Castapp Logo
Privacy

Privacy Policy

Effective: 12 July 2026

Preamble

With the following privacy policy, we would like to inform you about what types of your personal data (hereinafter also referred to as "data") we process, for what purposes, and to what extent. The privacy policy applies to all processing of personal data carried out by us, both in the provision of our services and in particular on our websites, in mobile applications, and within external online presences, such as our social media profiles (hereinafter collectively referred to as "Online Services").

The terms used are not gender-specific.

Controller
Stageapp Services GmbH
Kieselweg 1
22395 Hamburg

Authorized representatives:
Sebastian Kraft
Email: office@castapp.pro

Overview of Processing

The following overview summarizes the types of data processed and the purposes of their processing and refers to the data subjects.

Types of data processed:

  • Master data
  • Payment data
  • Contact data
  • Content data
  • Contract data
  • Usage data
  • Meta, communication and process data
  • Applicant data
  • Log data of interface accesses

Categories of data subjects:

  • Customers
  • Employees
  • Prospects
  • Communication partners
  • Users
  • Applicants
  • Business and contractual partners
  • Submitters (third parties publishing external casting calls via the platform)
  • Children with a Junior profile and their parents or legal guardians

Purposes of processing:

  • Provision of contractual services and customer service
  • Contact requests and communication
  • Security measures
  • Direct marketing
  • Reach measurement
  • Office and organizational procedures
  • Management and response to inquiries
  • Application process
  • Feedback
  • Marketing
  • Provision of our online services and user experience
  • Information technology infrastructure
  • Publication and management of external casting calls
  • Provision of programmatic interfaces for casters
  • Provision of Junior profiles by parents and legal guardians
  • Presentation of the network and its members in public areas of the platform

Applicable Legal Bases

Below you will find an overview of the legal bases of the GDPR on the basis of which we process personal data. Please note that in addition to the regulations of the GDPR, national data protection regulations may apply in your or our country of residence or domicile. If more specific legal bases are relevant in individual cases, we will inform you of these in the privacy policy.

  • Consent (Art. 6(1)(a) GDPR) - The data subject has given consent to the processing of their personal data for one or more specific purposes.
  • Contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR) - Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.
  • Legal obligation (Art. 6(1)(c) GDPR) - Processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Legitimate interests (Art. 6(1)(f) GDPR) - Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.

In addition to the data protection regulations of the GDPR, national regulations on data protection apply in Germany, in particular the Federal Data Protection Act (BDSG).

Registration

When you register, we process your personal data such as name, address, email address, date of birth, and payment data, which we need to fulfill the contractual relationship with you or to carry out pre-contractual measures.

As part of the registration as an artist, each account undergoes a review process by the provider. The provider may request the submission of additional evidence for this purpose. This evidence is processed exclusively for the purpose of the review and is deleted after completion of the review process, unless there is a legal obligation to retain it. The legal basis is Art. 6(1)(b) GDPR.

The artist profiles with the personal data entered by the artist, such as name, contact details, curriculum, and characteristics and skills relevant to the selection of performers, are shared within the platform functionalities with the caster accounts connected to the Castapp platform. This also includes retrieval via the programmatic interfaces and processing in the casters' own applications for casting purposes; details and safeguards are described in the section on programmatic interfaces. The role type details role gender and role appearance are voluntary professional self-disclosures; "Not specified" can be selected for each of them in the profile.

The main uses of the artist profiles enabled for the connected caster accounts by the platform functionalities are listed in our Terms of Use.

Artist profiles are retained on the platform until the artist deletes their profile or user account, the user agreement expires, or retention is no longer necessary for other reasons; whichever occurs latest. The legal basis for processing the artist profiles is Art. 6(1)(b) GDPR.

The artist has the option to create a personalized profile link to make selected videos from their Castapp account accessible. In addition to the videos, the artist's complete profile and contact details are displayed. The artist can set the validity period of the link when creating it (automatic deletion after 7 or 30 days, or permanent). By using this link, the artist agrees that the selected information will be made publicly accessible.

Presentation of the Network

We present the network and its members in publicly accessible areas of the platform, in particular on the home page and the performer overview pages. Profile pictures of artists may be shown in this context in order to showcase the platform and its reach.

