Privacy policy

Controller and contact

The controller for data processing on castgigs.com is:

For all data protection matters — access, rectification, erasure, withdrawal of consent, questions — an email to this address is sufficient. Further information about the operator is in the legal notice.

Representative in the European Union

Because the platform also offers services to people in the EU, the operator has appointed a representative in the Union under Art. 27 GDPR. People in the EU and the EEA as well as the supervisory authorities there can also contact the representative on all questions about the processing of their data — by post or email; the representative forwards enquiries to the operator, who answers them:

Scope and applicable law

The operator is based in Switzerland. The processing is therefore governed by the Swiss Federal Act on Data Protection (FADP, in German DSG) in the version in force since 1 September 2023. Since the platform also offers services to people in the European Union and the European Economic Area — in particular in Germany and Austria — the General Data Protection Regulation (GDPR, Art. 3(2)) also applies. Where this policy names legal bases under the GDPR, they apply to people in the EU and the EEA; the FADP has no exhaustive list of legal bases, but requires the same purpose limitation, proportionality and transparency, which this policy adheres to.

The policy applies to the website castgigs.com with all its subpages, to the application after login and to the emails the platform sends. It does not apply to third-party websites that are linked (company websites, Instagram, TikTok, YouTube, Microsoft, Meta) — their own privacy notices apply there.

Who this policy applies to

The platform knows seven groups of people whose data it processes:

• Visitors — anyone who opens the public pages (home page, company directory, these legal pages) without logging in. Section “Visiting the website”.
• Senders of the contact and agency forms — anyone who writes to us via the contact form or the agency enquiry form. Section “Contact and agency enquiries via the website”.
• Creators — content creators who apply via the form or create a profile via a link in a reply email, and who then use the platform with their profile. Sections “Applications and enquiries via the forms” and “Creator profile” to “Instagram connection”.
• Applicants by email or Instagram — anyone who sends a company that uses the platform an application or collaboration request to its mailbox or as an Instagram direct message to its connected Instagram account. Sections “Applications by email” and “Instagram direct messages to companies”.
• Employees of companies (“customers”) — people who manage an account for a brand or agency, review creators and communicate with them, people whom a company invites to its account, as well as people who enquire for a company via “Als Marke anfragen” (enquire as a brand) or are named in it as part of its management. Sections “Applications and enquiries via the forms”, “Mailbox connection” and “Customer accounts and company data”.
• People shown in images — anyone who can be seen in a photo on our website. Section “People in images on the website”.
• People who report and people reported — anyone who reports content to us under the DSA, and anyone whose content is reported. Section ‘Reports under the DSA’.

In this policy, “company” or “customer” means a brand or agency with an account on the platform. Parents or guardians of minor creators are dealt with in the section “Creator profile”.

Visiting the website

Server logs

Whenever a page is opened, the server processes the IP address, the time, the address opened, the referrer (if the browser sends it) and the browser identifier. This information is kept in server logs that operation and troubleshooting require — for example to trace an attack or a crash. The logs are rotated by size and continuously overwritten in the process; they are not analysed to track people. Requests to login links from emails are deliberately not logged, because the link contains a secret.

Legal basis: legitimate interest in secure and functioning operation (Art. 6(1)(f) GDPR; Art. 31(1) FADP).

Language of the home page

If you open the home page castgigs.com from outside our website, the server reads the language that your browser sends with every request (Accept-Language) and the referrer. If your browser lists English before German and the home page is fully or partly translated into English, we redirect you to the English home page /en; anything not yet translated there appears in German. Nothing is stored in the process — no cookie, no identifier; you can return at any time with the language switch “DE” at the top right or in the footer. Legal basis: legitimate interest in a website in your language (Art. 6(1)(f) GDPR; Art. 31(1) FADP).

Hosting

The platform runs on a server of Hetzner Online GmbH at the Falkenstein site, Germany; the database is also located there. Uploaded files (photos, videos, documents) and the raw versions of incoming emails are kept in the object storage Cloudflare R2 with binding EU jurisdiction. Both providers work for us as processors (section “Recipients”).

Counting on the home page

At the top of the home page there is an opener consisting of a heading, a sentence and a button. To find out which opener is easier to understand, we sometimes show several of them in equal shares (a test). Only while a test is running do we count: which opener was shown in which language and whether its button, one of the ways to get in touch (such as the contact button) or one of the buttons leading to more information for brands or for creators was clicked afterwards, and whether a contact or agency form on the home page was submitted. We do not count anyone who is logged in, sees the page via a preview or sends a cookie of this website that applies to the home page, such as the login cookie (section “Cookies”).

Nothing is stored on your device for this — neither a cookie nor anything in local storage. The server draws which opener appears afresh on every visit; you are not recognised. After the opener is shown and after one of these clicks, your browser sends a short message to our server. It contains only a signed note — test, opener, language, day and a random value so that nothing is counted twice — and the type of event. The random value is an identifier of this one page view. It comes to your browser with the page, is not stored on your device, and we keep it in memory for at most 24 hours, only to discard duplicate messages. We never store it with the totals. If you submit a form on the home page, a hidden field in it names only the opener shown and its language — no random value and no identifier. We count this when your enquiry arrives and do not store it with your enquiry. Your IP address is not part of the count: it is only processed briefly in memory to prevent misuse, hashed with a random value that changes daily and is not stored anywhere. The browser identifier (user agent) that every request carries is only compared briefly with a list of known machines and is not stored. These messages are not logged; if our server briefly fails, an error line may be created that contains neither your IP address nor your browser identifier. Opening the page itself is recorded in the server log like any other page request (above).

Only daily totals per test, day, opener, language and event are stored, i.e. figures such as “opener B, German, one day: 412 views, 9 clicks” — no information about individual visitors. The purpose is an understandable home page. Legal basis: legitimate interest in an understandable, effective website (Art. 6(1)(f) GDPR; Art. 31(1) FADP). We delete the totals 24 months after the end of the test.

You can object without setting anything we would have to store: if your browser sends the “Global Privacy Control” or “Do Not Track” signal, the page does not count you. Without JavaScript we count no views or clicks; submitting a form on the home page is counted even without JavaScript. You can also object to the counting on grounds relating to your particular situation via datenschutz@castgigs.com.

The website does not use third-party analytics services, advertising or tracking cookies, social media plugins, or fonts or libraries embedded from third-party servers. What the browser loads comes from our own server. Files from our object storage Cloudflare R2 (EU jurisdiction; section “Recipients and processors”) — uploaded images, videos and documents, company logos and images from connected Instagram accounts — are loaded via a short-lived, signed address directly from there, and when uploading, the browser sends a file directly there; Cloudflare receives your IP address and browser identifier in the process. The website loads only one thing from a third-party service: the bot protection on the forms for applications, enquiries and “Passwort vergessen” (forgot password), described below.

Bot protection (Cloudflare Turnstile)

The forms “Als Creator bewerben” (apply as a creator), “Als Marke anfragen” (enquire as a brand) and “Passwort vergessen” (forgot password) use Cloudflare Turnstile, a bot protection intended to fend off automated mass requests (such as mass applications or password reset emails). As soon as you open one of these pages, your browser loads a script directly from Cloudflare. The script runs small checks in your browser and reads technical information from your browser in the process (access to your device). Cloudflare receives your IP address, technical characteristics of the browser and the connection (such as the browser identifier) and the website on which the check is running, and uses them to recognise whether a human is filling in the form. When the form is submitted, our server asks Cloudflare whether the check was passed and passes on your IP address. Our website does not set a cookie for the bot protection; which cookies Cloudflare uses in its own check window is described in Cloudflare’s cookie policy. You can prevent the script from loading, for example with a content blocker in your browser; the form can then not be submitted.

