Privacy policy

Version 2026-10-14.v9 · effective since 2026-10-14

1. Who is responsible for your data

Kastor is a platform that background-casting agencies use to manage their castings. When you sign up through an agency's link, that agency is the data controller: it decides which castings your data is used for and which end clients you are presented to.

The platform is owned by Alejandro Leon, tax ID 36579730R, address C/ Santa Elena, 10, 08001 Barcelona (España), contact email alexleonleon@gmail.com, who acts as data processor on behalf of each agency and as controller of the data strictly needed to run your account (email address, encrypted password and language).

2. What data we process

• Account: email address and password (encrypted). If you sign in with your Google account (optional), instead of a password Google gives us your name, your email and your Google profile photo: we use the name and email for your Kastor account, and we do not use the photo. We never receive your Google password or access anything else in your account.
• Casting profile: name and surname, date of birth, sex, ID number (DNI/NIE), social security number, phone, address, postcode and city of residence, place of birth, nationality, sizes (height, shoe, shirt, trousers), languages, own vehicle, driving licences, IBAN and up to 3 photographs.
• Introduction video (optional, only if your agency uses it): a video of up to 15 seconds with your image and your voice. It is seen by your agency and by the production companies it proposes you to, next to your photos; you can change or delete it at any time.
• Documents with an expiry date (if you or your agency add them): the clearance certificate from the Spanish Central Register of Sex Offenders, your driving licence and your work or residence permit, with their dates of issue and expiry and a copy (PDF or photo). Only you and your agency can see them; production companies never do.
• Dietary requirements, if you provide them: used only to organise catering on set. Note that some options may reveal religious beliefs or a health condition; providing them is voluntary and amounts to explicit authorisation for that use (art. 9.2.a GDPR). You may leave the field empty or clear it at any time.
• If you are a minor: additionally, identification and contact details of your legal guardian and the record of their consent.
• Casting applications: your answers to each casting's forms, including any files you upload.
• Attendance on set: for each shooting day you are called to, whether you showed up, your check-in and check-out times, any notes the coordinator writes and, if the agency collects it, your handwritten signature on arrival and departure. That data produces the attendance sheet for the day.
• Image rights release: if the agency asks for one in a project, the text you sign (or that your parent or guardian signs, if you are a minor), your handwritten signature, who signed and when.
• QR code: your profile includes a code containing only an internal random identifier. It lets the coordinator find you in the day's list when you arrive on set; it is not a credential and grants no access by itself.
• Platform records: date and version of your consent, and a log of the profile-sheet downloads made by agencies (traceability obligation).

3. What we use it for

• Managing your account and your profile in each agency you belong to.
• Processing your application and selection for castings.
• Producing your presentation sheet for the agency's end clients (production companies and advertisers). The sheet never includes your IBAN.
• Managing payment for the days worked (IBAN).
• Recording the days you actually worked: attendance control, the day's attendance sheet and proof for the production company or the employer that hires you.
• Organising catering on set, if you provided dietary requirements.
• Telling you about castings: the agency may message you on WhatsApp or call the phone number on your profile to offer you a part in a project. You can turn off WhatsApp alerts at any time from your profile without leaving the talent pool: projects you are invited to will still appear on your dashboard and you can still sign up for them.
• Telling you about your own projects: when the agency casts you for a project, we tell you inside Kastor and by email as well. You can turn those emails off at any time from your profile; the notification will still show up in Kastor, so you are never left not knowing what you have been called for.

4. Legal basis

We process your data on the basis of your consent (art. 6.1.a GDPR), which you give when signing up, and to take pre-contractual steps at your request (art. 6.1.b GDPR): applying to a casting is asking to take part in a selection process. You can withdraw your consent at any time by deleting your account or writing to your agency or to alexleonleon@gmail.com.

Attendance data (days, times, signature) is not processed on the basis of consent, but because it is necessary to manage your participation in the shoot and to evidence the days worked to whoever hires you, as well as to meet the employment obligations that fall on your agency (arts. 6.1.b and 6.1.c GDPR). You therefore cannot withdraw it while that relationship exists, although you can access it and request its rectification.

The image rights release is signed by you (or by your parent or guardian) when the agency asks for it in a project: it is your authorisation to use your image in that project, and you can revoke it under Spanish Organic Law 1/1982. The signed text and the signature are kept so that it can be proven (arts. 6.1.b and 6.1.f GDPR).

Documents with an expiry date are processed because they are needed to take part in the shoots that require them: the sex offences certificate is mandatory for working in regular contact with minors (art. 13.5 of Spanish Organic Law 1/1996 and art. 57 of Organic Law 8/2021) and the work permit is needed to hire you (arts. 6.1.b and 6.1.c GDPR; the certificate also under art. 10 GDPR). Adding them is voluntary, but without them the agency cannot count on you for those shoots.

5. Minors

If you are under 14, your legal guardian must complete or authorise the registration (art. 7 of the Spanish LOPDGDD). For minors under 18, the profile records the guardian's details and the record of their consent; without them, the agency cannot call you in. In addition, the participation of minors in shoots requires prior authorisation from the labour authority, which the agency handles outside this platform.

6. Who it is shared with

• Your agency's end clients (production companies, advertisers): they receive your presentation sheet when the agency puts you forward for a casting. This disclosure is the main purpose of the service and is logged. The agency can do it from the production company's panel or with a private link that expires and that it can cancel at any time; through the link, only the initial of your surname is shown.
• Supabase (database and file storage): provider with servers in the European Union (Stockholm, Sweden), under an art. 28 GDPR data-processing agreement.
• Resend (delivery of account emails: sign-up and password reset): provider with sending infrastructure in the European Union (Ireland). It only receives your email address and the message content.
• Google (only if you choose to sign in with your Google account): Google Ireland Limited identifies you on its own screen and confirms to us who you are. In that step it processes your Google data as a controller, under its own privacy policy; Kastor does not send it the data in your profile.

No international transfers take place outside the European Economic Area and no data is disclosed to third parties other than those listed. If the list of providers changes, a new version of this policy will be published.

7. How long we keep it

For as long as your account is active. If you delete it (or ask your agency to), your profile, photos and files are erased. Only the records needed to prove legal compliance are kept (for example, the sheet-download log), and they do not allow your profile to be reconstructed.

Attendance sheets and their signatures are kept separately, for as long as liabilities may arise from your participation in the shoot (generally four years), because they evidence the days worked. After that period they are deleted.

Signed image rights releases are kept for as long as the release lasts. If you delete your account, they are deleted with it; the agency may have kept a copy beforehand to prove the authorisation.

For documents with an expiry date, the file is deleted automatically a month after it expires; the record (type and dates) stays until you renew or delete it. You can delete them at any time from your profile, and they are deleted with your account.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability before your agency or by writing to alexleonleon@gmail.com. From your own profile you can correct your data, download it and delete your account. If you believe a request has not been properly handled, you can complain to the Spanish Data Protection Agency (aepd.es).

9. Changes to this policy

Each version of this policy is numbered and dated. When you sign up, the version you accepted is recorded. If a substantial change affects how your data is processed, you will be asked to accept the new version.