Data processing agreement

1. Parties and roles

This agreement is made between the customer identified in Annex I, Part A (the Controller) and the PrePro Selects entity identified in Annex I, Part A (the Processor).

It applies to all processing of personal data that the Processor carries out on behalf of the Controller in providing the PrePro Selects service under the terms of service (the "Principal Agreement"), and forms part of that agreement.

Where the Processor determines its own purposes — account administration, billing, security, its own website — it acts as controller, and the privacy policy governs instead. This agreement does not cover that processing.

2. Definitions

GDPR means Regulation (EU) 2016/679. Personal data, processing, controller, processor, data subject, personal data breach and supervisory authority carry the meanings given to them there. Sub-processor means a processor engaged by the Processor to carry out processing on behalf of the Controller.

3. Scope and duration

The subject matter, duration, nature and purpose of the processing, the types of personal data and the categories of data subject are set out in Annex I, Part B, as Article 28(3) requires.

This agreement takes effect when the Controller first uses the service, or on the date of signature below if it is executed separately, and continues for as long as the Processor processes personal data on the Controller's behalf. Clauses that by their nature should survive — confidentiality, deletion, liability — survive termination.

4. Documented instructions

The Processor processes personal data only on the Controller's documented instructions, including as to transfers to a third country, unless required to do otherwise by Union or member state law — in which case it informs the Controller of that requirement before processing, unless the law forbids it on important grounds of public interest.

The Controller's documented instructions are: this agreement, the Principal Agreement, and the configuration and actions the Controller and its authorised users perform inside the product (creating projects, uploading material, creating and scoping client logins, enabling downloads, deleting content, and on the casting accounts creating casting links and forms and keeping a casting 14 more days).

The Processor informs the Controller if, in its opinion, an instruction infringes the GDPR or other data protection law, and may suspend that instruction until it is withdrawn or amended.

Running the service. Providing the service includes the Processor's own named personnel viewing account and gallery-login records (names, email addresses, sign-ins and time spent) in its operator tools, to give support, fix faults, keep the service secure and prevent abuse. Such access is logged. The Controller also authorises the Processor to compile statistics about use of the service that identify no person, no client and no Controller, and to use them to run and improve the service. The Processor does not use personal data processed on the Controller's behalf for any other purpose of its own, and never contacts the Controller's clients for marketing.

Casting links. On the casting accounts the Controller instructs the Processor to collect, through its street-casting and self-tape links, what members of the public send in answer to the Controller's form; to compress every photo and video on arrival and delete the original once the compressed copy has passed its checks; and to file each person into the Controller's casting project. When a casting project is deleted, the Processor keeps a short card of each person who applied (name, contact, answers and one headshot) as its own controller, under its privacy policy, to answer questions or claims about the casting. The Controller cannot see it, and it is deleted when the person asks or at the latest 3 years after the casting.

5. Personnel

The Processor ensures that every person authorised to process the personal data is bound by an obligation of confidentiality, is subject to appropriate training, and has access only to the data they need to do their job. Production access is limited to named individuals, is logged, and is withdrawn when it is no longer required.

6. Security measures

The Processor implements and maintains the technical and organisational measures set out in Annex II, which are designed to meet Article 32 having regard to the state of the art, the cost of implementation, and the nature, scope, context and purposes of the processing as well as the risk to data subjects.

Measures may be updated, provided the level of security is not reduced. The current measures are described in more detail on the security page.

7. Sub-processors

The Controller gives the Processor general written authorisation to engage sub-processors. Those currently engaged are listed in Annex III.

The Processor gives the Controller at least 30 days' notice by email before adding or replacing a sub-processor. The Controller may object on reasonable data protection grounds within that period; if the objection cannot be resolved, the Controller may terminate the affected part of the service and receive a pro-rata refund of prepaid fees.

The Processor imposes on each sub-processor, by contract, data protection obligations no less protective than those in this agreement, and remains fully liable to the Controller for the sub-processor's performance.

8. Data subject requests

Taking into account the nature of the processing, the Processor assists the Controller by appropriate technical and organisational measures, insofar as this is possible, in fulfilling the Controller's obligation to respond to requests to exercise data subject rights under Chapter III GDPR.