Cloudflare uses this data in two roles. For protecting our forms, Cloudflare is our processor. In addition, Cloudflare uses it to improve its bot detection; for this, Cloudflare is an independent controller and relies on its own legitimate interest (Cloudflare’s “Turnstile Privacy Addendum”: www.cloudflare.com/turnstile-privacy-policy). That your data reaches Cloudflare at all when you open the page is caused by our embedding of the script; we are responsible for that. The provider is Cloudflare, Inc., USA (sections “Recipients and processors” and “Disclosure abroad”).

The legal basis for our processing of your data is our legitimate interest in protecting the forms against automated mass requests (Art. 6(1)(f) GDPR; Art. 31(1) FADP). We consider the access to your device strictly necessary to protect the form you want to submit against misuse (section 25(2) no. 2 TDDDG; section 165(3) TKG 2021); we do not ask for your consent for it. If the check is not passed, our server rejects the form.

People in images on the website

On our website we show images to illustrate what Castgigs offers. Some of them show example people generated by AI; each of these images bears the notice “AI-generated example person” (on the German pages “KI-generierte Beispielperson”). If we show photos of real, identifiable people — such as creators, employees or models —, this section applies.

Which data. The image itself (the person’s appearance), a short image description (alternative text) and, where the image shows a name, the first name or an abbreviation. When uploading, we remove camera and location data (EXIF); only the information on the origin of the file (such as “generated with AI”) is kept. If a file carries a proof of origin (C2PA), we keep the unaltered original internally; it is never delivered.

Purpose and legal basis. We only show a photo of an identifiable person with their consent (Art. 6(1)(a) GDPR; Art. 31(1) FADP) or on the basis of a contract with them that expressly covers publication on our website (Art. 6(1)(b) GDPR). The purpose is to present what we offer. Without consent or a contract, we do not show identifiable people; we do not show images of minors.

Withdrawal. You can withdraw consent at any time with effect for the future, informally by email to datenschutz@castgigs.com. We then remove the image from the website and from our image collection within 7 days; it is deleted as described under “Retention periods”.

Recipients. The image files are kept with our storage provider and delivered via our servers (section “Recipients”). On the website, they can be retrieved by anyone; search engines can index them, third parties can copy them. After removal, such copies and caches (browsers, search engines) may still exist for some time; we have no influence over them.

Retention. As long as the image is on the website or in our image collection (media library). After removal, it stays in the bin for 30 days and is then deleted automatically — longer only as long as an expressly named earlier version of the website still shows it. We keep earlier versions of the website for at most 12 months, named ones until their name is removed (table “Retention periods”, rows “Images on the website” and “Earlier versions of the website”).

Your other rights — such as access, rectification, erasure and complaint to a supervisory authority — are set out in the section “Your rights”.

Applications and enquiries via the forms

Creators: “Als Creator bewerben” (apply as a creator)

The application form asks for: stage name or handle, first and last name, email address, mobile number, date of birth, gender, address, languages, willingness to travel, the channels with approximate reach, the desired visibility, the voluntary consents (image rights, campaign notifications) and your confirmation that you accept the terms of use and have taken note of this privacy policy. Initially, the form only creates an enquiry; a person at the operator decides on approval. Only with approval is a profile created.

Companies: “Als Marke anfragen” (enquire as a brand)

The enquiry form asks for: company, registered company name, address, optionally VAT number, website, register court and number, management, plus first and last name, email address and mobile number of the contact person and the confirmation that the company accepts the terms of use and has taken note of this privacy policy, and the declaration that the person may act for the company and concludes the data processing agreement — with version, time, name and email address of the person making the declaration (also for a further company from an existing account). Here too, a person decides on approval; the company and the first user account are then created from the enquiry, and the conclusion of the data processing agreement is recorded with these details in the company’s log.

Switching language while filling in a form

If you switch the language with the language switch “DE | EN” while filling in the application or enquiry during registration, your browser briefly keeps what you have entered so far in the session storage of this browser tab (sessionStorage); the page in the other language fills it in again so that nothing is lost. Passwords, confirmation codes, the data of the bot protection and the ticks for consents and confirmations are never kept — you set these again in the new language. Your entries do not leave your browser in the process; they only reach us when you submit the form. The page in the other language deletes them as soon as it has filled them in; entries older than 10 minutes are no longer filled in and are deleted. When you close the tab, your browser discards the session storage anyway. If you do not want this, choose the language before filling in the form. We use your browser’s storage for this only after you click the switch; we consider this strictly necessary to offer the language switch you requested without losing your entries (section 25(2) no. 2 TDDDG; section 165(3) TKG 2021); we do not ask for your consent for it. The legal basis for briefly keeping your entries is our legitimate interest in preserving them when you switch language (Art. 6(1)(f) GDPR; Art. 31(1) FADP).

Confirmation of mobile number and email address

After submission, we send a code by SMS to the mobile number and a code by email. The SMS is sent by Twilio (Twilio Inc., USA) via the Twilio Verify service; for this, Twilio receives the mobile number and generates and checks the code. No enquiry is processed without a confirmed mobile number and email address. Enquiries that are not confirmed within 48 hours are deleted automatically.

Confirmed enquiries remain until we have decided on them. We delete a rejected enquiry 6 months after the rejection. We keep an approved enquiry as a record of the registration for as long as the creator profile or company account created from it exists, and delete it together with that account. Deletion is automatic in each case.

Protection against misuse

Per sender (email address or IP address), we accept at most three enquiries a day, and at most three SMS per hour per enquiry. For this, we store a hash of the IP address — not the address itself — and delete it after 24 hours. The forms also contain a hidden field that only automated programs fill in (honeypot), and the bot protection described in the section “Visiting the website”.

Address suggestions

When you type the address, the form suggests addresses and marks an address taken over as verified. The suggestions come from HERE (HERE Europe B.V., Netherlands); for this, HERE receives the part of the address typed and the country selected, not your name. If HERE is not set up, the suggestions come from Photon (komoot GmbH, Germany, based on OpenStreetMap). In both cases, the request goes via our server; your IP address is not transmitted to the provider.

Legal basis: if you apply as a creator, or enquire via “Als Marke anfragen” as a sole trader for your own business, the legal basis for the details needed for this is the initiation and performance of the user contract with you (Art. 6(1)(b) GDPR). If you enquire on behalf of another company, for example as an employee of a corporation, the legal basis is our legitimate interest in initiating a contract with the company and, for this purpose, in contacting you as its contact person (Art. 6(1)(f) GDPR; Art. 31(1) FADP). If the enquiry names you as part of the company’s management, we only process your name as part of the company details with which we create the company on approval (also point (f)). For voluntary details, the legal basis is our legitimate interest in using them for the intended collaboration, and for protection against misuse our legitimate interest in operating the forms securely (point (f) in each case); for the bot protection, see “Bot protection (Cloudflare Turnstile)” in the section “Visiting the website”. We base keeping the approved enquiry as a record on our legitimate interest in being able to prove the registration and the acceptance of the terms of use (point (f)); recording the conclusion of the data processing agreement on our legitimate interest in being able to prove it, as data protection law requires for this agreement (point (f)).

