Version 3.1

Last updated: May 7, 2026

Privacy Policy

Professional casting management platform for the audiovisual industry.

Identification of the Data Controller and the Data Processor
Territorial scope and covered markets
Categories of personal data processed
Purposes of processing and legal bases
Granular consents — Reinforced regime for sensitive data
Data retention periods
Recipients and data processors
International data transfers
Rights of data subjects
Specifics of the audiovisual sector
Third-party data and user responsibility
Casting directors as independent controllers
Communication between users — Closed platform model
Minors
Technical and organisational security measures
Cookies and similar technologies
Measurement and analytics services
Transfer to third parties in case of merger or acquisition
Jurisdiction-specific provisions
Amendments to this Privacy Policy
Complaints to supervisory authorities

1. Identification of the Data Controller and the Data Processor

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (hereinafter, the “GDPR”), Spanish Organic Law 3/2018, of 5 December, on Personal Data Protection and the Guarantee of Digital Rights (hereinafter, the “LOPDGDD”), and the local regulations applicable in the other markets covered by the platform, the following structure of responsibility is hereby disclosed regarding the personal data collected through TRAMA:

1.1. Data Controller

Concept	Details
Holder	Mr. Antonio García Romero
Spanish ID (DNI/NIF)	48687751V
Status	Sole trader (self-employed)
Address for notices	Calle Iglesia 14, p1/1, Aldaia (Valencia), 46960, Spain
Email for privacy matters	contacto@somostrama.ai
Platform	trama.ai

1.2. Data Processor

The company APPXPERT SOLUTIONS, S.L. provides the technical services of design, development, maintenance and support of the TRAMA platform, acting as Data Processor under article 28 GDPR, with the corresponding Data Processing Agreement (DPA) entered into with the Data Controller.

Concept	Details
Company name	APPXPERT SOLUTIONS, S.L.
Spanish Tax ID (CIF)	B56200264
Registered office	Calle Alejandro Dumas 17, Entresuelo, 29004 Málaga, Spain
Commercial Registry	Málaga

Hereinafter, the Data Controller shall be referred to indistinctly as “the Controller”, “TRAMA” or “the platform”. Any reference to user rights shall be understood as exercisable against the identified Controller.

2. Territorial scope and covered markets

This Privacy Policy governs the processing of personal data carried out by the Controller through the TRAMA platform, accessible via mobile application (iOS and Android) and, where applicable, via web interface. It applies to all platform users regardless of their functional role (actor or actress, agent or agency, casting director, and system administrator).

The platform is intended for users residing in the following markets:

Spain and the other countries of the European Economic Area (EEA).
North America: United States of America, Canada and Mexico.
Latin America: Panama, Costa Rica, Peru and Chile.

Operational availability by jurisdiction. The operational launch in each jurisdiction is subject to the prior completion by the Controller of the applicable local procedures (registration filings, designation of representatives, authorisations or other formal obligations). Until such procedures are completed for a specific jurisdiction, the service will not be available to users residing therein, in which case the system will prevent registration or limit the corresponding functionalities.

The specifics applicable to each jurisdiction are set out in Section 19.

3. Categories of personal data processed

TRAMA collects and processes the following personal data, grouped according to their nature, sensitivity and stage in the user flow. Where relevant, the special category status under article 9 GDPR is expressly identified, as well as those categories that receive a reinforced consent regime within TRAMA due to their professional context.

Onboarding structure and associated data. The TRAMA onboarding flow is divided into successive phases. Only the data corresponding to phases already completed are processed by the Controller. Phase 4, in which the actor or actress provides the extended professional profile data, is enabled only once the administration team has validated the user’s professional standing in the previous phase. Consequently, the Controller does not process sensitive actor profile data prior to such validation.

3.1. Account and authentication data (phase 1)

Unique user identifier (UID generated by Firebase Authentication).
Email address.
Password, managed exclusively by Firebase Authentication using standard cryptographic functions; the Controller does not store passwords in clear text.
Authentication provider used: email or Google account (in the latter case, via the Google OAuth flow).
Functional role assigned in the platform (actor, agent, casting director, administrator). The role is immutable after account creation.

3.2. Profile identification data — Common to all roles (phase 2)

Full name.
Date of birth (mandatory for actors, optional for the other roles). On the public interface only the calculated age is displayed; the full date remains accessible only to the user and to the administration team.
Mobile phone in international E.164 format. Only disclosed to the casting director after confirmation of the application.
City and country of residence (mandatory for actors).
External professional links: IMDb, LinkedIn, own professional website (all optional).
Agency or representation company name (only for users with the agent role).
Public username automatically generated by the system.

3.3. Professional verification documentation (phase 3)

In order to safeguard the professionalism and authenticity of users, TRAMA requests at this phase supporting documentation that is reviewed manually by the administration team:

Actors: professional CV in PDF format and, optionally, a verification video.
Agents: up to three PDF documents (cover letter, recommendation, others).
Casting directors: up to three PDF documents (cover letter, recommendation, others).
Optional referral code, in case of invitation by another verified user.

