# Privacy Policy

URL: https://castingagenda.com/privacy-policy/

> What data we collect, why we use it, and how long we keep it. No ads, no tracking cookies — your schedule stays yours.

*Last updated: 21 October 2026*

Casting Agenda is a personal agenda for extras, featured extras and actors in small speaking roles. You keep your own casting options, shoot days and fees in it. We are not a casting agency and we do not broker work: your data belongs to you and is not shared with agencies or producers.

In this statement you can read which data we process, why, how long we keep it and which rights you have.

## 1. Who is responsible?

**Casting Agenda** Email: [contact@castingagenda.com](mailto:contact@castingagenda.com)

We do not have a data protection officer; you can direct all your questions to the address above.

## 2. Which data do we process?

### 2.1 Account data

- Your first and last name and email address
- Your password, stored only in encrypted form (hashed) — we cannot view it
- Your language, recorded at registration based on the language of the website
- Registration date and the moment you confirmed your email address
- When and with which version you accepted the terms of use
- A profile photo, only if you upload one yourself
- A unique, non-guessable personal app link
- Any invitation code if you joined through someone else
- Your email preferences (whether you want to receive tips — including the email on the day a production airs — and the monthly overview)
- Your dashboard and overview layout (order and size of blocks and columns)
- If you change your email address: the new address, temporarily (for a maximum of 24 hours), until you confirm it

### 2.2 The content of your agenda

This is everything you enter yourself for an option or shoot day:

- Date or dates, time and production title
- Location, including the formatted address and the matching coordinates if you choose an address to show on the map
- Role, the type of role (extra, featured extra, small speaking role or a custom description you enter yourself), casting agency, broadcaster and broadcast date
- Fee, payment term and whether payment has already been made
- Status of the option, your own notes and when you want a reminder
- How visible you were in a production (not on screen, background, midground or foreground), which you enter yourself after broadcast. This applies to all options with the same title.
- Agencies and statuses that you create yourself
- Dates on which you are not available, with any note
- Quitclaims that you upload with an option (PDF, JPEG, PNG or WebP, maximum 10 MB per file and 10 files per option), with file name, type and size

**Automatically filled-in broadcast date:** if an option has no broadcast date, we look up the production title on The Movie Database (TMDB). Only the title goes to TMDB, not your personal data; see section 4. For each option we record whether the broadcast date was entered by you or filled in automatically, when that happened, and whether you confirmed or declined a newly found date. We never overwrite a date you entered yourself.

**Please note:** you decide yourself what you enter. Do not put information in the app that falls under a non-disclosure agreement from a production, and avoid data about others (such as fellow extras) unless it is really necessary.

### 2.3 Notifications

If you turn on push notifications, we store the technical subscription of your browser: the notification address of your browser provider, the associated encryption keys, a short description of your browser or device, and when the subscription was created and last used. Push notifications cover, among other things, shoot days, status changes, payments, the weekly overview and the day a production is broadcast. If you turn off your notifications, we delete this.

### 2.4 Technical data

- Standard server logs from our hosting provider, including your IP address, time and the page requested
- Security logs from our firewall, including login attempts
- Protection against repeated 404 errors: if an IP address requests many pages that do not exist within a short time, that address is blocked temporarily or permanently. For this we keep the blocked IP addresses (until they are released), the IP addresses of administrators set up to manage the site (the last 20), and a log of IP addresses that caused 404 errors, for the last 24 hours.
- Security check when logging in, registering and resetting a forgotten password (ALTCHA, on our own server): your browser computes a one-time proof of work, and a short-lived counter per hashed IP address (maximum 15 minutes) slows down bots that make many attempts. We do not use external services for this.
- Requesting a new confirmation email is limited: we count per hashed IP address (maximum 1 hour) and per account (per day). We do not store the IP address itself.
- When you last logged in and when you were last active in the app
- Anonymous visitor statistics of the public website (Matomo, on our own server): pages visited, the website you came from, device type, browser and operating system. Your IP address is shortened before it is stored, and we do not use cookies for this. The app, the login pages and personal links are not measured. If you use a tracker blocker in your browser, your visit is not counted. You can also opt out of these statistics yourself (see section 9).

### 2.5 Contact form

If you use the contact form, we store your name, email address and message, and we use them only to reply to you.

**What we do not do:** we do not use Google Analytics or other third-party statistics tools, no advertising networks, no tracking pixels and no profiling. We do not sell or trade your data.