Contact and agency enquiries via the website

Some pages of our website contain two forms you can use to write to us without registering: a contact form for general messages and an enquiry form for agencies that look after several brands. Applying as a creator and enquiring as a brand use the registration with its own forms (section “Applications and enquiries via the forms”); this section does not apply to them.

Which data. With the contact form: your name, your email address, your message and, if you give one, a subject. With the agency enquiry form: the name of the agency, the contact person, the email address, the message and, if you give them, the agency’s website and the number of brands looked after. We also store on which page and in which language the form appeared, when the enquiry was received, when you confirmed your email address and when we completed the enquiry. Please do not include especially sensitive data (for example about health) in the message — we do not need it.

Confirmation by link. After submission, we store the enquiry and send you an email with a link. We only respond to the enquiry once you have confirmed your address with it — so an enquiry that someone without access to your mailbox has submitted under your address remains unanswered; you then only receive this email. The link is valid for 48 hours; without confirmation, we then delete the enquiry automatically.

Protection against misuse. We do not use a third-party service for this. Per email address and per IP address, we accept at most three enquiries within 24 hours; anything beyond that is not stored and receives no email. For this, we store checksums (hashes) of the email address and of the IP address, not the IP address itself; we delete the checksum of the IP address after 24 hours and that of the email address together with the enquiry. In addition, the server briefly counts enquiries per IP address in memory without storing them. Like every page request, the submission is also recorded in the server log (section “Visiting the website”). The form also contains a hidden field that only automated programs fill in; an enquiry with this field filled in receives no email and is deleted after 48 hours.

Purpose and legal basis. We use the data to answer your enquiry and, if you wish, to initiate a collaboration. If you, as a private individual or sole trader, are yourself initiating a contract with us, the legal basis for the details needed for this is the initiation of that contract (Art. 6(1)(b) GDPR). Otherwise — in particular when you write as an employee of an agency or another company, for voluntary details and for general messages — the legal basis is our legitimate interest in answering enquiries addressed to us and maintaining business contacts (Art. 6(1)(f) GDPR; Art. 31(1) FADP). For protection against misuse and the confirmation by link, the legal basis is our legitimate interest in operating the forms securely (Art. 6(1)(f) GDPR; Art. 31(1) FADP). We do not use the data for advertising, and we do not pass it on to companies on the platform.

Recipients. Only we, the operator, read the enquiry. It is stored in our database on our server at Hetzner in Germany; the database backups, in which it may be contained for up to 30 days, are kept in the Cloudflare R2 object storage with binding EU jurisdiction. We send the emails — the confirmation link to you and our reply — via our mailbox at MXroute (USA). More on this in the sections “Recipients and processors” and “Disclosure abroad”. The email with the confirmation link does not contain your message, and we notify ourselves internally about a new enquiry without its content.

Retention. We delete an unconfirmed enquiry, together with the email containing the link, after 48 hours, and the checksum of the IP address after 24 hours — both automatically. We keep a confirmed enquiry until we have completed it and for 6 months after that; we delete it at the latest 12 months after receipt, together with the platform’s emails about it (automatically, daily run). If we reply to you by email, that exchange is stored in our mailbox at MXroute. We delete it there manually at the latest 6 months after the enquiry is completed and at the latest 12 months after receipt; we check this monthly. If the enquiry leads to a contract, we keep the exchange for as long as the contract runs and afterwards only insofar as it must be kept as a record. A deleted item may still be contained in a database backup for up to 30 days (section “Retention periods”).

Your other rights — such as access, rectification, erasure, objection and complaint to a supervisory authority — are set out in the section “Your rights”. On request, we also delete an enquiry before the period ends, including the platform’s emails about it; an email to datenschutz@castgigs.com is enough.

Reports under the DSA

Anyone can use the “Report content” form or email kontakt@castgigs.com to report content on Castgigs that they consider illegal or in breach of our terms of use (Art. 16 of Regulation (EU) 2022/2065, “DSA”). We store reports sent with the form in a list that only we as the operator can see; we handle reports sent by email and appeals in our mailbox. This section applies to the person who reports and to the person whose content is reported.

What data. From the person reporting: what it is about, where the content is, the explanation, name and email address (optional for reports of child sexual abuse), on request on whose behalf they report, the good-faith statement, the language and the place from which the form was opened, the report number and the times of receipt, review, decision and notification. From the person reported: the reported content, the profile or account details we need for the review, our decision and statement of reasons, and any appeal. For both: our notes on handling the report. This information comes from the person reporting and from the profile or account of the person reported. Please only write what is necessary for the report and do not send copies of the content.

Protection against misuse. We do not use a third-party service for this. Of the IP address we store only a checksum (hash), not the address itself, and delete it after 24 hours. We accept at most ten reports from one connection in 24 hours and automatically send at most three confirmations of receipt to the same email address in 24 hours. In addition, the server briefly counts reports per IP address in memory without storing them. Like every page request, the submission appears in the server log (section “Visiting the website”). The form contains a hidden field that only automated programs fill in; we store a report with that field filled in with a note, send no automatic email and review it by hand. If an unusually large number of reports arrives at once, we also store further reports with a note and without automatic email. If more than one thousand reports arrive within 24 hours, the form temporarily accepts no more and refers to email.

Purpose and legal basis. We use the details to handle the report, confirm receipt, communicate the decision, give the person concerned our reasons, review appeals and, where necessary, inform authorities. The DSA obliges us to do so (Art. 16 to 18 and 20); the legal basis is Art. 6(1)(c) GDPR. We process information about possible criminal offences only to the extent required by Art. 16 and 18 DSA (Art. 10 GDPR). If a report contains special categories of personal data, such as data on health, sex life or origin, we process them only to the extent necessary to handle it under the DSA (Art. 9(2)(g) GDPR). For reports concerning our terms of use and for protection against misuse, the legal basis is our legitimate interest in a safe and lawful platform (Art. 6(1)(f) GDPR; Art. 31(1) FADP).

Recipients. Only we as the operator read the report. We do not give the reporting person’s name and email address to the person concerned unless it is strictly necessary for the decision; in that case we tell the reporting person beforehand. If there is a suspicion of a criminal offence threatening someone’s life or safety, we inform the competent law enforcement authorities or, if the Member State concerned cannot be identified, Europol (Art. 18 DSA); an authority that sends us an order under Art. 9 or 10 DSA receives the details needed for it. The report is stored in our database on the server at Hetzner in Germany; database backups, in which it may be contained for up to 30 days, are stored in Cloudflare R2 object storage with binding EU jurisdiction. We send and receive emails via our mailbox at MXroute (USA). The confirmation of receipt does not contain the report, and we notify ourselves internally about a new report without its content. More in the sections “Recipients and processors” and “Disclosure abroad”.

Retention. We keep a report sent with the form until our decision and for 6 months after our last notification about it – the period for appeals – plus two weeks for appeals that arrive on the last day. If a notification cannot be delivered, the day on which we find this out counts. We then delete the report automatically together with the platform’s emails about it. If an appeal is received or proceedings before an authority, a court or a dispute settlement body are pending, we keep the report until they are concluded; the period then starts again. We delete the IP checksum after 24 hours. We delete reports sent by email, appeals, statements of reasons for restrictions without a report and other email exchange about them in our mailbox by hand after the same periods and check this monthly. Without names, addresses or content, we keep only a record in the audit log, for up to 36 months, that a report of a given type was received via the form and how we decided (section “Retention”). Deleted data may remain in a database backup for up to 30 days.