Such documents may contain personal data of third parties (signatories of the letters, teachers, referenced directors). The processing of such data is governed by Section 11.

Scope of administration team access. During the professional validation phase, the Controller’s administration team accesses only the account data, the user’s basic identification data and the supporting professional documentation. The user has not yet had the opportunity to provide the extended actor profile data (physical data, ethnic origin, professional photographs), which are completed in the subsequent phase. Validation has the sole purpose of confirming the user’s belonging to the audiovisual industry.

3.4. Extended actor profile data (phase 4 — only after professional validation)

Once the user has been validated by the administration team, actors and actresses may voluntarily provide the following additional professional data necessary for casting selection. Due to its nature, this block receives in TRAMA a reinforced regime of granular consent as detailed in Section 5.

3.4.1. Professional identity

Stage name (optional).
Place of birth (country).
Nationalities (one or several).
Work permits by country.
Self-declared gender identity. The default value is “prefer not to say” to protect the conscious decision of the user.

3.4.2. Professional physical data

Due to the professional nature of the audiovisual sector, the following data are customary and necessary for selection processes, and are subject to filtering by verified casting directors:

Height (in centimetres) and weight (in kilograms).
Build.
Hair colour and type.
Eye colour.
Tattoos and piercings (existence, visibility and approximate quantity).
Distinctive physical features (free text, optional).

Special category Art. 9 GDPR — Self-declared ethnic origin. The actor may voluntarily indicate their self-declared ethnic origin. This datum constitutes a special category of personal data under article 9.1 GDPR. Its processing is carried out solely on the basis of the data subject’s explicit consent (article 9.2.a GDPR), provided through a specific checkbox differentiated from the rest of consents. The processing of this datum is justified by its recognised sectoral professional use in the audiovisual industry, where searching for a specific ethnic profile for narrative reasons or fidelity to a role is a usual and legitimate practice. The actor may decline to provide this datum (option “prefer not to say”), withdraw it or modify it at any time from the profile editor. Choosing not to provide this datum does not penalise the visibility of the profile, but prevents the actor from appearing in searches filtered by this criterion performed by casting directors.

3.4.3. Languages, accents and professional skills

Languages and level of proficiency.
Mastered accents.
Singing, dance and sport disciplines and level.
Musical instruments.
Driving licences (type and issuing country) — declared, with no document required.
Stunt qualification.

3.4.4. Training and professional credits

Acting training: school, teacher, type and years (mentioning the teacher implies the processing of a third party’s data — see Section 11).
Professional credits: production, role, director, year, country, production company (mentioning the director implies the processing of a third party’s data — see Section 11).

3.4.5. Audiovisual material of the professional profile

Professional photographs (minimum 3, maximum 6): close-up (“headshot”), medium shot (“midshot”), full body (“fullbody”) and, optionally, additional photographs. Stored in Firebase Storage.
Showreels or reels: maximum 2 external links to Vimeo or YouTube. The management of the privacy of the link on these external platforms is the actor’s responsibility.
Professional verification video provided in phase 3 (optional).
Self-tapes: videos recorded as a specific response to a test request for a particular role.

Human validation of photographs. The photographs uploaded by actors are reviewed by administration personnel of the Controller, who validate whether they meet the established professional standards. This review is performed by a natural person — not by automated algorithms — and therefore does not constitute biometric processing under Art. 9 GDPR. Under no circumstances does TRAMA perform automated facial recognition, algorithmic biometric comparisons or storage of biometric templates extracted from images.

3.5. Operational data derived from the use of the platform

Castings created by casting directors: title, synopsis, production company, director, dates, location, budget, type (open, restricted, confidential).
Roles defined within each casting and their associated requirements.
Applications: applications of actors to roles, application status, complete and traceable history of status changes, declared availability, self-tape provided.
Non-disclosure agreements (NDA) signed by the user, where applicable.
Links between actors and agents (“representations”), including region and status of the link.
Consents given or withdrawn by the user, together with the date on which they were declared, retained as evidence of compliance with article 7.1 GDPR.

3.6. Technical and usage data

Timestamps of creation, modification and deletion of each document.
Identifier of the user who performed the last modification of each application (audit).
Logs of notifications sent, scheduled, cancelled or failed.
Technical connection data managed by Firebase and the infrastructure providers: IP address, device identifier, operating system, device language, basic technical usage events.