## 3. Why do we process this data?

| Purpose | Legal basis (GDPR) |
| --- | --- |
| Creating your account and giving you access to your agenda | Performance of the contract |
| Storing, displaying, exporting and synchronising your agenda items | Performance of the contract |
| Confirming your email address, confirming a new email address and enabling password reset | Performance of the contract |
| Sending reminders about your own shoot days, by email or push | Performance of the contract; for push, your consent |
| A notification on the day a production you worked on is broadcast: by email (counts as tips) and, if you have push notifications on, by push | Legitimate interest (email; you can unsubscribe under tips); consent for push |
| The monthly overview with a backup (CSV) of all your options | Legitimate interest (keeping your data safe with you); you can unsubscribe from this |
| Tips: help getting started, a nudge about options that have been open for a while, a congratulation on your first booking and an occasional reminder if you have not used the app for a while | Legitimate interest; you can unsubscribe from this |
| A warning before an unconfirmed or unused account is deleted | Legitimate interest (so you do not lose your account unexpectedly) |
| Converting addresses to map locations | Performance of the contract |
| Looking up the broadcast date of your production at TMDB | Performance of the contract (you get the broadcast date in your agenda) |
| Anonymous visitor statistics of the website, to see which pages are read and to improve the site | Legitimate interest; you can opt out or object (see section 9) |
| Security, abuse prevention and resolving faults | Legitimate interest (a safe, working service) |

**Unsubscribing:** you can switch off tips and the monthly overview yourself on your account page, under **Emails**; every tip email also contains a link there. Emails that are needed for the service to work — account confirmation, password reset, shoot-day reminders and the warning before deletion — you will keep receiving. You can switch off the shoot-day reminder per option. The email on the day a production is broadcast falls under tips. You switch off push notifications on your account page, tab **Calendar**.

## 4. Who can see your data?

Your agenda is protected per user: other users cannot access it. Our administrators may have access to data during technical maintenance or a support request, but they do so only when necessary.

We use the following parties:

- **Hosting provider (Hostinger):** runs the website, app and database. Servers in the Netherlands.
- **Matomo (self-hosted):** anonymous visitor statistics of the public website. Runs on our own server at our hosting provider; no visitor data is sent to Matomo itself or to other parties.
- **Email sender (Proton Mail):** sends confirmation, reset and reminder emails and the monthly overview.
- **The Movie Database (TMDB):** looks up the broadcast or release date of your productions. For each production only the title goes to TMDB, via a request from our server, not from your browser. See also the [TMDB website](https://www.themoviedb.org) for their own terms.
- **Wordfence (Defiant Inc., United States):** security and firewall. When there is suspicious activity, such as an attack or repeated failed login attempts, Wordfence shares the visitor’s IP address with the Wordfence security network so that attacks can be blocked faster.
- **WP Forms:** contact form.
- **MapTiler (only if we use the map service):** provides the map background on pages with a map. MapTiler is a European provider; your browser fetches the map tiles directly from MapTiler, and MapTiler sees your IP address and the map area you are viewing.
- **OpenStreetMap Foundation (Nominatim):** looks up an address when you enter a location. Your browser sends the search term you typed directly to OpenStreetMap; OpenStreetMap also sees your IP address.
- **Your browser provider (Apple, Google, Mozilla or Microsoft):** delivers push notifications, only if you have turned them on.

We sign data processing agreements with parties that process data on our behalf. For push notifications and for security reports to Wordfence, your IP address may be processed outside the European Economic Area, for example in the United States. In that case this is based on the standard contractual clauses of the European Commission or a valid adequacy decision. Fonts, map software, visitor statistics and the security check when logging in run on our own server.

## 5. Your iCal link and availability link

You can link your agenda to Apple Calendar, Google Calendar or Outlook via a personal iCal link. That link contains a long, secret code and is deliberately accessible without logging in — otherwise your calendar app cannot reach it. **Anyone who has your iCal link can see the contents of your agenda.** So do not share it.

The availability link is intended for sharing with casting agencies. It shows only dates marked as available, booked or not available, and your name — no productions, titles or locations.

If you suspect a link has leaked, or you want it to stop working, create a new link yourself on your account page (tab **Calendar**). The old link stops working immediately.

## 6. Cookies and local storage

We use only functional and strictly necessary cookies and local storage. There are no tracking or advertising cookies on the site; our anonymous visitor statistics also work without cookies.