Your further rights are described in the section “Your rights”. As long as we have not yet decided on a report, the person who sent it can withdraw it; we then delete it unless we have to keep it because of proceedings. After our decision, the report remains until the end of its period and is not deleted earlier at either side’s request: during that time both sides can appeal, and we must be able to review the appeal (Art. 17(3)(b) and (e) GDPR). An email to datenschutz@castgigs.com is enough for your request.

Creator profile

What data the profile contains

After approval, the creator fills in their profile in steps. Depending on what they provide, it contains:

• Identity: stage name, first and last name, date of birth, gender (with optional self-description), pronouns, address, nationality, languages, willingness to travel, short introduction, driving licence.
• Contact: email addresses and mobile numbers with their confirmation status.
• Channels and reach: platform, handle, followers, posts, average views, engagement rate, audience breakdown by age, gender and origin — from the creator’s own details or, with a connected Instagram account, from Instagram.
• Content and topics: formats, topics, excluded industries, previous collaborations.
• Terms: price list per format, usage rights, exclusivity.
• Media: profile picture, photos and videos (section “Photos, videos and image rights”).
• Origin of every value: for every field we store where the value comes from — own entry, Instagram or operator — and when it was last changed. No value from an application email is taken over into a profile.

Bank details, tax number and shipping details (delivery address, clothing sizes, allergies, pets in the household) are not part of the profile: the step “Abrechnung” (billing) is not yet in operation and does not ask for anything today. Before it goes into operation, this policy will be supplemented.

What for

The profile is the platform’s service: it shows companies who the creator is, what reach they have and on what terms they work, so that they can contact and book them. The operator uses the same data to review the profile, to support creators and companies with queries and to detect misuse.

Who sees what

Companies only see the profile if it is visible to them (next section) — and even then not everything: they see the age, not the date of birth; they see town and country, not the full address; they never see identity documents, password or security details. The operator sees the full profile because it reviews it and carries out deletion requests. This separation is not just a rule of the interface but is built into the database itself (section “Data security”).

Minor creators

If the creator is under 18 according to their date of birth, their profile is not approved automatically and is not visible to companies. There is currently no procedure by which the platform itself obtains the consent of a parent or guardian; nor does the profile ask for any details of parents or guardians. If such a profile is to be approved, the operator clarifies consent in the individual case outside the platform by email with the parent or guardian and records it with the date. The details provided in this process (name and email address of the parent or guardian) serve exclusively as this proof.

Legal bases

• Performance of the user contract with the creator — profile, matchmaking, communication (Art. 6(1)(b) GDPR).
• Consent (Art. 6(1)(a) GDPR) for visibility to all companies, the display of photos and videos and campaign notifications by email — each separately and revocable at any time: visibility and campaign notifications in the profile step “Sichtbarkeit” (visibility), the display of photos and videos by email to datenschutz@castgigs.com (section “Photos, videos and image rights”). We store every consent given or withdrawn with the time, the wording and the channel (form or operator) so that we can prove it (Art. 7(1) GDPR).
• Legitimate interest (point (f)) in checking details and preventing misuse — for example in ensuring that nobody passes off someone else’s channels as their own.
• For minors, the consent of the parent or guardian as a prerequisite of the contract — obtained in the individual case by the operator, as described above.

Profile visibility and connections

A creator profile becomes visible to a company in exactly three ways:

1. Connection through an application. If a creator applies to a company — by clicking on the platform, or by email to its mailbox or by Instagram direct message, as soon as they log in or register via the link in the reply and agree to the connection —, a connection to this company is created, and the company sees the profile. This is not a default setting but reflects the action “I have written to this company”. The creator can end any connection at any time under “Firmen → Meine Firmen” (companies → my companies); the company then no longer sees the profile and can no longer write. The company can also end a connection; the creator then only sees “Verbindung beendet — von der Firma” (connection ended — by the company) and can apply again. The previous conversation remains readable for both sides.
2. Release to all companies (“open pool”). Only with express consent in the step “Sichtbarkeit” (visibility). The profile then appears in the search of all companies on the platform. Revocable at any time in the same place; afterwards, only the visibility from connections and releases applies again.
3. Individual release. A targeted release of the profile to a specific company, for example as part of a campaign invitation. It applies until the creator withdraws it.

The narrow option is the default: visible only to companies the creator has applied to or has released their profile to. Conversely, a company can block a creator for itself (“Blockieren”); the creator then no longer appears in its search, their application emails and Instagram messages to this company are not answered automatically, and messages between the two are not possible. The company records a short reason for this, which only the company itself and we as the operator see (Art. 6(1)(f) GDPR — the company’s legitimate interest in keeping away unwanted contacts); the creator only learns that the connection was ended. If the company lifts the block, the note remains in its history.

The public company directory at /firmen does not show any creator profiles — only companies that have published their company profile themselves.

Photos, videos and image rights

Creators upload profile pictures, photos and videos. Every file is scanned for malware on upload (ClamAV, on our own server) and stored in the object storage Cloudflare R2 (EU jurisdiction). The storage is not public: every display runs via a signed address that is valid for five minutes and is only issued for the person who is allowed to see the profile.

Displaying photos and videos to companies requires the creator’s consent (“Ich erlaube die Anzeige meiner Fotos und Videos im Profil” — I allow my photos and videos to be displayed in my profile) — under Art. 6(1)(a) GDPR and, for creators in Germany, Sections 22 and 23 of the German Art Copyright Act (Kunsturhebergesetz — right to one’s own image); in Switzerland under Art. 28 of the Swiss Civil Code (ZGB). It is given in the profile step “Sichtbarkeit” (visibility) and is a mandatory field there: a profile with photos and videos that nobody may see serves no purpose for matchmaking. The consent can be withdrawn at any time with effect for the future — by email to datenschutz@castgigs.com; the operator records the withdrawal with the time. After withdrawal, the files are no longer displayed or delivered to companies; they remain in the creator’s storage until they remove them themselves in the step “Fotos & Dateien” (photos & files) or request their deletion. Anyone who does not want to show photos and videos simply does not upload any — the consent only concerns files that exist.

Companies may view the media within the platform in order to assess the creator. Any use outside the platform — in campaigns, on their own channels, in presentations — requires a separate agreement with the creator (terms of use).

Applications by email to a company

What happens

Companies can connect their own mailbox to the platform — the address to which creators send their applications and collaboration requests. In doing so, the company chooses one or more folders (in Gmail: labels), for example a folder used only for applications; the platform reads only these folders. The company can only choose the inbox or the archive if it confirms that the mailbox is used only for applications and collaboration requests. The company cannot choose folders for sent messages, drafts, trash or spam — those that the mail server marks as such or that are named so at the top level. The platform shows the names of the other folders only so that the company can choose; it stores the chosen and previously chosen folders (name, period, retrieval status). When the mailbox is connected, the platform retrieves the messages of the last 12 months from each chosen folder — a shorter period if the company wishes —, and after that every message that newly arrives in a chosen folder; it does not retrieve older messages. The same limit applies if the company chooses further folders or the platform has to re-read a folder (for example after a change at the mail provider). It initially stores each retrieved message in full: sender address and name, recipients, subject, text, times (sending and receipt by the mail server), folder and attachments as well as the result of the sender verification that the receiving mail server writes into the headers (SPF, DKIM, DMARC); the unaltered raw version of the email is kept in object storage (R2, EU). Fixed rules classify every message in the process: application or not. We match further emails from the same sender to their request and show them in the same thread.