4. Purposes of processing and legal bases

In accordance with articles 5.1.a, 13 and 14 GDPR, the purposes of processing, their legal basis and the categories of data involved are detailed below:

Purpose	Legal basis	Data processed
Creation, management and maintenance of the user account and authentication.	Performance of the contract (Art. 6.1.b GDPR).	Account, authentication and identification profile data.
Professional verification of the user and prevention of fraud on the platform.	Legitimate interest of the Controller in safeguarding the professional authenticity of users (Art. 6.1.f GDPR).	Verification documentation, professional profile data.
Building and publication of the actor’s professional profile for consultation by verified casting directors and agents, including physical data.	Consent of the data subject (Art. 6.1.a GDPR), provided via specific checkbox.	Physical data of the actor profile, professional photographs.
Processing of the actor’s self-declared ethnic origin.	Explicit consent of the data subject (Art. 9.2.a GDPR), provided via a differentiated and reinforced checkbox.	”ethnicOrigin” field.
Processing of photographs and videos of the actor profile.	Consent of the data subject (Art. 6.1.a GDPR).	Professional photographs, reels, verification video, self-tapes.
Filtering of candidates by the casting director (including age, physical data and ethnic origin where declared).	Performance of the contract (Art. 6.1.b GDPR) with the casting director; explicit consent (Art. 9.2.a) of the actor for filtering by ethnic origin.	Physical data, calculated age, ethnic origin (if declared), languages, accents, location.
Management of applications and matching between actors and available roles.	Performance of the contract (Art. 6.1.b GDPR).	Profile data, applications, availability.
Communication between users with an active application, managed exclusively by the platform — see Section 13.	Performance of the contract (Art. 6.1.b GDPR).	Necessary identification and contact data; data on the status of the application.
Management of the representation of actors by verified agencies or agents.	Performance of the contract (Art. 6.1.b GDPR).	Identification data of actor and agent, regional scope, dates.
Intermediation in the management of non-disclosure agreements (NDA) in castings that require them.	Performance of the contract (Art. 6.1.b GDPR).	NDA document provided by the casting director; identification of the signatory; signed document; dates of each step.
Sending of operational notifications related to the user’s activity on the platform.	Performance of the contract (Art. 6.1.b GDPR).	Email address, operational event data.
Sending of commercial communications by email (newsletter, product updates, sectoral content).	Consent of the data subject (Art. 6.1.a GDPR), provided in a specific manner independent of the general consent — see Section 5.6.	Email address and user account status data.
Handling of requests for the exercise of rights and user support.	Compliance with a legal obligation (Art. 6.1.c GDPR) and legitimate interest of the Controller.	Identification and contact data, content of the request.
Retention of information for the fulfilment of legal tax, accounting and commercial obligations.	Compliance with a legal obligation (Art. 6.1.c GDPR).	Identification and, where applicable, tax data.
Continuous improvement of the service through aggregated and anonymised data.	Legitimate interest of the Controller (Art. 6.1.f GDPR).	Anonymised usage data; no automated decisions with legal effects are made.

Automated decisions. TRAMA does not adopt automated decisions, including profiling, that produce legal effects on the data subject or significantly affect them in a similar manner, within the meaning of article 22 GDPR. Application matching and filtering processes are tools to support decision-making by human casting directors; the final decision on the selection or non-selection of a candidate always rests with a natural person.

Data Protection Impact Assessment (DPIA). Given that the processing of ethnic origin combined with the possibility of filtering in the candidate directory may configure high-risk processing under article 35 GDPR, the Controller undertakes to carry out the corresponding Data Protection Impact Assessment prior to the activation of the advanced confidential directory functionalities.

5. Granular consents — Reinforced regime for sensitive data

In accordance with the principle of transparency and the requirement of free, specific, informed and unambiguous consent (articles 4.11 and 7 GDPR), TRAMA collects user consent through separate and differentiated checkboxes according to the category of data. Each consent is recorded with the date it was granted, as well as with the date of any subsequent withdrawal, in accordance with article 7.1 GDPR.

Applicable to all users. It covers the processing of basic identification data for account creation, service management and operational communications. It is collected through the acceptance of the Terms and Conditions and this Privacy Policy at the time of registration.

Applicable only to the actor role, in phase 4 of onboarding. It is collected through a specific checkbox when filling in the physical data block of the profile. It covers the processing of height, weight, build, hair colour and type, eye colour, tattoos, piercings and distinctive physical features, as well as the possibility that these data may be used as filtering criteria by casting directors.

The actor may revoke this consent at any time from the profile editor, which will entail the deletion of the physical data and the consequent reduction of the visibility of their profile to casting directors filtering by these criteria.

Applicable only to the actor role, in phase 4 of onboarding. It is collected through a differentiated checkbox reinforced with detailed information on the consequences of the processing. It is fully optional: the actor may decline to provide this datum and complete their profile without it. The “prefer not to say” option is always available and does not penalise the general visibility of the profile.

The explicit consent enables the processing of the ethnic origin solely for the purposes described in Section 4 (display of the professional profile and filtering by verified casting directors). The actor may revoke this consent at any time, with immediate effect on the visibility and filterability of the datum.

Applicable only to the actor role. It is collected when uploading photographs or providing video links. It covers the processing of audiovisual material for the purposes described in Section 4, as well as the viewing of the material by the Controller’s administration personnel for the purposes of professional validation.

