1. Who We Are
Global Audition AB ("Short Audition", "we") operates a casting and audition management platform. Our contact details:
- Privacy: privacy@globalaudition.org
- Data Protection enquiries: privacy@globalaudition.org
- Website: globalaudition.org
2. Data Controller & Processor Roles
Privacy roles depend on the data context:
- Applicant casting data — the Production Company running the project is the data controller. Global Audition acts as a data processor on their instructions.
- Platform account data (admin logins, billing, support) — Global Audition is the data controller.
- Applicant app accounts — Global Audition is the controller for authentication; casting data remains under the Production Company.
A Data Processing Agreement (DPA) is available for Production Companies upon request.
3. Data We Collect
3.1 Account data
- Name, email address, phone number (optional)
- Authentication provider (email, Google, Apple)
- Role and organization membership
- Profile photo (optional)
- FCM push notification tokens
- Language preference (EN/SV)
3.2 Application / casting data
- Identity: name, email, phone, city, date of birth, age
- Physical attributes (optional, with explicit consent): height, hair/eye colour, ethnicity
- Skills, experience, CV, previous shows
- Photos, headshots, audition videos, showreels
- Custom form responses and eligibility answers
- Social media links (optional)
- Accessibility needs (optional)
- Group member details (couple/group applications)
3.3 Technical & usage data
- IP address (recorded at consent events and security checks)
- User agent / device type / app version
- Form completion steps and drop-off analytics (aggregated)
- Video upload metadata (resolution, duration, success/failure)
- Audit log entries for security and GDPR actions
3.4 Data we do not collect
- Advertising identifiers or cross-app tracking
- Precise GPS location (unless explicitly added in a future locations module)
- Payment card details from applicants (applicants never pay)
4. Legal Basis for Processing (GDPR Art. 6 & 9)
| Processing activity | Legal basis |
|---|
| Processing casting applications | Contract (Art. 6(1)(b)) |
| Video & photo review by casting team | Contract / Legitimate interest |
| Marketing updates (optional opt-in) | Consent (Art. 6(1)(a)) |
| Physical attributes, ethnicity (optional) | Explicit consent (Art. 9(2)(a)) |
| Consent logging (IP, timestamp) | Legal obligation / Legitimate interest (Art. 7 accountability) |
| Fraud prevention, App Check, rate limiting | Legitimate interest (Art. 6(1)(f)) |
| Platform analytics (aggregated) | Legitimate interest / Consent for cookies |
| Billing records (producers) | Legal obligation (tax/accounting law) |
5. Consent Management
Global Audition records consent per data field including:
- Field name (e.g. video_recording, marketing_opt_in)
- Granted or denied
- Timestamp (UTC)
- IP address
- User agent
- Privacy policy version (currently 2026.07.09)
You may withdraw consent for optional processing (e.g. marketing) at any time without affecting the lawfulness of prior processing. Withdrawal does not affect submitted applications already under contract processing.
6. How We Use Your Data
- Enable application submission, video upload, and save-and-continue
- Display submissions to authorized casting team members (RBAC)
- Send transactional notifications (received, shortlisted, callback, etc.)
- Generate registration numbers and track pipeline status
- Transcode videos to streaming formats (HLS)
- Improve platform reliability (aggregated analytics)
- Comply with legal obligations and respond to rights requests
- Detect fraud, abuse, and security incidents
7. Data Sharing & Processors
We share data only as necessary:
- Production Companies — applicant data for their casting projects
- Google Firebase — Auth, Firestore, Cloud Storage, Cloud Functions, FCM (europe-west1)
- SendGrid — transactional email
- Twilio — optional SMS notifications
- Stripe — producer billing only (not applicants)
All processors operate under Data Processing Agreements with Standard Contractual Clauses (SCCs) where data may transfer outside the EEA. We do not sell personal data.
8. International Transfers
Primary data storage is in europe-west1 (Google Cloud, Belgium). Some sub-processors (e.g. SendGrid, Twilio) may process data in the United States under EU-approved transfer mechanisms. Copies remain subject to the same security and retention controls.
9. Data Retention
- Default: 18 months per project from submission date (producer-configurable: 6–36 months)
- Incomplete drafts: 90 days from last save
- Consent records: 5 years (legal accountability)
- Audit logs: 5 years
- Billing: 7 years (Swedish accounting law)
After retention expires, personal data is anonymized or deleted. Media files are removed from Cloud Storage. See our Data Retention Policy for full details.
10. Your Rights
Under GDPR and UK GDPR you have the right to:
- Access — download your data as JSON (mobile app: Settings → Privacy & Data → Export JSON)
- Rectification — correct inaccurate data via the app or privacy@globalaudition.org
- Erasure — delete your account with a 30-day grace period (Settings → Delete My Account)
- Restriction — request limited processing while a dispute is resolved
- Portability — receive data in machine-readable JSON format
- Object — object to marketing or legitimate-interest processing
- Withdraw consent — for optional fields at any time
We respond within 30 days. Contact privacy@globalaudition.org with your registration number or account email.
11. Children's Privacy
Casting projects may require applicants to be 18+. Where minors are eligible, parental or guardian consent is required for applicants under 16 in the EU. We do not knowingly profile children for advertising. Production Companies must configure age gates appropriately.
12. Security Measures
- Encryption in transit (TLS 1.2+) and at rest (Firebase default AES-256)
- Role-based access controls with 8 defined roles and 30+ granular permissions
- Firebase Security Rules — least-privilege access to submissions and media
- Firebase App Check to reduce abuse and unauthorized API access
- Audit logging for GDPR actions, video access, and admin changes
- Rate limiting and CAPTCHA on public submission endpoints
- Soft-delete with anonymization rather than immediate hard-delete where legally required
13. Automated Decision-Making
Global Audition does not make casting decisions by solely automated means. Video quality gates (minimum resolution, duration) may auto-flag technical issues, but all casting outcomes involve human reviewers. Optional AI transcript features (when enabled) assist reviewers but do not determine selection.
14. Cookies & Similar Technologies
The web admin portal uses essential cookies for authentication and optional analytics cookies with consent. Mobile apps use local storage for offline drafts, not browser cookies. See our Cookie Policy for details.
15. Data Breach Notification
In the event of a personal data breach posing risk to your rights, we will notify the relevant supervisory authority within 72 hours and affected individuals without undue delay where required by law. Report security concerns to security@globalaudition.org.
16. Changes to This Policy
We update this policy when practices change. Material updates trigger a new policy version number; existing consents remain valid unless we request re-consent. The "Last updated" date reflects the current version.