Messages that are not applications

The platform does not process messages that the rules do not classify as applications any further: no reply, no matching to a profile. How long their content remains stored depends on how certain the classification is:

• Automatic replies (such as out-of-office notices and emails marked as bulk mail), delivery reports and emails that the receiving mail server has marked as spam: we delete their content at the latest 24 hours after retrieval — sender name, recipients, subject, text, attachments and the raw version in object storage. A technical identifier remains: the message identifier and the identifiers of the messages it replies to, the mailbox and folder, time of receipt and sending, the classification, the sender address, the result of the sender verification and a checksum from which the content cannot be recovered. This allows the company to correct a misclassification: if it classifies such a message as an application, the platform retrieves it again from its mailbox, provided it is still in the folder from which it was retrieved — even if the company has since deselected that folder.
• Replies to earlier messages, emails with very little text or without a recognisable sender, emails via a distribution list (mailing list) and forwards from the company itself: These often include applications — such as the reply to a call from the company, an application to a group address or a forwarded request. They therefore remain stored like application emails (section “Retention periods”), and the company can classify them as an application.

The platform treats a message that the rules consider an application — this may also be an invoice or a newsletter — like an application. We also treat messages that belong to an application in the same way: emails from a sender whose application has not yet been matched to a creator profile; messages in a thread to which an application belongs; and emails in the conversation with a connected creator. The platform never alters, moves or deletes the original in the company’s mailbox. Deleted content may still be contained in the database backups for up to 30 days; after that they expire. Deletion after 24 hours applies to messages retrieved on or after 29 September 2026.

Removing from Castgigs

If a message has been retrieved that does not belong on the platform — for example a private message, a message containing health information or a personnel file —, the company can delete it with “Remove from Castgigs” („Aus Castgigs entfernen“). The platform then immediately deletes the text, attachments including preview images and the raw version in object storage, as well as any replies to it that have not yet been sent; of a reply that has already been sent, only the recipient, time and delivery status remain as proof. The same message in a second mailbox of the company is removed as well, as is a forward that the platform recognises as a forward of this message; if that forward is itself a separate message (for example a request or a message in a conversation), the platform only deletes its raw version. If the message does not belong to a conversation and nobody has connected via the link in the reply to it, all that remains of it is a checksum of its message identifier, so that the same message is not stored again (until twelve months and one day after its receipt), and an entry in the company’s audit log stating who removed it and when — without sender, subject or content. If the message is in a conversation with a creator, or a creator has connected via the link in the reply to it, a row without content remains with the sender address and the message identifier: it carries the connection, which remains in place, and the matching of later emails from this creator; in the conversation, the company and the creator see “Removed from Castgigs by the company” („Vom Unternehmen aus Castgigs entfernt“) in its place. This row is deleted like an application email (section “Retention periods”). The message remains unchanged in the company’s mailbox. It may still be contained in the database backups for up to 30 days; after that they expire.

Two things happen with an application — similarly to an Instagram direct message (section “Instagram direct messages to companies”):

1. Matching within the company. The platform only checks whether the sender address belongs to a creator who is connected with this company or whom it has blocked — via that creator’s confirmed email address or the address with which they redeemed this company’s link themselves. It does not compare against the profiles of all other creators. Nothing more is read: no program analyses the text of the email, no profile is created or prefilled from it, no value from it is taken over into a profile. An email whose sender verification has failed never counts as a message from this creator.
2. Reply. Depending on what the company has set for its mailbox, no automatic reply is sent (the company replies itself), the platform suggests a reply that an employee sends from the company’s mailbox with one click, or the reply is sent automatically. It contains a link to a page on which the sender can log in or register a profile themselves and agree to the connection with the company — without a secret and without a login token; the link is valid for 14 days. This also applies to senders who already have a profile. If the sender address belongs to a creator who is already connected with the company, and its sender verification has not failed, no new reply is sent; the email goes into the shared conversation (below). If the platform does reply to such a creator — for example when the company follows up on an email that was held back —, the reply mentions the existing connection and leads to the login page. When connecting its mailbox, the company confirms that the automatic replies to applicants contain this link and that whoever uses it and agrees is connected.

A connection between creator and company (section “Profile visibility and connections”) only arises when the sender logs in or registers via the link in the reply and agrees — the sender address is then noted as an unconfirmed additional address on their profile. A company’s click does not connect anyone. From then on, the email belongs to the shared conversation on the platform, and later emails from the address of a connected creator also belong to it without a new reply, provided their sender verification has not failed. If a company has blocked a creator, the platform no longer matches their emails to this profile and does not answer them automatically; the email itself remains in the company’s mailbox.

Who is responsible for what

The mailbox belongs to the company. The company is the controller for reading the emails from the chosen folders, classifying them, matching them to creators connected with it or blocked by it, and replying on its behalf; Castgigs acts as its processor (Art. 28 GDPR; Art. 9 FADP) on the basis of the agreement with the company. Castgigs itself is responsible for the creator profile and for the connection that the creator confirms via the link.

Legal bases and duration

For processing the application: the legitimate interest of the company and of the sender in a reply to a request the sender made themselves (Art. 6(1)(f) GDPR), and the initiation of a collaboration (point (b)). For the connection with the creator profile: the user contract with the creator (point (b)). Anyone who has sent an application but does not want to use the link does not have to do anything: the email simply stays with the company; the maximum period of 24 months after receipt applies to it (section “Retention periods”), the unused link expires after 14 days and is deleted 30 days later. For automatic replies, delivery reports and spam, the content is deleted at the latest 24 hours after retrieval; the same maximum period as for an application email applies to their identifier and to the other messages that are not applications. Deletion can be requested at any time from the company or from us; the company can also remove an individual message from Castgigs itself (above).

Identity and channel verification

The platform checks details at several levels — each with its own proof:

• Mobile number: code by SMS via Twilio Verify (section “Applications and enquiries”). Twilio keeps and checks the code; we only store that and when the number was confirmed.
• Email address: code or link by email, sent from our server.
• Address: marked as verified if an address suggestion was taken over (HERE).
• Channel: proof through connecting the account with the network (today Instagram, next section).
• Verification (“blue tick”): at the creator’s request, the operator personally reviews the profile — does the channel belong to this person, are the figures correct, is the profile complete — and awards or refuses the badge. Request, decision and time are logged.

Legal bases: contract (Art. 6(1)(b) GDPR) and the legitimate interest of everyone involved in profiles being genuine (point (f)).

Instagram connection

Creators can connect their Instagram account (creator or business account) to their profile. To do so, the creator logs in to Instagram and consents there; the platform receives an access token from Meta. The provider is Meta Platforms Ireland Limited, Dublin, Ireland (“Instagram API with Instagram Login”). The connection is voluntary; without it, the channel details remain self-reported.

What data we receive from Instagram

• username, profile name, the account identifiers (app-scoped user ID and account ID), account type;
• the profile description (bio), the website stored in the profile and the profile picture;
• number of followers, of accounts followed and of posts;
• the last twelve posts: identifier, type (image, video, carousel, reel), link to the post, time, caption (shortened to 300 characters), thumbnail and the post’s metrics (likes, comments, views, reach, saves, shares, interactions);
• for stories, only metrics (identifier, type (image or video), time, views, reach, replies) — not the content, no image, no text;
• from 100 followers, the breakdown of followers by age, gender, country and city (audience demographics, as shares; the five largest countries and cities individually);
• the access token with expiry date and the permissions granted.