5.5. Informed acknowledgement regarding self-tapes

Before providing the first self-tape, the actor or agent receives specific information about the regime of processing of this material:

The casting director to whom the self-tape is addressed will be able to download the file from the platform.
Once downloaded, the file remains in the possession of the casting director outside the technical scope of TRAMA, which cannot guarantee its deletion.
Over the downloaded file, the casting director acts as an independent controller of the processing — see Section 12 — and is bound by the provisions applicable to their jurisdiction.
Fifteen calendar days after the closure of the casting to which the self-tape was associated, TRAMA automatically deletes its copy of the file.

The actor may at any time decide not to provide self-tapes for a particular application, which will entail the cessation of the selection process for that role. This limitation is inherent to the way the sector operates and does not constitute a penalty by the Controller.

For the sending of commercial communications by email (newsletter, sectoral content, product improvements, etc.), the Controller collects user consent through a specific request independent from the general consent.

This request is presented to the user once, on the first entry into their profile after account activation, by means of a message that allows three responses: accept, reject or postpone the decision. Every response is recorded with the date on which it was given. The user may change their decision at any time from the platform’s preferences section.

The rejection of marketing consent does not affect the use of the service in any way.

5.7. Reinforced information in free-text fields

Certain platform fields admit free text from the user. To avoid the inadvertent processing of sensitive data (health information, identification data, etc.), the interface includes specific notices at the following points:

Distinctive physical features (“specialFeatures” field): explicit notice recommending not to include health information, medical conditions or surgeries.
Professional CV: explicit notice recommending not to include national ID, full postal address, social security data or medical information.
Cover and recommendation letters: notice recommending that the persons mentioned have authorised the use of their data.

6. Data retention periods

Personal data will be retained for the time strictly necessary to fulfil the purposes for which they were collected and, in any event, for the periods legally required:

Data category	Retention period
Active account and profile data	While the user’s account remains active on the platform.
Account deleted by the user	Grace period of 30 calendar days after the deletion request, during which the account is deactivated. After such period, automated anonymisation of the personal identification data is executed by means of an automated function (Cloud Function), so that the account cannot be re-linked to the data subject.
Self-tapes associated with applications (copy retained by TRAMA)	15 calendar days after the closure of the casting to which they were associated. After such period, TRAMA deletes its copy of the file. The copy that may have been downloaded by the casting director remains outside the technical scope of the Controller and is governed by the casting director’s own responsibility (Section 12).
Professional photographs rejected during validation	Immediate deletion from storage upon rejection of the block by the administration team. Only the rejection reason (text) is retained.
History of applications and status changes	While the actor’s or agent’s account remains active. Anonymised upon account deletion.
Verification documentation (CV, letters)	While the account remains active or until revoked by the user.
Signed non-disclosure agreements (NDA)	During the term of the agreement and, thereafter, during the legal limitation period of any actions arising from it.
Operational notifications (logs)	Twelve (12) months from sending, for audit and incident resolution purposes.
Records of consents granted or withdrawn	For the entire life of the processing and the subsequent limitation periods of actions, in accordance with the burden of proof of Art. 7.1 GDPR.
Data subject to tax and accounting obligations	Six (6) years from the end of the corresponding fiscal year, in accordance with article 30 of the Spanish Commercial Code.
Data related to potential claims	Until the end of the limitation period of the applicable legal actions.

Automated anonymisation. Once the 30-day grace period from the deletion request has elapsed, an automated function of the system replaces the user’s identification fields with non-reversible anonymous values. The application associated with an actor whose account has been anonymised will be displayed to the casting director with the legend “Account deleted”, without name, photograph or any personal data, while preserving the traceability of the process so as not to disrupt the casting director’s workflow.

7. Recipients and data processors

TRAMA does not sell, share for cross-context advertising purposes nor commercialise in any way the personal data of its users. Personal data are only shared with the following recipients and processors:

7.1. Other platform users

The functional essence of TRAMA implies reciprocal access to certain data by other verified users, in the context of selection processes:

Casting directors: access the full professional profile of actors who apply to their roles. In the case of confirmed applications, they additionally access the contact data of the actor — or of their agent, if any — at the time of confirmation. The legal status of the casting director with respect to these data is governed by Section 12.
Agents: access the full professional profile of the actors who have expressly accepted their representation, as well as the status of the applications associated with their roster.
Actors: do not access profiles of other actors. They only access aggregated information of castings and roles published with public visibility.
Confidential castings: the identification data of the production remain hidden. Only the casting director accesses the identity of the invited actors.