  • Types of data processed: profile picture; master data (name, professional information).
  • Data subjects: users (artists).
  • Purposes of processing: presentation of the network and its members; presentation of the platform.
  • Legal bases: legitimate interests (Art. 6(1)(f) GDPR).
  • Right to object: Artists may object to the use of their profile picture in these areas at any time, in their settings or by notifying us. We will then remove the picture from the affected areas within a reasonable period.

Castapp Junior

With Castapp Junior, parents and legal guardians can create a Junior profile for their child from the age of 6 and apply on the child's behalf to Junior auditions. The contracting party and user is exclusively the parent or legal guardian of legal age; the child does not receive their own access. The information about the child, including the date of birth, is entered by the parent or legal guardian.

Safeguards: Junior profiles are visible to casters exclusively via a separate selection and can only apply to Junior auditions. External castings and the Castapp+ subscription are not available for Junior profiles. Invitations and notifications are sent to the parent or legal guardian. Junior profiles are completely excluded from access via the programmatic interfaces.

  • Types of data processed: the profile and application data mentioned in the section on registration, entered by the parent or legal guardian.
  • Data subjects: children with a Junior profile; parents and legal guardians.
  • Purposes of processing: provision of the Junior profile and participation in Junior auditions.
  • Legal bases: consent of the parent or legal guardian (Art. 6(1)(a) GDPR) and performance of the contract with the parent or legal guardian (Art. 6(1)(b) GDPR).

We treat children's data with particular care.

Programmatic Interfaces for Casters (MCP and Webhooks)

Casters can access profile and application data available to them on the platform via programmatic interfaces (MCP and Webhooks) and process it in their own applications, including AI applications of their choice.

Interface access is deactivated by default and is activated individually per user by us. There are two access levels: read-only, and read and write. Authentication is personal and takes place via the respective user account (OAuth). All write actions require express confirmation in the respective tool. Access can be revoked at any time by the user or by us; it expires automatically when a user account is deactivated. Junior profiles are completely excluded from interface access.

Interface accesses are logged. The user, the time, the functions called, and the success of the request are recorded. We store the logs for six months in our database in Germany.

From the moment of retrieval via the interface, the respective caster processes the data as an independent controller within the meaning of the GDPR. The caster selects their applications and AI providers themselves. Use is contractually limited to casting purposes; training AI models with this data is prohibited. Rights of data subjects regarding this processing must be asserted against the respective caster.

  • Types of data processed: master data, contact data, and content data (profile and application data) of the artists within the scope of the caster's respective platform permission; log data of interface accesses.
  • Data subjects: users (artists); casters.
  • Purposes of processing: provision of contractual services; security and prevention of misuse.
  • Legal bases: contract performance (Art. 6(1)(b) GDPR); legitimate interests in security and traceability (Art. 6(1)(f) GDPR).

Joint Controllership with Casters (Art. 26 GDPR)

For certain processing operations within the platform, we are jointly responsible with the respective caster within the meaning of Art. 26 GDPR. This concerns the caster's activities on the platform: searching and viewing artist profiles, enriching them with the caster's own data (notes, tags, ratings, files, contract data), organizing the application process (auditions, appointments, lists), communicating with artists via platform functions, managing the caster's own users, and retrieving data via the programmatic interfaces.

The essence of the agreement: We take the lead in fulfilling the information obligations, the rights of data subjects, and the notification obligations in the event of data breaches for these processing operations. Data subjects can contact both us and the respective caster with their concerns; if a request is received by the caster, the caster forwards it to us. We are solely responsible for the collection and storage of the artist profiles and the operation of the platform. The respective caster is solely responsible for any processing outside the platform, in particular in the caster's own applications.

The full text of the agreement can be accessed at any time at castapp.pro/art26.

Security Measures

We take appropriate technical and organizational measures in accordance with the legal requirements, taking into account the state of the art, the costs of implementation and the nature, scope, circumstances and purposes of processing as well as the different likelihood and severity of the threat to the rights and freedoms of natural persons, in order to ensure a level of protection appropriate to the risk.

