Data protection at starboxx

Privacy policy
Responsible and secure handling of your data is important to us. We only collect and process data that is necessary for the fulfillment of legal requirements or for the provision of our services. We follow the principles for the processing of personal data according to the applicable data protection laws.

Below you will find information about what data is collected during your visit to or use of our website www.starboxx.de (including all sub-pages – collectively referred to as the 'website') and during/for the use of our casting & modelling agency services, how we use it and what security measures we take to protect your data. Information on objecting to the processing of data and what rights you have under data protection law can be found below.

Starboxx provides this data protection policy in the German language as well as in the English language – as a regard to international customers. In case of interpretation doubts, the German version prevails and is applicable.

I. Name and contact details of the controller and the data protection officer

1. Controller
The responsible party within the meaning of Art. 4 (7) GDPR for all data processing carried out via our website and within the scope of our activities as a casting & modelling agency is:

starboxx GmbH & Co KG, represented by starboxx Verwaltung GmbH,
which is represented by the managing directors: Marcel Knaak and Oliver Moritz
All of them: Fasanenstr. 35A, D-10719 Berlin (Germany)
Email: datenschutz@starboxx.de
Phone +49 (0)30 88 720 76 0
Fax +49 (0)30 88 720 76 -20

2. Data Protection Officer
Our data protection officer can be reached as follows:

EDSB - Andreas Lusch
Obentrautstr. 32, D-10963 Berlin (Germany)
E-Mail: datenschutz@starboxx.de

II. Data processing when using our website

1. When visiting the website
When you visit our website www.starboxx.de, the browser used on your end device automatically sends information to the server of our website, which is located in Germany. This information is stored temporarily and in so-called log files.

The following information is collected without your intervention and stored until automated deletion:

1. Information about the browser type and version used
2. The operating system of the user
3. The user’s Internet service provider
4. The IP address of the user
5. Date and time of access
6. Websites from which the user’s system accesses our website
7. Websites and files that are accessed by the user’s system via our website
8. Amount of data sent in bytes

We process the above data solely for the purposes of ensuring a smooth connection and maintaining the security and stability of our systems. The temporary storage of the IP address by the system is necessary to enable delivery of the website to the user’s computer. For this purpose, the user’s IP address must remain stored for the duration of the session. It is automatically deleted after the session ends. The deletion of further data stored in the log files takes place at the latest seven days after leaving the website. In this case, the IP addresses of the users are deleted or anonymised so that it is no longer possible to assign the calling client to a person. A longer storage period of the log files is possible in individual cases, for example, if there is a suspicion of misuse and we need the data to document it. The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected.

The storage in log files is done to ensure the functionality of the website. In addition, we use the data to optimise the website and to maintain the security of our information technology systems. An evaluation of the data for marketing purposes does not take place in this context. The processing is expressly not carried out for the purpose of drawing conclusions about your person.

The legal basis for this data processing is Art. 6 (1)(1)(f) GDPR. Our legitimate interest follows from the aforementioned purposes of data collection.

III. Data processing when contacting us

a. By email
For questions of any kind, we offer you the possibility to contact us via the email address mail@starboxx.de. If you click on this address under 'Contact' on our website, our website will contact your email program and automatically open a new window for writing an email, in which our email address is already entered as the addressee. You can avoid this function by adjusting the default settings of your email program or by using the corresponding functions of your mouse or keyboard to only copy the email address without clicking on it and then manually starting a new email.

When you send an email to us, we will see your sender email address. We also ask you to include your name in the email and, if you would like us to contact you by telephone, your telephone number. The data processing is carried out for the purpose of processing your request as well as for us to contact you, if requested in the content of the email. The legal basis for this is Art. 6 (1)(1)(a) GDPR based on your voluntarily given consent, which you impliedly give by contacting us via email. The personal data you provide us with in this process will be automatically deleted once your enquiry has been dealt with, unless legal reasons require us to store it.

b. Via our contact form
A contact form is available on our website, which can be used for electronic contact. If a user takes advantage of this option, the data entered in the input mask will be transmitted to us and stored. This data is:

• Your request or message
• Company/website
• Name
• Email address
• Telephone (optional)

The processing of the personal data from the input mask serves us solely to process the contact. In the case of contact by email or by contact form, this also constitutes the necessary legitimate interest in the processing of the data pursuant to Art. 6 (1)(1)(f) GDPR. The legal basis for this is Art. 6 (1)(1)(a) GDPR based on your voluntarily given consent.