Permissions: instagram_business_basic (profile and posts) and instagram_business_manage_insights (metrics of posts and stories, audience demographics). Via this connection we do not read any messages, comments or contacts and do not publish anything on the creator’s behalf. (Direct messages to a company that has connected its own Instagram account for this purpose are dealt with in the section “Instagram direct messages to companies”.)

What for

Two things: proof that the channel belongs to the creator (whoever consents at Instagram owns the account), and a meaningful profile with real figures — followers, bio, website, profile picture, the latest posts and the audience then come from Instagram instead of self-reporting. From the metrics of the posts and stories, we calculate the engagement rate (average likes, comments, saves and shares per post divided by followers), the average views per post and the average story views over the last 30 days; for companies, these values bear the label “von Instagram” (from Instagram) with the day of the sync. Profile, posts and audience are updated every three days, the story metrics daily; the token is valid for 60 days and is renewed automatically before it expires as long as the connection exists.

How we store it

The access token is stored encrypted in the database (envelope encryption with a key known only to the server). Username, account identifiers, account type and permissions are in the connection record. Bio, website, profile name and the metrics are stored with the channel; we load the profile picture and post thumbnails once from Instagram, re-encode them (at most 480 pixels, without metadata) and store them in our storage in the EU — we do not store Instagram’s own image addresses. Followers, accounts followed, posts and the audience breakdown are stored as measurements with the date and the source “Instagram” on the channel. We show all of this to companies in the profile — within the visibility set out in the section “Profile visibility”; the number of accounts followed is stored but not displayed.

Retention: of the posts, only the twelve most recent are kept — a post that drops out of these twelve is deleted together with its thumbnail at the next sync. We keep story metrics for 90 days. Bio, website, profile name and profile picture are replaced at every sync. The measurements (followers, metrics, audience) remain as a time series with dates as long as the channel exists.

Disconnecting

The creator can end the connection at any time under “Profil bearbeiten → Kanäle & Zielgruppe” (edit profile → channels & audience) with “Trennen” (disconnect). The access token is then deleted immediately, no further sync takes place and the channel proof lapses. Bio, website, profile name, profile picture, the stored posts with their thumbnails and the story metrics are deleted immediately. The figures measured up to then (followers, engagement rate, views, audience) remain in the profile with their date as a snapshot until the creator changes them or requests their deletion. If the creator instead removes the app in their Instagram settings, Meta notifies us and we disconnect in the same way.

Deletion of Instagram data

The data taken over from Instagram can be deleted in two ways:

1. Via Instagram: in the Instagram settings under “Apps and websites”, remove the app “Castgigs” and request the deletion of the data there. Meta then calls our deletion interface. We disconnect, delete the access token, bio, website, profile name and profile picture, the stored posts including thumbnails and story metrics as well as all measurements (followers, accounts followed, posts, engagement rate, views) and audience breakdowns with the source Instagram, clear the details derived from them in the profile and reply to Meta with a confirmation code. At https://castgigs.com/api/instagram/loeschung?code=… the status of the deletion request can be checked at any time with this code; the page can be reached without logging in. So that this status page can answer and the withdrawal remains provable, the connection record keeps the username, account identifiers and account type with the note “getrennt” (disconnected) — without token, without figures, without further sync. We also delete these identifiers on request by email and at the latest with the profile.
2. By email: a message to datenschutz@castgigs.com with the Instagram username is sufficient. We carry out the deletion — on request including the identifiers in the connection record — and confirm it.

The channel (handle) entered by the creator themselves remains in both cases as their own detail until they remove it themselves. Every connection, disconnection and deletion is recorded in the audit log — with the Instagram username (the public handle), without token, identifiers or figures. The audit log cannot be altered afterwards (section “Data security”); its entry is the proof that the deletion took place.

Legal bases: consent given to Meta when connecting and the user contract with the creator (Art. 6(1)(a) and (b) GDPR). Meta’s privacy notices apply to processing by Meta itself.

Mailbox connection for companies

A company connects its application mailbox in one of two ways. With Microsoft 365, an authorised employee logs in to Microsoft and grants the platform access to exactly this mailbox (OAuth); the platform receives access tokens from Microsoft (Microsoft Ireland Operations Limited, Dublin, Ireland). With other providers, the company stores the server name, username and password for IMAP and SMTP. Tokens and passwords are stored encrypted in the database; Microsoft tokens are renewed automatically as long as the connection exists.

Both ways technically allow access to the whole mailbox; the platform only reads the folders chosen by the company. With this access, the platform retrieves the messages of the last 12 months from these folders when the mailbox is connected, and newly arriving messages after that, and sends the replies from this mailbox (section “Applications by email”). The company can disconnect at any time in the settings; the tokens are then deleted. During login at Microsoft, the platform sets a short-lived cookie that secures the way back (section “Cookies”). The legal basis is the user contract with the company (Art. 6(1)(b) GDPR; terms of use); the processing of the messages on behalf of the company is governed by the data processing agreement. Microsoft acts as the company’s processor.

Instagram direct messages to companies

What happens

Companies can connect their Instagram professional account to the platform — the account to which creators send their collaboration requests as direct messages. To do so, an authorised employee logs in to Instagram and consents there; the platform receives an access token from Meta (permissions instagram_business_basic and instagram_business_manage_messages; provider Meta Platforms Ireland Limited, Dublin, Ireland). Nothing is read when connecting: only when the company switches on the mode “Vorschlag” (suggestion) or “Automatisch” (automatic) does Meta report new direct messages to the platform (webhook), and a regular sync catches up on what the webhook did not deliver. For each message, only the message identifier, the sender identifier assigned by Meta (and its hash), the text, the time and the type of any attachments (image, video — not the attachments themselves) are stored. No profile picture, no name, no follower count. In addition, for each sender and company account, we note the time of their last message and of the company’s last reply — solely to know whether a reply is still possible under Meta’s 24-hour rule.

Three things happen with every message:

1. Classification. Fixed rules — no AI language model — check the text to see whether it is a collaboration request. During the sync, only what is a request is stored; a message from the webhook that is not a request (order questions, complaints, private messages) is not presented to the company as a request and is deleted after 24 hours, unless it belongs to an open request from the same sender. The company can correct a misclassification within this period.
2. Sender. Only for requests does the platform ask Meta for the sender’s username (nothing else from the profile). It does not compare against the Instagram connections or handles of creators on the platform. It only checks whether the message comes from a creator whom the company has blocked — via the sender identifier with which this creator previously redeemed this company’s link, or via an earlier message in the shared conversation.
3. Reply. On behalf of the company, the platform suggests a reply that an employee sends with one click from the company’s Instagram account — or that is sent without a click in the mode “Automatisch” (automatic) if the company has expressly set this and the operator has enabled it for this account. Every such message states that it was sent automatically on behalf of the company, how the sender can reach a human, that “STOP” ends further automatic messages, and links to this policy. It does not contain a login link with a secret, only a link to a page on which the sender can log in or register themselves and agree to the connection with the company. When connecting its Instagram account, the company confirms that the automatic replies contain this link and that whoever uses it and agrees is connected. Replies are only possible within 24 hours of the sender’s last message (Meta’s requirement); older requests and everything received before switching on are never answered automatically. Anyone who writes “STOP” no longer receives automatic messages from this account.