The measures include in particular securing the confidentiality, integrity and availability of data by controlling physical and electronic access to the data as well as access, input, disclosure, ensuring availability and separation of the data. Furthermore, we have established procedures that ensure the exercise of data subject rights, the deletion of data and responses to data threats. Furthermore, we take the protection of personal data into account during the development or selection of hardware, software and procedures in accordance with the principle of data protection through technology design and through data protection-friendly default settings.

TLS encryption (https): To protect your data transmitted via our online services, we use TLS encryption. You can recognize such encrypted connections by the prefix https:// in the address bar of your browser.

Storage Location of Data

We store the platform's data exclusively in data centers within the European Union. The database is operated at netcup in Germany; media and file uploads are stored at Backblaze in the EU region (Netherlands).

Data Processing in Third Countries

If we process data in a third country (i.e., outside the EU or the EEA) or if the processing takes place in the context of the use of third-party services, this only occurs in accordance with the legal requirements. Subject to express consent or contractually or legally required transfer, we only process or have data processed in third countries with a recognized level of data protection, on the basis of contractual obligation through standard contractual clauses of the EU Commission, in the presence of certifications or binding internal data protection regulations (Art. 44 to 49 GDPR).

Deletion of Data

The data processed by us is deleted in accordance with the legal requirements as soon as the consents given for processing are revoked or other permissions cease to apply. If the data is not deleted because it is required for other and legally permissible purposes, its processing is limited to these purposes. This applies, for example, to data that must be retained for commercial or tax law reasons.

Data that casters have lawfully obtained within the scope of the platform functions, for example via the programmatic interfaces or exports, is not automatically covered by a deletion on the platform. Casters are contractually obliged to delete data from their own systems as soon as it is no longer required for the casting purpose.

Use of Cookies

We only use functional cookies to make the use of the website easier and more convenient for visitors or to enable certain functions in the first place. Accordingly, we have a legitimate interest in this processing within the meaning of Art. 6(1)(f) GDPR. In the context of the use of cookies, we store your personal data for as long as is necessary to make the use of our website easier and more convenient.

In your browser, you can set that storage of cookies is only accepted if you agree, how to reject new cookies, and how to disable already received ones. If you reject cookies, you may not be able to use certain website features.

Cloudflare Turnstile (Bot Protection)

We use Cloudflare Turnstile on our registration and form pages (e.g., during user registration and when publishing external casting calls) to verify whether inputs originate from a human and not from an automated bot. In doing so, technical data is transmitted to Cloudflare. Cloudflare also provides the content delivery network, the DNS service, and the attack protection of our platform.

  • Types of data processed: usage data (e.g., interaction data, browser fingerprint); meta, communication and process data (e.g., IP address, timestamps).
  • Purposes of processing: security measures; protection against automated abuse (bot protection); provision of the online services.
  • Legal bases: legitimate interests (Art. 6(1)(f) GDPR).

Service provider: Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA; Website: https://www.cloudflare.com; Privacy policy: https://www.cloudflare.com/de-de/privacypolicy/; Data processing agreement with standard contractual clauses: https://www.cloudflare.com/de-de/cloudflare-customer-dpa/.

Provision of the Online Services and Web Hosting

We process users' data in order to provide them with our online services. For this purpose, we process the user's IP address, which is necessary to transmit the content and functions of our online services to the user's browser or end device.

  • Types of data processed: usage data; meta, communication and process data (e.g., IP addresses, timestamps); content data.
  • Data subjects: users; customers.
  • Purposes of processing: provision of our online services and user experience; information technology infrastructure; security measures; provision of contractual services.
  • Legal bases: legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Collection of access data and log files: Access to our online services is logged in the form of "server log files". These may include the address and name of the accessed files, date and time of access, amounts of data transferred, notification of successful access, browser type and version, operating system, referrer URL, as well as IP addresses and the requesting provider. Deletion: log file information is stored for a maximum of 30 days and then deleted or anonymized; Legal bases: legitimate interests (Art. 6(1)(f) GDPR).
  • netcup: database hosting and provision of information technology infrastructure; Service provider: netcup GmbH, Daimlerstraße 25, 76185 Karlsruhe, Germany; Legal bases: legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.netcup.com; Privacy policy: https://www.netcup.com/de/kontakt/datenschutzerklaerung; Data processing agreement: concluded in writing.
  • Backblaze: storage of media and file uploads (photos, videos, audio files, documents) in the EU region; Service provider: Backblaze Inc., 500 Ben Franklin Ct, San Mateo, CA 94401, USA; Storage location: EU (Netherlands); Legal bases: legitimate interests (Art. 6(1)(f) GDPR); certified under the EU-US Data Privacy Framework; Data processing agreement with standard contractual clauses: https://www.backblaze.com/company/policy/dpa-for-eea-eu-residents.
  • Sentry: monitoring of system stability and identification of code errors; information about the device or time of the error is collected pseudonymously and subsequently deleted; Service provider: Functional Software Inc. (Sentry), 132 Hawthorne Street, San Francisco, CA 94107, USA; Legal bases: legitimate interests (Art. 6(1)(f) GDPR); Website: https://sentry.io; Privacy policy: https://sentry.io/privacy; Data processing agreement with standard contractual clauses: https://sentry.io/legal/dpa/.