7.2. Data processors

The following entities act as processors under article 28 GDPR, with the corresponding processing agreement:

Processor	Service provided	Location / Safeguards
APPXPERT SOLUTIONS, S.L. (CIF: B56200264)	Design, development, technical maintenance and support of the TRAMA platform. Access to the information strictly necessary for the provision of the service.	Spain (EU). Data Processing Agreement (DPA) entered into with the Controller in accordance with Art. 28 GDPR.
Google Ireland Limited / Google LLC (Firebase)	Authentication services (Firebase Authentication), database (Cloud Firestore), file storage (Firebase Storage) and serverless functions (Cloud Functions). Audiovisual files (photos, self-tapes) are stored encrypted.	Ireland (EU) and United States. International transfer relying on Standard Contractual Clauses approved by the European Commission and, where applicable, on the EU-U.S. Data Privacy Framework.
Twilio SendGrid Inc.	Sending of transactional emails and commercial communications (the latter subject to user consent).	United States. International transfer relying on Standard Contractual Clauses and, where applicable, the Data Privacy Framework.

7.3. External video hosting platforms

When the user provides links to showreels or reels hosted on external platforms such as Vimeo or YouTube, such platforms act as independent controllers as regards the hosting of the video, governed by their own privacy policies. TRAMA only stores the URL of the link and has no control over the processing conditions that such platforms apply to the content. The management of the privacy of the video on the external platform (public, hidden, unlisted, etc.) is the sole responsibility of the user who hosts it.

7.4. Communications to authorities

The Controller may communicate personal data to public authorities, security forces or judicial bodies where there is a legal obligation to do so, or where such communication is necessary for the defence of legitimate rights of the Controller or of third parties.

8. International data transfers

As a consequence of the use of the technology providers identified in Section 7, certain personal data are subject to international transfers outside the European Economic Area, in particular to the United States of America.

These transfers are carried out relying on one of the mechanisms provided in Chapter V of the GDPR:

Standard Contractual Clauses approved by the European Commission by means of Implementing Decision (EU) 2021/914, signed with the relevant providers.
EU-U.S. Data Privacy Framework for those US providers that are certified under the framework approved by the European Commission’s Adequacy Decision of 10 July 2023.

For users residing in Latin American countries, transfers between the user’s country and the servers of the Controller’s technology providers are carried out relying on the equivalent safeguards provided in each local regulation. The Controller makes available to data subjects, upon request to the email address indicated in Section 1, a copy of the safeguards applied to these international transfers.

9. Rights of data subjects

In accordance with articles 15 to 22 GDPR and articles 13 to 18 LOPDGDD, users may exercise at any time, free of charge, the following rights:

Right	Content
Access (Art. 15 GDPR)	To obtain confirmation as to whether or not personal data concerning them are being processed, as well as to access such data and the information about the processing.
Rectification (Art. 16 GDPR)	To request the correction of inaccurate data or the completion of incomplete data. A large part of these rights can be exercised autonomously from the profile editing interface itself.
Erasure / “Right to be forgotten” (Art. 17 GDPR)	To request the erasure of data when the circumstances provided by law concur. Account deletion additionally has an autonomous procedure available from the platform itself.
Restriction of processing (Art. 18 GDPR)	To obtain the restriction of processing when the legally provided grounds concur.
Portability (Art. 20 GDPR)	To receive the personal data provided, in a structured, commonly used and machine-readable format, and to transmit them to another controller, where the processing is based on consent or on a contract and is carried out by automated means.
Objection (Art. 21 GDPR)	To object at any time to the processing based on the legitimate interest of the Controller, on grounds relating to the particular situation of the data subject.
Withdrawal of consent (Art. 7.3 GDPR)	To withdraw at any time the consent given for the processings based on it (granular consents in Section 5), without this affecting the lawfulness of the prior processing. The withdrawal of the consent for ethnic origin, physical data, audiovisual material or commercial communications is accessible from the profile editor itself.
Not to be subject to automated decisions (Art. 22 GDPR)	TRAMA does not make automated decisions with legal effects. Nevertheless, this right is expressly safeguarded.

9.1. Procedure for exercising rights

The rights may be exercised through any of the following channels:

Through the platform interface itself, in those cases in which the functionality so allows (modification of profile data, account deletion, withdrawal of granular consents).
By written communication addressed to contacto@somostrama.ai, clearly indicating the right being exercised and providing, where applicable, the documentation necessary to verify the identity of the applicant.
By postal communication addressed to the Controller’s address indicated in Section 1.

The Controller shall respond to the request within a maximum period of one (1) month from receipt, extendable by two (2) additional months in cases of particular complexity, in which case the data subject shall be informed within the first month.

10. Specifics of the audiovisual sector

10.1. Processing of image and voice

The user with the actor or actress role voluntarily provides professional photographs, videos (reels, showreel, verification video) and, where applicable, self-tapes specifically recorded for particular selection processes. These contents may contain identifiable information of the person.

The provision of these contents by the user is made on the basis of their express consent, given at the time of uploading the material, and is understood to be linked exclusively to the professional purposes described in this Policy. The user retains at all times the ownership of their image and may withdraw such contents from their profile.

The Controller shall not use the user’s images or videos for commercial, advertising or marketing purposes of the service itself without obtaining additional, specific and unambiguous consent for such purposes.