If the sender redeems the link in the reply — by logging in or registering and agreeing —, this creates a connection between creator and company as with an application by email: the message becomes part of the shared conversation on the platform, the company may see the profile, and the creator receives an email about it. A company’s approval of a reply does not connect anyone. For now, the platform presents further requests from a connected creator via Instagram to the company as a new request, not in the conversation; it treats the creator’s other Instagram messages like other messages that are not requests (above). Creators and companies can end the connection at any time; it is resumed if the creator applies again via the platform or redeems a link from a reply of the company (including an earlier one). A company that has blocked a creator (“Blockieren”, section “Profile visibility and connections”) is no longer presented with messages that could be matched to this creator; the link in an earlier reply then does not create a connection either.

Who is responsible for what

The Instagram account belongs to the company. The company is the controller for reading the direct messages, classifying them, checking whether they come from a creator whom it has blocked, and replying on its behalf; Castgigs acts as its processor (Art. 28 GDPR; Art. 9 FADP) on the basis of the agreement with the company. Castgigs itself is responsible for the creator profile and for the connection that the creator confirms via the link. Meta’s privacy notices apply to processing by Meta itself.

Legal bases and duration

For processing the request: the legitimate interest of the company and of the sender in a reply to a request the sender made themselves (Art. 6(1)(f) GDPR), and the initiation of a collaboration (point (b)). For the connection with the creator profile: the user contract with the creator (point (b)). Messages that are not requests are deleted after 24 hours unless they have become part of a connection; if they belong to an open request from the same sender, we treat them like that request (readable for 90 days, then redacted, deleted after 12 months). For requests without a connection to a creator profile, text and username are deleted after 90 days, Meta’s sender identifier is replaced by its hash, and any match to a creator profile is removed; the message identifier, the hash and the times remain for further months as proof that and when a reply was sent, and are deleted 12 months after receipt. Messages that have become part of a connection are deleted, like application emails, 24 months after receipt. The record of the time of the last message per sender and account is deleted 12 months after the last message. An hourly run applies these periods automatically. If the sender deletes the message on Instagram, Meta notifies us and we delete it immediately; if the company requests the deletion of its data via Instagram (section “Instagram connection”, the same way), all messages of the account are deleted immediately. If the company disconnects the account, the access token is deleted immediately; the messages remain until their periods expire. The log of webhook deliveries (only identifiers and outcome, no content) is deleted after 14 days. Deletion can be requested at any time from the company or from us.

Customer accounts and company data

For every employee of a company, we store first and last name, email address, a password (only as a hash), optionally a profile picture, the second factor (TOTP secret, encrypted) and membership of one or more companies with a role. For the company itself: name, registered company name, address, VAT number, register, website, logo, description and legal notice link. Companies can publish their company profile in the public directory at /firmen; as long as they do not, it is only visible to creators with whom they are connected.

For every login, we store a session with its start, last activity, a hash of the IP address and a hash of the browser identifier — to detect stolen sessions, not to track people. Security-relevant actions (login, invitation, password change, mailbox connection including the chosen folders and period, approvals, emails removed from Castgigs — without their content) are recorded in the audit log with time and acting person. Password recovery runs via a link by email that expires after a short time.

A company’s team. People with the roles ‘Owner’ and ‘Admin’ can invite further people and give them a role: ‘Member’, ‘Finance’ or ‘Viewer’, and the ‘Owner’ also ‘Admin’; the role ‘Owner’ is held by exactly one person and is transferred. For an invitation, we store the invited person’s email address, the role, who invited them, until when the invitation is valid (14 days) and whether it was accepted or withdrawn. This information comes from the inviting company, not from the invited person. The invitation reaches the person by email; it shows the name of the inviting person. All members of a company see the name, email address and role of the other active members; people with the roles ‘Owner’ and ‘Admin’ also see open invitations, whether a member’s email address is confirmed, whether the people in these two roles have set up a second factor and whether Castgigs has blocked a member’s access. Invitations, role changes, removal from the team, leaving and the transfer of the owner role are recorded in the audit log, with the email address of the person concerned or invited; they remain there for as long as the audit log is kept (36 months, see the section “Retention periods”). Anyone removed from a company or leaving it keeps their account; we delete it on request.

Companies that view creator profiles are themselves responsible for their own further use of the profile data (notes, campaign planning, conclusion of contracts). The terms of use oblige them to use the data only for initiating and carrying out collaborations. The legal basis for managing the account is the contract with the company (Art. 6(1)(b) GDPR) where you concluded it yourself, for example as a sole trader. If you did not conclude the contract yourself — for example because you act for a company or were invited by a company — it is our legitimate interest and that of the company to provide the platform to it and to manage access for the people acting for it (Art. 6(1)(f) GDPR; Art. 31(1) FADP); the same applies to invitations and team management. For the security measures, it is likewise the legitimate interest (point (f)).

Messages and emails from the platform

Creators and companies write to each other via the platform. Messages, their time and their read status are stored and shown to both sides — even after a connection has ended, the conversation remains readable so that both can refer to it. If the company removes an email from the creator from Castgigs (section “Applications by email”), both see only “Removed from Castgigs by the company” in its place; its content and attachments are then deleted, while the email in the creator’s and the company’s mailboxes is not affected. The operator only reads conversations to review reported misuse or at the request of one of the two sides.

The platform sends emails to creators and employees: login links, confirmation codes, invitations, notifications of new messages and requests, replies to applications (on behalf of the company from its mailbox) as well as notices about verification and security. The sender is the operator’s mailbox or the company’s connected mailbox. These emails are part of the service and cannot be unsubscribed from as long as the profile or account exists. Legal basis: contract (Art. 6(1)(b) GDPR); if you did not conclude the contract yourself, our legitimate interest in providing the services agreed with the company (point (f)).

If a suggested reply in a company’s inbox is waiting for a click, the people responsible for it (with the roles ‘Owner’, ‘Admin’ and ‘Member’) receive a bundled notification email and, for Instagram requests, a reminder before the reply window closes. These notifications serve the performance of the contract (Art. 6(1)(b) GDPR) or, if you did not conclude the contract yourself, our legitimate interest in it (point (f)); each of these people can switch them off under “Konto → Benachrichtigungen” (account → notifications).

Campaign notifications by email

With the consent “Ich möchte über passende Kampagnen informiert werden” (I would like to be informed about suitable campaigns), we may send creators emails when a campaign or request from a company matches their profile. The consent is voluntary, not part of the application, and can be withdrawn at any time in the profile step “Sichtbarkeit” (visibility) or by email to datenschutz@castgigs.com. Legal basis: Art. 6(1)(a) GDPR.

This function is not yet in operation. The platform currently does not send any campaign notifications, and there is no selection of suitable campaigns. When the function goes into operation, the selection will be based on the profile details (topics, channels, languages, country), will have no legal effect and will not be an automated decision; this policy will be supplemented accordingly beforehand.

Recipients and processors

Personal data is only received by the parties that are necessary for the respective purpose. Within the platform, these are the companies to which a profile is visible and the creators with whom a company is connected — both as independent controllers for their further use. In addition, we use processors who work on our instructions and on the basis of a data processing agreement. Where a service provider also uses data for its own purposes or does not act for us, the table says so:

The virus scan (ClamAV) runs on our own server; no file leaves the platform in the process. We only disclose data to authorities and courts if we are legally obliged to do so. If there is a suspicion of a criminal offence threatening someone’s life or safety, we inform the competent law enforcement authorities or Europol (Art. 18 DSA; section ‘Reports under the DSA’).

Disclosure abroad

The platform’s data is located in Germany (servers, database) and in the EU (object storage). From the perspective of the Swiss FADP, the EU and EEA states are countries with adequate data protection (Annex 1 of the Data Protection Ordinance); from the perspective of the GDPR, Switzerland is a country with an adequate level of protection (adequacy decision of the European Commission). Data processing by the operator in Zurich and storage in Germany are thus covered in both directions.

