castyThis Privacy Policy explains how Casty ("Casty", "we", "us") processes personal data when you use our mobile applications, websites (including public portfolio pages), and related services (collectively, the "Services").
1. Who we are
The data controller for the Services is the entity operating Casty. For privacy requests and general support, contact support@casty.pl.
2. Data we collect
- Account data: name, email address, date of birth or age, authentication identifiers (via our identity provider), and profile preferences.
- Portfolio data: photos, bio, city, physical attributes, skills, social links, and public handle you choose to display.
- Job data: role applications, attendance check-in/check-out events, OTP verification for on-set attendance, and related operational timestamps.
- Device and usage data: app version, language, push notification tokens (if enabled), and diagnostic logs needed to secure and improve the Services.
- Communications: messages you send to support and records of your privacy or account requests.
3. How we use data
- Provide and operate the Services, including public portfolios, job applications, and attendance flows.
- Authenticate users, prevent fraud and abuse, and enforce our Terms.
- Send service-related notifications (for example job updates) when you enable push notifications.
- Improve reliability, security, and product experience through analytics and debugging.
- Comply with legal obligations and respond to lawful requests.
4. Legal bases (EEA/UK users)
Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the Services you request); legitimate interests (security, product improvement, fraud prevention) balanced against your rights; consent where required (for example optional marketing or certain permissions); and legal obligation where applicable.
5. Sharing and processors
We share data only as needed to run the Services, including with:
- Authentication and account management providers.
- Cloud hosting and database providers.
- Image hosting and delivery providers for portfolio photos.
- Organizations and production teams when you apply to a role or check in to a job day (limited to information required for that production).
- Professional advisers or authorities when required by law.
We do not sell your personal data. We require processors to protect data under contract.
6. International transfers
If we transfer personal data outside your country, we use appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms where required.
7. Retention
We keep personal data while your account is active and for a limited period afterward for legal, security, and dispute-resolution purposes. You may delete your account in the app; we will then delete or anonymize data within a reasonable period, except where retention is required by law.
8. Your rights
Depending on your location, you may have rights to access, correct, delete, restrict, or object to processing, and to data portability. You may also withdraw consent where processing is consent-based. Contact support@casty.pl to exercise these rights. You may lodge a complaint with your local data protection authority.
9. Account deletion
You can delete your account from in-app Settings. Deletion removes your profile, portfolio content, and associated server records subject to backup retention limits and legal holds.
10. Children
The Services are not directed to children under 16. We do not knowingly collect data from children under 16. Contact us if you believe a child has provided data.
11. Security
We use technical and organizational measures appropriate to the risk, including encryption in transit, access controls, and monitoring. No method of transmission or storage is completely secure.
12. Changes
We may update this Policy. We will post the revised version with a new "Last updated" date. Material changes may be notified in the app or by email where appropriate.