Lost in Casting · Legal
Privacy Policy
Who we are. Lost in TV Limited trading as Lost in Casting (company number 04801855, 82A James Carter Road, Mildenhall, Suffolk IP28 7DE) is the data controller for the personal data described here. We are part of the Lost in TV group. Contact: [email protected]. Data protection queries go to [email protected]; no statutory Data Protection Officer is required at our scale and none is appointed.
This policy has two parts: A for supporting artistes (and applicants), B for production company contacts. Cookies are covered in our separate Cookie Policy.
Part A – Artistes
What we collect
| Category | Examples | Why |
|---|---|---|
| Identity & contact | name, email, phone, town, postcode, date of birth | account, 18+ eligibility, casting |
| Physical profile | height, weight, chest/waist/hip and related measurements, hair, eyes, shoe size | casting searches and wardrobe |
| Photos | headshot, full-length | casting |
| Ethnicity | your selected ethnicity | casting searches – special category data; providing it is entirely optional and it is processed only with your explicit consent, which you can withdraw at any time; you can also delete it yourself from your profile |
| Skills & experience | skills, proficiency, acting experience, Equity membership | casting |
| DBS certificate | the type of certificate, its date of issue, its certificate number, the date we looked at it and who looked; and a copy of the certificate itself for 10 days | evidencing to productions that a check exists – criminal offence data under Article 10 UK GDPR; see "DBS certificates" below |
| Right to work | passport/visa document copy, type, expiry | legal obligation before booking |
| Financial | bank account name, sort code, account number, National Insurance number | paying you; HMRC reporting – stored encrypted |
| Work records | applications, bookings, digital chits (hours, pay), queries, release forms, payments | running your engagements; pay transparency |
| Availability | calendar entries | casting |
Where your data comes from
Directly from you; from your use of the platform; and, if you choose to join through Lost in TV, from your existing Lost in TV account (name, contact details, date of birth) to pre-fill your profile – this transfer happens at your request when you opt to join.
Lawful bases
Contract (registration and work-finding services; bookings and payment) · Legal obligation (right-to-work checks; financial record-keeping; HMRC digital platform reporting from January 2024 rules) · Explicit consent (ethnicity; DBS certificate information) · Legitimate interests (service improvement, fraud prevention, enforcing our terms).
For DBS certificate information, which is criminal offence data under Article 10 UK GDPR, we rely on your explicit consent as our Article 6 basis and on the consent condition in Part 3 of Schedule 1 to the Data Protection Act 2018. Sending us a certificate is entirely optional, nothing on the platform requires it, and you may ask us to delete what we hold at any time. We also maintain an Appropriate Policy Document describing how this data is handled.
Who we share it with
- Production companies: your casting profile (name, photos, age, physical profile, ethnicity where you have consented, nationality, skills, general location, availability) so they can cast and run productions. They must use it only for the production and delete it afterwards; they never receive your bank details, NI number or right-to-work documents.
- Service providers: hosting (Hetzner, Germany – EU, covered by UK adequacy regulations), email delivery (Amazon SES, London region – data remains in the UK).
- Authorities where required by law (including HMRC reporting of platform earnings). We do not sell personal data and we do not share it for third-party marketing.
DBS certificates
A DBS certificate has no expiry date: it describes the day it was issued and nothing more. There is also no way for us to verify a certificate after the event – there is no lookup service, and the DBS Update Service is not open to us for the kind of work we cast. So we make no claim that a certificate is valid.
What we do is look at it and write down what it says.
- You send us your certificate only if you choose to. We cannot apply for one on your behalf; a basic certificate is something you obtain yourself from gov.uk.
- A person here looks at it and records the type, the date of issue, the certificate number, and who looked and when.
- Productions are shown that record – for example "Basic DBS, issued 6 July 2026, sighted 12 July 2026" – never a bare tick, because a tick would claim an assurance nobody can give. Once a certificate is more than 18 months old it is shown with its age against it rather than removed.
- The copy you send is deleted after 10 days. It is held in private storage, is never published, never attached to an email and never given a shareable link, and can only be opened by our own team from within the admin system.
- Every time certificate information leaves us we record who received it, what they were given and why, so you can always be told who has seen your check.
- You can ask us to delete the record at any time, and withdraw your consent, without affecting anything else about your registration.
Retention
- DBS certificate copy: 10 days from receipt, then deleted automatically.
- DBS record (type, issue date, number, sighting): for your registration term, deleted with your profile.
- Active profiles: for your 12-month registration term and any renewals; if you do not renew, your profile is hidden immediately and deleted 12 months after lapse unless you return.
- Financial and booking records: 6 years after the tax year they relate to (legal requirement).
- Right-to-work evidence: 2 years after your last engagement through us, then deleted automatically. If you never work through us it is deleted with your profile.
- Unsuccessful/incomplete applications: 12 months.
Your rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent (for ethnicity) – exercised via your profile or by contacting us. You can complain to the ICO (ico.org.uk).
Security
Bank details and National Insurance numbers are encrypted at rest. Access to personal data is restricted to our team on a need-to-know basis. Chit and release records are token-protected. DBS certificate copies are held in private storage that is not reachable from the public site, are opened only through an authenticated admin route, are never given a shareable link, and are deleted automatically after 10 days.
Part B – Production contacts
We hold your name, role, company, contact details, VAT/company numbers and account activity to operate your account, fulfil bookings and invoice you. Lawful bases: contract, legal obligation (financial records, 6 years), legitimate interests. We share it with our service providers as above and do not use it for third-party marketing. Rights as in Part A.
Part C – Anyone who emails us
When you write to us at [email protected], or reply to one of our emails, we keep your message, your name and email address, and anything you choose to put in it, so that we can answer you and keep a record of what was agreed.
Lawful basis. Legitimate interests: running an agency means being able to find what was said, by whom, and when. Where your message concerns a booking or an application, we also rely on contract.
Who sees it. Our own team. We do not use anything you email us for marketing, and we do not pass it on unless your message concerns a specific engagement and the production needs to see it in order to answer you.
How long. Six years, matching the retention of our booking and financial records, because correspondence agreeing a rate, a date or a cancellation forms part of that record. Messages are then deleted automatically, original included. We delete individual messages sooner where there is no reason to keep them, and we will do so on request.
Other people's information. Please do not send us other people's personal details unless you need to. Where a message reaches us containing information about someone who has no dealings with us – a forwarded booking sheet, for example – we delete it once it has served its purpose, without waiting for the period above.
Your rights. As set out in Part A. To have correspondence deleted, write to [email protected].
Last updated 6 September 2026. We will notify account holders of material changes.