- **Login cookies:** keep you logged in. They expire after 30 days or as soon as you log out.
- **Language choice:** remembers whether you view the Dutch or English version. Retention: one year.
- **Form:** if logging in, registering or requesting a new password does not succeed, a short-lived cookie (10 minutes) remembers which form you were filling in, so the details you entered stay put and you do not have to start again.
- **Display preference:** remembers in your browser whether you use light or dark mode, and which period and which group of tiles you view on the dashboard. Stays until you clear your browser data.
- **Opt-out for statistics:** only if you opt out of visitor statistics (see section 9), a cookie in your browser records that we should not measure you. Without opting out, this cookie is not placed.
- **Background tasks:** a timestamp in your browser makes sure scheduled tasks (such as reminders) are not triggered more often than necessary.
- **Security and speed:** the firewall, the hosting provider and the caching plugin of the website may place technical cookies that are needed to keep the site secure and fast.

## 7. How long do we keep your data?

- **Your account and agenda:** as long as your account exists.
- **If you delete your account:** if you log in again within 24 hours, the request is cancelled. Otherwise your account and all related data — options, files, agencies, statuses and notification subscriptions — are permanently deleted no later than 48 hours after your request. Just before deletion you automatically receive an email with an export (CSV) of all your casting options.
- **Unconfirmed accounts:** after 7 days you receive a reminder by email; after 14 days an account that is still unconfirmed is deleted.
- **Unused accounts without options:** after 30 days without activity you receive a warning by email; if you do not log in within 7 days after that, the account is deleted.
- **Accounts with options** are never deleted automatically.
- **Blocked IP addresses (404 protection):** remain blocked until they are released. The IP log of the last 24 hours is cleared automatically after that.
- **Security check counters:** maximum 15 minutes; the counter for a new confirmation email maximum 1 hour. Then automatically removed.
- **Form cookie:** 10 minutes.
- **Visitor statistics:** raw, shortened visit data is automatically deleted after 6 months; after that only aggregated figures remain that cannot be traced back to individuals.
- **Backups:** data may remain briefly in encrypted backups and is overwritten there according to the regular backup schedule.

## 8. Security

- All traffic is encrypted via HTTPS.
- Passwords are stored only in hashed form and must be at least 8 characters long.
- You can change your email address or password only with your current password. A new email address becomes active only after you have confirmed it via a link in your mailbox; your old address is notified of this.
- Each user can access only their own data.
- Forms are protected against abuse from outside.
- A firewall blocks suspicious login attempts and traffic.
- Uploads are checked on content, not only on file name. A quitclaim may be a PDF, JPEG, PNG or WebP file (maximum 10 MB per file, 10 files per option); a profile photo a JPEG, PNG, WebP or GIF file (maximum 5 MB).

## 9. Your rights

You have the right to:

- view your data;
- have incorrect data corrected;
- have your data deleted;
- restrict the processing;
- object to processing based on legitimate interest;
- receive your data in a commonly used file format;
- withdraw given consent, for example for push notifications, at any time.

You can arrange much of this yourself in the app: edit your data, export your options to a CSV or Excel file, switch off notifications and emails, renew links and delete your account. If you cannot manage, email [contact@castingagenda.com](mailto:contact@castingagenda.com). We respond within 30 days. If you are not satisfied, you can file a complaint with the [Dutch Data Protection Authority](https://autoriteitpersoonsgegevens.nl/).

### Opting out of visitor statistics

Do you not want to be counted in the anonymous visitor statistics of this website? Then you can opt out below. Your opt-out is remembered with a cookie in your browser. If you clear your cookies or use another device or browser, you will need to opt out again. Opting out protects your privacy, but it also means we see less of how the site is used.

Use the checkbox below: a checked box means you are counted. Uncheck it to opt out, and check it again to opt back in. It works only with JavaScript and with cookies enabled. If it does not work, email [contact@castingagenda.com](mailto:contact@castingagenda.com).

Opt-out set: your visits to this website are not stored for statistics. If you clear your cookies or use another device or browser, you will need to opt out again.

You can choose not to be counted in our anonymous visitor statistics. That protects your privacy, but we can then learn less about how the site is used and what can be improved.

**Cookies must be enabled to opt out.**

## 10. Age

Extra work is also done by young people. If you are under 16, use Casting Agenda only with the permission of your parent or guardian. If we find that an account of someone under 16 was created without that permission, we will delete it.

## 11. Changes

We may amend this privacy statement, for example when new features are added. The date at the top shows when we last did so. For significant changes we will inform you via the app or by email.