Payment Methods

In the context of contractual and other legal relationships, we offer data subjects efficient and secure payment options and use a payment service provider for this purpose. The data processed by the payment service provider includes master data as well as contract, sum and recipient-related information. The payment data entered is only processed and stored by the payment service provider. We do not receive any account or credit card-related information, only confirmation or negative confirmation of the payment.

  • Types of data processed: master data; payment data; contract data; usage data; meta, communication and process data.
  • Data subjects: customers; prospects.
  • Purposes of processing: provision of contractual services and customer service.
  • Legal bases: contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Further information on processing operations, procedures and services:

  • Stripe: payment services (technical integration of online payment methods); Service provider: Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA; Legal bases: contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); Website: https://stripe.com; Privacy policy: https://stripe.com/de/privacy; Data processing agreement: concluded in writing.

Provision of the Online Services: Email Sending

We send transactional emails, such as notifications about applications, invitations, and account-related notifications. In doing so, the recipients' addresses as well as further information concerning the email sending and the contents of the respective emails are processed.

  • Postmark: sending of transactional emails; Service provider: Wildbit, LLC (Postmark), 225 Chestnut Street, Philadelphia, PA 19106, USA; Legal bases: contract performance (Art. 6(1)(b) GDPR) and legitimate interests (Art. 6(1)(f) GDPR); Website: https://postmarkapp.com/; Privacy policy: https://postmarkapp.com/privacy-policy; Data processing agreement with standard contractual clauses: https://postmarkapp.com/dpa.
  • United Domains: provision and management of our domains and our business email mailboxes; sender and recipient addresses as well as the contents of the emails are processed in this context; Service provider: united-domains AG, Gautinger Straße 10, 82319 Starnberg, Germany; Legal bases: legitimate interests (Art. 6(1)(f) GDPR); Website: https://www.united-domains.de; Data processing agreement: concluded in writing.

Registration, Login and User Account

Users can create a user account. In the context of registration, users are informed of the required mandatory information, which is processed for the purpose of providing the user account on the basis of contractual obligation fulfillment. The processed data includes in particular the login information (username, password and an email address).

In the context of using our registration and login functions and using the user account, we store the IP address and the time of the respective user action. Storage is based on our legitimate interests as well as those of users in protection against misuse and other unauthorized use.

  • Types of data processed: master data; contact data; content data; meta, communication and process data.
  • Data subjects: users.
  • Purposes of processing: provision of contractual services and customer service; security measures; management and response to inquiries; provision of our online services and user experience.
  • Legal bases: contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR); legitimate interests (Art. 6(1)(f) GDPR).

Further information:

  • Registration with pseudonyms: Users may use pseudonyms as usernames instead of real names.
  • User profiles are not public: User profiles are not publicly visible or accessible unless the user themselves creates a personalized profile link.
  • Deletion of data after termination: When users have terminated their user account, their data relating to the user account is deleted, subject to a legal permission, obligation or consent.

External Castings

External castings are casting calls published by third parties (hereinafter "submitters") via a public form on the platform. No user account is required for publication.

  • Types of data processed: contact data of the submitter (name, email address); content data (production title, name of the theatre/organizer, description, category, casting location, event location, casting period, application deadline, application contact); meta, communication and process data (IP address, timestamps).
  • Data subjects: submitters.
  • Purposes of processing: publication and management of the external casting call on the platform; provision of the editing and deactivation links via email; communication with the submitter.
  • Legal bases: contract performance and pre-contractual inquiries (Art. 6(1)(b) GDPR).