Data reaches the USA via three service providers: Cloudflare (management of the object storage and bot protection; the objects themselves remain in the EU; when loading and uploading such files and for the bot protection, your browser connects directly to Cloudflare), MXroute (emails of the operator’s mailbox) and Twilio (mobile number for the SMS code). The content of application emails and direct messages is not passed to any service provider for analysis; the raw version of an email is kept in object storage in the EU. The basis is the EU-U.S. Data Privacy Framework or the Swiss-U.S. Data Privacy Framework, insofar as the service provider is certified there, and in addition the standard contractual clauses of the European Commission in the version recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC) for Switzerland. Cloudflare, Inc. is certified under both frameworks. Meta and Microsoft may transfer data to the USA within the framework of their own privacy notices; their safeguards apply to this.

Retention periods

We store personal data for as long as the purpose requires or a law prescribes. For this, we have set maximum periods for each data area; they are listed in the following table. The column “Today” states how the period is currently implemented: some deletions run automatically; for the others there is not yet a regular run — there we delete on request (section “Your rights”) and as part of the operator’s review runs. An automatic run for all periods is planned; as soon as it is in operation, this table will be adjusted.

A profile or account is deleted on request (section “Your rights”). Where a law requires longer retention — for example for invoices —, the personal reference is removed and the record is kept without it. A deleted detail may still be contained in a database backup for up to 30 days after deletion; backups are not analysed but only used to restore after an outage.

Cookies

The platform only sets technically necessary cookies. None of them serves analytics, advertising or recognition across other websites; there is therefore no cookie banner and no consent for them. All cookies are restricted to castgigs.com, are only transmitted over encrypted connections and cannot be read by scripts in the browser (httpOnly). For the bot protection’s access to your device and the cookies Cloudflare uses in its own check window, see “Bot protection (Cloudflare Turnstile)” in the section “Visiting the website”.

If a creator connects their Instagram account, no cookie is set; the protection of the way back is held in the database there. The legal basis for the necessary cookies is the contract (Art. 6(1)(b) GDPR) or the legitimate interest in a secure login (point (f)); under § 25(2) of the German Telecommunications Digital Services Data Protection Act (TDDDG), they do not require consent. When you switch language during registration, your browser briefly keeps your entries in session storage, not in a cookie (section “Applications and enquiries via the forms”).

Data security

The platform protects personal data with technical and organisational measures:

• Encrypted transmission. All connections run over HTTPS; the application can only be reached via our own server.
• Encrypted storage of secrets. Access tokens (Instagram, Microsoft), mailbox passwords and second-factor secrets are stored in the database with envelope encryption; the key for this is not stored in the database. Passwords are only stored as a salted hash. Login links are exchanged for a cookie on first use so that the secret does not remain in the address bar.
• Access rules in the database. Who may see what is decided not only by the interface but by the database itself: every query runs under the role of the acting person (company, creator, operator) with row-level security rules. Even in the event of an application error, a company cannot read profiles that are not visible to it, and a creator cannot read other creators’ data.
• Audit log. Security-relevant actions are recorded in a log that cannot subsequently be altered or shortened: the entries are cryptographically chained, and a check run finds any gap. We record a declaration of withdrawal there as proof — name, email address, details of the contract and the profile, time of receipt and, for declarations without login, a shortened checksum of the IP address (Art. 6(1)(f) GDPR; Art. 31(1) FADP). It remains even after the profile has been deleted until the period for the audit log expires (section “Retention periods”).
• Files. Virus scan before storage, private storage, short-lived signed addresses, separate access data for application and backup, backups with protection against deletion.
• Protection against misuse. Bot protection, throttling of requests, lockout after repeated incorrect logins, an optional second factor (TOTP) for customer and creator accounts.
• Protection against misuse for “Passwort vergessen” (forgot password), the login link and SMS codes. To stop anyone from flooding other people’s inboxes or triggering large numbers of SMS codes, we limit these requests per internet connection, and SMS codes additionally per mobile number. For this we store hashes of the IP address or its network range and of the mobile number, not the data itself, and delete them after 24 hours; we do not include them in our daily database dumps. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR; Art. 31(1) FADP).
• Minimisation. IP addresses and browser identifiers are stored as a hash; confirmation codes are kept by the SMS service and never in plain text in our database; post content from Instagram is not retrieved, and direct messages only for companies that have connected and switched on their own Instagram account for this (section “Instagram direct messages to companies”).

Your rights

You have the following rights vis-à-vis us (Art. 25 et seq. FADP; Art. 15 to 22 GDPR):

• Access to whether and which data we process about you, for what purpose, for how long and to whom we disclose it.
• Rectification of incorrect data and completion of incomplete data — creators and employees can change most details themselves in their profile or account.
• Erasure of your data, unless a statutory retention obligation prevents it; the personal reference is then removed. Creators find the way to do this in their account under “Sicherheit → Konto löschen” (security → delete account): before confirmation, it states there what disappears, what remains for legal reasons and from when it takes effect. From the request onwards, the profile is no longer visible to companies; it is carried out after a seven-day grace period, during which the request can be cancelled with one click. After that, the profile row remains in anonymised form (invoices and the log refer to it), invoices and contracts until their retention period expires, and the messages in the conversations with the respective company — the latter without name, without contact details and without social media handle, including in the company’s messages. What is removed are the details that were in the profile; a detail that appears only once in free text cannot be found there by us — write to us and we will remove it by hand. Anyone who no longer has access to their account writes to datenschutz@castgigs.com; we then take up the request by hand after verifying their identity. The same route via this address applies to company accounts. Creators can also withdraw from their contract (terms of use, “Right of withdrawal for creators”) — via “Vertrag widerrufen” (withdraw from contract) in the account or without login at castgigs.com/profil/vertrag-widerrufen. After a withdrawal, we delete the profile in the same way and with the same exceptions as with “Konto löschen” (delete account); for a declaration without login, only after we have checked that it comes from the owner of the profile. Unlike a deletion request, a withdrawal cannot be cancelled with one click; until deletion, the creator can continue the contract by agreeing to the terms of use again. Reports under the DSA that you sent or that concern your content remain after our decision until the end of their own retention period; before that, we only delete a report if the person who sent it withdraws it before our decision (section ‘Reports under the DSA’).
• Restriction of processing, for example while the accuracy of data is being checked.
• Data portability of the data you have given us, in a common electronic format.
• Objection to processing that we base on a legitimate interest, on grounds relating to your particular situation.
• Withdrawal of any consent with effect for the future — visibility in the open pool and campaign notifications in the profile step “Sichtbarkeit” (visibility), all consents by email. The lawfulness of the processing up to the withdrawal remains unaffected.

Please send requests to datenschutz@castgigs.com. We reply within one month; where we cannot recognise your identity from the profile or account, we ask for proof before we disclose or delete data.

Complaint to a supervisory authority

You can also contact a data protection supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch; in the EU and the EEA, the supervisory authority of your place of residence, place of work or the place of the alleged infringement — in Germany, the data protection authority of your federal state, in Austria, the Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna.

Changes to this policy

We adapt this policy when the platform changes — for example when a new service provider is added, a function such as bookings and invoices goes into operation or a period changes. The current version is available at castgigs.com/datenschutz (in English at castgigs.com/en/privacy) with the date of the last update at the top. In the event of material changes affecting creators or companies, we also inform them by email or at the next login.