10.2. Self-tapes — Specific regime

Self-tapes are audiovisual material provided by the actor as a response to a specific request from the casting director for a particular role. Their processing is governed by the following rules:

The self-tape is stored in TRAMA and made available to the casting director to whom it is addressed.
The casting director may view the self-tape on the platform and download the file if needed for their selection process. Before providing the first self-tape, the actor receives explicit information about this download possibility (Section 5.5).
Once downloaded by the casting director, the file remains outside the technical scope of the Controller, who cannot guarantee its deletion. The casting director acts on the downloaded file as an independent controller of the processing (Section 12).
Fifteen calendar days after the closure of the casting to which the self-tape was associated, TRAMA automatically deletes its copy of the file from storage.
During the initial BETA phase, self-tapes are provided as external links to Vimeo or YouTube, with the actor being responsible for the privacy configuration of the link on those platforms.

10.3. Disclosure of information to casting directors and agents

The application to a role implies that the responsible casting director accesses the professional profile of the candidate actor. This disclosure is consubstantial to the operation of the service: without it, the contractual purpose pursued is not possible. The user is informed of this circumstance prior to each application.

Likewise, agents access the professional profile of the actors who have expressly accepted their representation. The acceptance of representation is performed actively by the actor, by confirming the invitation received.

10.4. Confidential castings and NDA

Certain castings may be classified as confidential at the production’s request. In such cases:

The identity of the production company and, eventually, other data of the work, remain hidden from the invited actor until the casting director decides to reveal them.
The actor may be required to sign a non-disclosure agreement (NDA) as a condition prior to accessing the full information of the role. The NDA document is provided by the casting director or the production company; TRAMA acts exclusively as a technical intermediary for its signature and archiving, without assuming responsibility for the content of the agreement or its legal validity.
The actor may freely refuse the invitation or the signing of the NDA, without consequences for the rest of their activity on the platform.

10.5. Filtering of candidates in the confidential directory

Verified casting directors may carry out filtered searches over the set of actors with a completed profile, attending to professional criteria customary in the sector: age, gender, location, languages, accents, complete physical data and, where the actor has expressly consented, self-declared ethnic origin.

Access to the filtering functionality requires prior professional verification of the casting director by the Controller’s administration team, who evaluates the supporting documentation provided in the onboarding.

10.6. Restricted profile visibility — Closed platform

Unlike other professional directories of the audiovisual sector, TRAMA profiles are not publicly accessible, are not indexable by search engines and are not distributed through public historical archives. Access to the actor’s profile is at all times restricted to verified users with a functional relationship to the selection process, in particular:

The casting director to whom the actor has applied, or who has invited the actor in a confidential casting.
The agent assigned to the actor, by virtue of an express link accepted by the actor themselves.
Administration personnel of the Controller, exclusively for the purpose and within the scope described in Section 3.3 and Section 15.

This closed architecture constitutes a conscious design choice aimed at maximising the protection of the actor’s professional profile, reducing the risk of unauthorised redistribution of their image and data, and minimising the surface of exposure to non-consented uses.

11. Third-party data and user responsibility

Certain contents that the user contributes to the platform may include personal data of third parties. In particular:

Cover or recommendation letters signed by third parties (agents, casting directors, teachers).
Professional CVs that mention teachers, directors or other collaborators.
Professional credits and training that include the names of directors, teachers, institutions.
Audiovisual material (reels, videos) that may contain images of other persons (cast members, technicians).
Castings published by casting directors that mention producers, directors or production companies.

In all such cases, the user warrants, when uploading or contributing the content, that they have the necessary authorisation of the persons mentioned or, failing that, that the processing is supported by a sufficient legal basis (for example, public professional data in the audiovisual field).

The user assumes responsibility for the content they contribute and undertakes not to include sensitive data of third parties (information on health, religion, sexual orientation, etc.) without their express consent.

If a natural person believes that their data have been included on the platform without their consent, they may contact the Controller through the channel indicated in Section 9 to request the erasure or restriction of the processing.

12. Casting directors as independent controllers

Casting directors who use the TRAMA platform for the purpose of selecting cast for an audiovisual production exercise, in relation to the personal data of the actors to whom they access, their own processing for their own professional purposes (the selection of cast for their production company or client). Consequently, casting directors have the status of independent Data Controllers with respect to the processing operations they carry out with the data accessed through the platform.

TRAMA acts as an intermediary platform that makes available to the casting director access to the actor’s data within the framework of the selection process. The casting director undertakes, through the acceptance of the role-specific Terms and Conditions:

Not to use the personal data of actors for purposes other than cast selection.
Not to share the data with third parties unrelated to the selection process without the actor’s authorisation.
To respect the retention periods that TRAMA applies on its platform and not to export data from the system beyond the audiovisual files downloaded (Section 10.2) that are necessary for their selection process.
To safeguard downloaded files (including self-tapes) with appropriate security measures and to delete them upon completion of the process for which they were provided.
To facilitate the exercise of the actor’s rights when the actor requests it directly from the casting director.
To assume their own responsibility under the GDPR and the local regulations applicable as regards the processing operations they carry out with the data.