Storage duration: The data of the external casting call is stored for the duration of the publication. After expiry or deactivation, the data is archived and deleted after the expiry of the statutory retention periods.

Visibility: The information contained in the casting call is visible to users with an active Castapp+ subscription. The submitter's contact email is not publicly displayed unless it is identical to the specified application email.

Notice: External casting calls are only published after activation by Castapp. The submitter is solely responsible for the accuracy, completeness and legality of the information provided.

Contact and Inquiry Management

When contacting us and in the context of existing user and business relationships, the information of the inquiring persons is processed to the extent necessary to respond to the inquiries and any requested measures.

  • Types of data processed: contact data; content data; usage data; meta, communication and process data; master data; contract data.
  • Data subjects: communication partners; customers; prospects; business and contractual partners.
  • Purposes of processing: contact requests and communication; management and response to inquiries; feedback; provision of contractual services and customer service.
  • Legal bases: legitimate interests (Art. 6(1)(f) GDPR); contract performance (Art. 6(1)(b) GDPR).

Further information:

  • Chatbase: support bot for artists based on external AI models, without access to profile or application data; the inquiries entered in the chat are processed; Service provider: Chatbase Inc.; Legal bases: legitimate interests (Art. 6(1)(f) GDPR); Data processing agreement: https://www.chatbase.co/legal/dpa.

Push Notifications

With users' consent, we can send "push notifications". These are messages that are displayed on users' end devices or in browsers, even when our online service is not actively being used. Push notifications are sent via our iOS app and via the website.

To subscribe to push notifications, users must confirm the request from their browser or end device to receive push notifications. This consent process is documented and stored. For these purposes, a pseudonymous identifier (so-called "push token") or the device ID is stored.

  • Types of data processed: usage data; meta, communication and process data.
  • Data subjects: communication partners; users.
  • Purposes of processing: provision of our online services and user experience; direct marketing.
  • Legal bases: consent (Art. 6(1)(a) GDPR); contract performance (Art. 6(1)(b) GDPR).

Further information:

  • OneSignal: sending and managing push notifications via our iOS app and via the website; Service provider: OneSignal, Inc., 2850 S Delaware St Suite 201, San Mateo, CA 94403, USA; Legal bases: consent (Art. 6(1)(a) GDPR); Website: https://onesignal.com; Privacy policy: https://onesignal.com/privacy_policy; Data processing agreement with standard contractual clauses: https://onesignal.com/dpa.

Newsletter and Electronic Notifications

We send newsletters and other electronic notifications (hereinafter "notifications") only with the consent of the recipients or a legal permission. Contents: information about us, our services, promotions and offers.

  • Types of data processed: master data; contact data; meta, communication and process data; usage data.
  • Data subjects: communication partners; customers; prospects; users.
  • Purposes of processing: direct marketing; marketing; reach measurement.
  • Legal bases: consent (Art. 6(1)(a) GDPR); legitimate interests (Art. 6(1)(f) GDPR).
  • Objection option (opt-out): You can cancel receipt of our newsletter at any time. You will find a link to unsubscribe at the end of each newsletter or you can use one of the contact options provided.

Further information:

  • Direct Mail: sending and evaluation of our newsletters; Service provider: e3 Software, LLC (Direct Mail), USA; Legal bases: consent (Art. 6(1)(a) GDPR); Data processing agreement: concluded in writing.

Management, Organization and Support Tools

We use services, platforms and software from other providers (hereinafter "third-party providers") for the purposes of organization, administration, planning and provision of our services. When selecting third-party providers, we observe the legal requirements.

  • Types of data processed: content data; usage data; meta, communication and process data; contact data.
  • Data subjects: communication partners; users; business and contractual partners; employees.
  • Purposes of processing: provision of contractual services and customer service; office and organizational procedures; contact requests and communication.
  • Legal bases: legitimate interests (Art. 6(1)(f) GDPR).

