); it is optionally available for your accounts. After repeated incorrect logins, an account is temporarily locked.
• Audit log. Security-relevant actions — including connecting and disconnecting a channel with the chosen folders and periods and their later changes, every change of mode, every approval, every email removed from Castgigs (without content), every operator intervention and the conclusion of this agreement — are recorded in a log whose entries are cryptographically chained and which cannot subsequently be altered or shortened.
• Backups. Daily database backups, 30 days rolling, in object storage with protection against deletion and with separate access data for application and backup.
• Files. Attachments and raw emails are stored in private object storage and only delivered via short-lived signed addresses; attachments are scanned for viruses and only released afterwards.
• Location. Servers and database at Hetzner in Falkenstein, Germany; object storage at Cloudflare with binding EU jurisdiction.
• Minimisation. IP addresses and browser identifiers are only stored as a hash; the content of a message is not passed to any service provider for analysis (no language model); Instagram posts are not retrieved, direct messages only for the connected and enabled account.

Annex 2: Sub-processors

Only the service providers that touch data from your mailbox or your direct messages — the complete list of all service providers of the platform is in the privacy policy:

Microsoft and Meta are deliberately not on this list (section “Sub-processors”). The virus scan runs on the platform’s own server; no file leaves the platform in the process.