13. Communication between users — Closed platform model

As a differential element of the service, TRAMA does not offer direct messaging functionality, chat or internal email between users. All operational communication related to the selection process is channelled exclusively through the platform, by means of automatic system notifications activated by the relevant events (submission of an application, status change, shortlisting, confirmation, etc.).

This intentional architecture has the following implications from a data protection perspective:

No personal data corresponding to the content of communications between users are processed, since no such communications exist within the platform.
The specific regime of the secrecy of electronic communications provided in article 18.3 of the Spanish Constitution and concordant regulations is not applicable to TRAMA, since the Controller does not act as a provider of interpersonal communications services.
The interaction between actor, agent and casting director during a selection process materialises exclusively through the application states and the structured flows defined by the platform.
Once an application is confirmed, the casting director accesses the contact data of the actor or of their agent (Section 7.1) and may initiate external communication by their own means. This communication remains outside the technical scope of the Controller and is governed by the responsibility of each party.

14. Minors

The use of the TRAMA platform is reserved exclusively to persons over 18 years of age. The registration process includes the verification of the user’s date of birth, and access is not permitted to persons who have not reached the age of majority.

The decision to set the age of majority as the access threshold is based on the professional nature of the platform, the presence of sensitive data (special categories, physical data, audiovisual material) and the need to safeguard the full and informed consent of the data subject.

Should the Controller detect the existence of an account belonging to a minor, it shall proceed with the immediate deactivation of the account and the erasure of the associated personal data.

15. Technical and organisational security measures

In accordance with articles 5.1.f and 32 GDPR, the Controller has implemented appropriate technical and organisational measures to ensure a level of security appropriate to the risk of the processing, including:

Encryption of data in transit using industry-standard TLS protocols.
Encryption of data at rest in the Google Firebase infrastructure.
Authentication system managed by Firebase Authentication, with passwords stored in encrypted form using industry-standard cryptographic derivation functions.
Access control to information by means of declarative security rules (Firestore Security Rules), restricting access to each datum exclusively to authorised users and roles.
Manual verification of the professional identity of users by the administration team prior to enabling operational access to the platform. The validation is performed solely on the account data and the professional documentation, without access to sensitive profile data.
Logical deletion system with deferred automated anonymisation (30 days).
Automated deletion of the Controller’s copy of self-tapes 15 days after the closure of the casting.
Access to self-tapes via signed URLs with limited duration.
Immutable and auditable record of application status changes.
Internal procedures for response to security incidents and notification of personal data breaches in accordance with articles 33 and 34 GDPR (notification to the AEPD within 72 hours; communication to the data subject when the breach entails a high risk).
Record of Processing Activities in accordance with article 30 GDPR.

Notwithstanding the foregoing, the Controller cannot guarantee the absolute inviolability of the Internet, so the sending and receipt of information through the platform are made assuming the inherent risk of electronic communications.

16. Cookies and similar technologies

The TRAMA mobile application uses essential technical identifiers for the correct operation of the service (session maintenance, user preferences, fraud prevention), as well as, in the case of the web version when available, cookies strictly necessary for the operation of the site.

Detailed information on the use of cookies and similar technologies is set out in the Cookie Policy, accessible from the platform itself. The installation of non-essential cookies will, where applicable, require the prior consent of the user.

17. Measurement and analytics services

As of the effective date of this Policy, TRAMA does not perform measurement or statistical analysis of platform usage by means of third-party analytics services.

The Controller reserves the possibility of activating in the future aggregated measurement services (in particular, Firebase Analytics, owned by the provider Google), with the purpose of improving the service and statistically understanding the use of the platform. The activation of such services:

Will be announced in advance to the user by means of an update to this Policy.
Will collect the user’s consent where required by applicable regulations, by means of the corresponding mechanism (cookie banner or equivalent).
Will limit the information collected to aggregated or pseudonymised data, with no direct commercial use of individual information.

18. Transfer to third parties in case of merger or acquisition

In the event of a merger, acquisition, sale of assets, corporate restructuring or any other equivalent operation affecting the Controller, the personal data processed may be transferred to the successor entity insofar as they are necessary for the continuity of the service provided to the user, while in all cases maintaining the data protection safeguards provided in this Policy and in the applicable regulations.

The Controller shall communicate to the user, with due notice, any circumstance of this nature that may affect the processing of their data, offering them the possibility to object to the transfer or to delete their account before the operation takes effect.

19. Jurisdiction-specific provisions

For users residing in each of the markets covered by the platform, in addition to the general framework described in this Policy, the corresponding local regulations apply. In case of conflict, the local regulation shall prevail when it offers greater protection to the data subject.

19.1. Spain and the European Economic Area

The processing of personal data is governed by Regulation (EU) 2016/679 (GDPR) and, in Spain, by Organic Law 3/2018, of 5 December (LOPDGDD). The competent supervisory authority is the Spanish Data Protection Agency (AEPD), with offices at C/ Jorge Juan 6, 28001 Madrid (www.aepd.es). In the other EEA Member States, users may address the supervisory authority of their country of residence.