Further information on processing operations, procedures and services:

  • Anthropic: AI services for internal workflows (text creation, research, organization); Service provider: Anthropic PBC, San Francisco, USA; Legal bases: legitimate interests (Art. 6(1)(f) GDPR); Data processing agreement with standard contractual clauses: https://www.anthropic.com/legal/data-processing-addendum.
  • DATEV: document management and document exchange with the tax advisory firm (DATEV Unternehmen online); Service provider: DATEV eG, Paumgartnerstr. 6-14, 90429 Nuremberg, Germany; Legal bases: legal obligation (Art. 6(1)(c) GDPR); Website: https://www.datev.de; Data processing agreement: provided by the service provider.
  • Slack: instant messaging service for internal communication; Service provider: Slack Technologies, Inc., 500 Howard Street, San Francisco, CA 94105, USA; Legal bases: legitimate interests (Art. 6(1)(f) GDPR); Website: https://slack.com; Privacy policy: https://slack.com/intl/de-de/legal; Data processing agreement: concluded in writing.
  • Zoom: conducting video conferences and online training sessions with customers and prospects; contact, usage and communication data of the participants are processed in this context; Service provider: Zoom Communications, Inc., 55 Almaden Boulevard, San Jose, CA 95113, USA; Legal bases: legitimate interests (Art. 6(1)(f) GDPR) and contract performance (Art. 6(1)(b) GDPR); Website: https://zoom.us; Privacy policy: https://zoom.us/de/privacy; Data processing agreement with standard contractual clauses: https://media.zoom.com/download/assets/zoom-global-dpa.pdf.
  • inboxmcp.io: access to our business email mailboxes via an interface (MCP) for processing and organizing email communication; Service provider: SERGO GmbH, Hamburg, Germany; Legal bases: legitimate interests (Art. 6(1)(f) GDPR); Data processing agreement: concluded in writing.

Social Media Presences

We maintain online presences within social networks in order to communicate with the users active there and to provide information about our services.

For the page insights of our Facebook and Instagram pages, a joint controllership agreement exists with Meta (Page Insights Addendum, available at https://www.facebook.com/legal/terms/page_controller_addendum). Meta provides us with aggregated statistics about the interaction with our pages.

  • Types of data processed: contact data; content data; usage data; meta, communication and process data.
  • Data subjects: users; communication partners.
  • Purposes of processing: contact requests and communication; marketing; reach measurement.
  • Legal bases: legitimate interests (Art. 6(1)(f) GDPR).

Changes and Updates to the Privacy Policy

We ask you to regularly inform yourself about the content of our privacy policy. We adapt the privacy policy as soon as changes in the data processing carried out by us make this necessary. We will inform you as soon as the changes require your participation (e.g., consent) or other individual notification.

Rights of Data Subjects

As a data subject, you have various rights under the GDPR, which arise in particular from Art. 15 to 21 GDPR:

  • Right to object: You have the right to object at any time, on grounds relating to your particular situation, to the processing of personal data concerning you which is based on Art. 6(1)(e) or (f) GDPR. If personal data concerning you is processed for direct marketing purposes, you have the right to object at any time to this processing.
  • Right to withdraw consent: You have the right to withdraw consent given at any time.
  • Right of access: You have the right to obtain confirmation as to whether data concerning you is being processed and to access this data as well as further information and a copy of the data.
  • Right to rectification: You have the right to request the completion of data concerning you or the rectification of inaccurate data concerning you.
  • Right to erasure and restriction of processing: You have the right to request that data concerning you be erased without undue delay, or alternatively to request restriction of the processing.
  • Right to data portability: You have the right to receive data concerning you, which you have provided to us, in a structured, commonly used and machine-readable format, or to request its transmission to another controller.
  • Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with a supervisory authority if you consider that the processing of personal data concerning you infringes the requirements of the GDPR.

For processing operations carried out by casters under their own responsibility outside the platform, the respective caster is the controller; the rights of data subjects must in this respect be asserted against the caster.

Supervisory authority responsible for us:

Hamburg Commissioner for Data Protection and Freedom of Information (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit)
Ludwig-Erhard-Str. 22
20459 Hamburg

Definitions

  • Personal data: Any information relating to an identified or identifiable natural person.
  • Controller: The natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
  • Processing: Any operation carried out with or without the aid of automated procedures in connection with personal data, be it collection, evaluation, storage, transmission or deletion.