In practice most of this is self-service: the Controller can search, export, correct and delete material, gallery logins and viewing records from inside the product without asking us. Where a request cannot be met that way, the Processor helps within a reasonable period and at no charge for a proportionate volume of requests.

If a data subject contacts the Processor directly about data processed on the Controller's behalf, the Processor does not respond substantively. It forwards the request to the Controller without undue delay and tells the data subject that it has.

9. Further assistance

Taking into account the nature of the processing and the information available to it, the Processor assists the Controller in complying with Articles 32 to 36 GDPR: security of processing, breach notification to the supervisory authority and to data subjects, data protection impact assessments and prior consultation.

10. Personal data breach

The Processor notifies the Controller without undue delay, and in any event within 48 hours of becoming aware of a personal data breach affecting personal data processed on the Controller's behalf.

The notification describes, so far as it is known at the time:

• the nature of the breach, including the categories and approximate number of data subjects and records concerned;
• the likely consequences;
• the measures taken or proposed to address it and to mitigate its effects;
• a contact point for further information.

Where the full picture is not available within 48 hours, the Processor sends what it has and follows up in phases. The Processor does not notify a supervisory authority or a data subject on the Controller's behalf unless the Controller asks it to in writing.

11. Return and deletion

At the Controller's choice, the Processor deletes or returns all personal data processed on the Controller's behalf at the end of the provision of services, and deletes existing copies, unless Union or member state law requires it to be stored.

The mechanics, stated plainly:

• The workspace remains available in read-only form for 30 days after the service ends, so the Controller can export everything.
• After that period the workspace is deleted: the storage subtree holding the material is removed from disk and the database rows are deleted.
• Copies held in backups expire on a rolling cycle: about two weeks for the copies on the Processor's own servers, and at most 35 days for the encrypted off-site copies. Until they expire they are not accessible for any operational purpose and are used only for disaster recovery.
• The Processor certifies deletion in writing on request.

Casting projects. While the service runs, a casting project created from 22 October 2026 is deleted 60 days after it was created, unless the Controller keeps it 14 more days, which it can do once; the Processor emails the owner 14, 7 and 1 day before. A casting project created earlier keeps the date it was given. After a casting is deleted, the Processor stores each person's name, contact, answers and one headshot on the Controller's behalf until the Controller or the person asks for them to be deleted, and at the latest until the workspace is deleted at the end of the service.

12. Audits

The Processor makes available to the Controller all information necessary to demonstrate compliance with Article 28, and allows for and contributes to audits, including inspections, conducted by the Controller or an auditor it mandates.

Audits are limited to once in any twelve-month period unless a breach or a supervisory authority makes another necessary, require 30 days' written notice, take place in working hours, must not disrupt the service or compromise another customer's confidentiality, and are subject to confidentiality undertakings. The Processor may satisfy an audit request by providing documentation, written answers or a current third-party report where that reasonably addresses the Controller's questions.

13. Transfers

Personal data processed under this agreement is stored and processed in the European Economic Area — the application, database and local backups in Germany, and project media and the encrypted off-site backups in the European Union jurisdiction of the sub-processor named for them in Annex III — and is not transferred outside the European Economic Area, except as recorded in Annex III. Where a transfer to a third country does take place, it is made only under a valid Article 46 safeguard — in practice the European Commission's Standard Contractual Clauses — together with any supplementary measures the transfer risk assessment requires.

The Processor's transfer impact assessment is available on request. Its material conclusion: the data is stored in the EEA, and only the limited help-box data recorded in Annex III leaves it; the application, database and local backups run on infrastructure operated by an EEA provider, and project media and the off-site backups are held by Cloudflare, Inc. only in its European Union jurisdiction; the Processor operates no equipment in the third country; and access by a third-country authority would require legal process served on the Processor, handled under the policy published on the legal notice page, or on Cloudflare, Inc., which publishes its own.

14. Liability and precedence

The liability provisions of the Principal Agreement apply to this agreement and to any claim arising from it.

If this agreement conflicts with the Principal Agreement on a data protection matter, this agreement prevails. If it conflicts with Standard Contractual Clauses entered into between the parties, those clauses prevail.