19.2. United States of America

The processing of personal data of users residing in the United States is not currently subject to a federal omnibus data protection law, but to a mosaic of state and sectoral rules. The Controller applies the GDPR standards in a transversal manner to all platform users, which in practice means a level of protection no lower than that required by the applicable state rules.

In accordance with the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) (hereinafter, jointly, the “California Privacy Laws”), users residing in California have the rights to know, delete, correct and to non-discrimination for their exercise, as well as the right to opt out of the sharing or sale of their personal data (“Do Not Sell or Share My Personal Information”).

The Controller expressly states that it does NOT sell personal data nor share them for cross-context behavioral advertising purposes within the meaning of the California Privacy Laws.

The categories of personal information collected, where applicable, in accordance with the California Privacy Laws include: identifiers (name, address, email, phone); personal information included in customer records under Cal. Civ. Code §1798.80; classification characteristics protected by California or federal legislation (race, ethnic origin, age, gender or other demographic information), processed solely with the user’s explicit consent; professional or employment-related information (career, credits, training); platform activity and technical usage information. California users may exercise their rights by contacting the Controller at the address indicated in Section 1, with the Controller responding within a period not exceeding forty-five (45) days.

19.3. Canada

The processing of personal data of users residing in Canada is governed by the Personal Information Protection and Electronic Documents Act (PIPEDA) and, where applicable, by the equivalent provincial regulations. Users may file a complaint with the Office of the Privacy Commissioner of Canada (OPC) or with the competent provincial authority.

19.4. Mexico

The processing of personal data of users residing in Mexico is governed by the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its Regulations. This Policy integrates the elements of the Privacy Notice required by such regulation. The competent authority is the National Institute of Transparency, Access to Information and Personal Data Protection (INAI).

Users residing in Mexico have the rights of access, rectification, cancellation and objection (“ARCO rights”), as well as the right to revoke the consent given for the processing.

19.5. Panama

The processing of personal data of users residing in Panama is governed by Law 81 of 26 March 2019 on Personal Data Protection, and its Executive Decree 285 of 2021. The competent authority is the National Authority of Transparency and Access to Information (ANTAI).

Users residing in Panama have the rights of access, rectification, cancellation, objection and portability, in accordance with national legislation.

19.6. Chile

The processing of personal data of users residing in Chile is governed by Law 19,628 on the Protection of Private Life, in its current wording. Users residing in Chile may exercise the rights provided in such law directly before the Controller.

The Controller will follow the evolution of the legal reform underway in Chile and will adapt this Policy accordingly, communicating the changes in due course.

19.7. Peru

The processing of personal data of users residing in Peru is governed by Law No. 29733 on Personal Data Protection, its Regulations (Supreme Decree 003-2013-JUS) and the directives issued by the National Authority for Personal Data Protection (ANPD), attached to the Ministry of Justice and Human Rights.

Users residing in Peru may exercise the rights of information, access, updating, inclusion, rectification, erasure and objection, as well as file a complaint with the ANPD. The Controller undertakes to register the corresponding databases with the National Registry of Personal Data Protection prior to the effective operation of the service in Peru.

19.8. Costa Rica

The processing of personal data of users residing in Costa Rica is governed by Law 8968 on the Protection of the Person against the Processing of their Personal Data, and its Regulations. The competent authority is the Agency for the Protection of Data of the Inhabitants (PRODHAB).

Users residing in Costa Rica have the rights of access, rectification, erasure and objection provided in the regulation, as well as the right to file a complaint with PRODHAB. The Controller undertakes to register the corresponding databases with PRODHAB prior to the effective operation of the service in Costa Rica.

20. Amendments to this Privacy Policy

The Controller reserves the right to amend this Privacy Policy to adapt it to legislative developments, jurisprudential criteria, sector practices or new functionalities of the service. Amendments will be published on the platform with reasonable notice prior to their entry into force and, where they entail substantial changes affecting the rights of the data subject, they will be specifically notified by email or other equivalent means.

The continued use of the service after the elapse of the aforementioned notice period shall imply the acceptance of the amendments. The user who does not wish to accept the new conditions may request the deletion of their account in accordance with the procedure described in Section 6.

21. Complaints to supervisory authorities

The data subject has the right to file a complaint with the competent supervisory authority in their jurisdiction, especially when they consider that the Controller has not satisfactorily addressed the exercise of their rights. The applicable supervisory authorities are identified in Section 19.

Registration on the TRAMA platform and the use of its functionalities imply the user’s knowledge and acceptance of this Privacy Policy.

Document prepared in accordance with Regulation (EU) 2016/679 (GDPR), Spanish Organic Law 3/2018, of 5 December (LOPDGDD), and the local regulations applicable in the other markets covered by the platform.

← Back to home