The following technical data is also stored at the time the message is sent:

1. The IP address of the user
2. Date and time of form submission

This is done to prevent misuse of the contact form and to ensure the security of our information technology systems. The legal basis for the processing of this data is Art. 6 (1)(1)(f) GDPR. Our legitimate interest arises from the protection against misuse.

c. Duration of storage
The data is deleted as soon as it is no longer required to achieve the purpose for which it was collected. For the personal data from the input mask of the contact form and data sent by email, this is the case when the respective conversation with the user has ended. The conversation is ended when it is clear from the circumstances that the matter in question has been conclusively clarified. The additional personal data collected during the sending process will be deleted after a period of seven days at the latest.

d. Contract enquiries
If the purpose of your contact is to conclude a contract with us, the additional legal basis for the processing is Art. 6 (1)(1)(b) GDPR, as the processing of your data then also takes place for the purpose of initiating a contract. If a contract is not concluded, the data will be deleted immediately as soon as this is clear to both parties. When a contract is concluded, the data is stored for as long as this is necessary within the framework of the contract, but at most for the duration of the contract, unless legal retention periods (e.g. for tax reasons) force us to store the data for longer.

IV. Data processing during registration and use of the member area

As a casting and model agency, we offer all persons interested in being booked as an actor/actress, model/photo model, presenter, actor/actress, extra or candidate the opportunity to register for our casting database free of charge. Unfortunately, this is not possible without a detailed description of your own appearance, age and other characteristics of your person that are relevant for potential photo shoots. The more accurate and complete the information you provide about yourself, the greater the chance of being able to submit job offers that are a perfect fit for you. The information we require from you, which you can add on a voluntary basis, and how this data is used by us, who can see it and to whom we pass it on, is described in the following information. We also require your contact details (name, address, telephone number and email address) for our own processing and for possible contract offers, as well as details of your legal representatives in the case of minors.

We would like to point out that you can change and/or delete your details at any time by editing your profile in the member area. You can also delete your profile completely at any time.

Please read the following instructions carefully before sending your application for inclusion in our casting database. We will of course be happy to answer any questions you may have.

1. Registration
In order to become a member of our casting database and to be able to use the member area of our website, you must first register and apply for admission to our database. Before submitting your registration, we ask you to consent to the use of your data described below for the purpose of providing and managing your online account and the use of the data required for this purpose (including photos) for casting purposes by ticking the box in accordance with Art. 6 (1)(1)(a) GDPR. You can freely revoke this consent for the future at any time or simply delete your entire profile if you no longer wish to be listed in our database and no longer wish to receive booking enquiries from us.

a. Registration and use in the basic profile
On the starboxx website, we offer interested users the opportunity to register by providing personal data in order to be included in our database. You can find out what information is collected on the registration form - the mandatory information is marked as such; further information can be provided voluntarily. The completed form can only be sent after all mandatory details have been entered and you have consented to the use of the data provided by you for the stated purposes by placing a tick (so-called opt-in).

After the profile data has been entered in an input mask and transmitted to us by you by clicking on the 'Send registration' button, it will first be temporarily stored on our server. You will then receive an email from us with a confirmation link to the email address you provided. This serves to verify that the email address exists and that the owner of this address actually agrees to the registration. This verification is in our and your interest and the intermediate storage as well as the sending of the confirmation email are therefore justified according to Art. 6 (1)(1)(f) GDPR.

After receipt of the confirmation from the link in the email, the profile is activated and stored in our database until it is deleted – by the user him/herself or by us. If no confirmation is received within 30 days after sending the confirmation link, the temporarily stored data will be deleted manually.

Registered members can log in to the personal profile area with their email address and a secure password they have chosen themselves. The selected password is stored in encrypted form. It can be changed by the respective user in his/her own login area at any time. If a member has forgotten his/her password, the old password cannot be recovered, but he/she will receive a link to set up a new password upon request.

In the default setting, the user profile created is not publicly visible. No personal data can be found by search engines or third parties.

b. Minimum age
Persons under the age of 18 may only declare their registration as well as their consent to data processing jointly with all persons authorised to represent them alone or with all persons authorised to represent them jointly (usually one or both parents). The information on age and power of representation shall be ensured separately.

We would like to point out that in this case the names of the representatives will also be stored in order to be able to carry out an age verification if necessary and to check the correctness of the information. Furthermore, the storage of the representatives’ names serves to be able to check the correspondence of the representatives named there with our database data when concluding contracts. The storage of the names of the authorised representative(s) is based on Art. 6 (1)(1)(c) and (f) GDPR, as we have a legitimate interest in ensuring the protection of children and young people as well as in the possibility of verifying proper representation and are also legally obliged to do so pursuant to Art. 8 (2) GDPR.

c. Transmission data during registration and use of cookies
When you submit your registration, the following technical data is also stored in addition to the content data about you:

1. The IP address of the user
2. Date and time of application/registration
3. Date and time of the email confirmation of registration
4. Date and time of consent to data processing
5. Date, time and status of login attempts

We use a cookie for this purpose. The use of this cookie is for the purpose of identifying the person via the terminal device they are using. The identification is technically not feasible without a cookie. This is technically necessary for registration and for subsequent log-in processes, because some elements of our website, such as the login area, require that the calling browser can be identified even after a page change, so that the user does not have to log in again when surfing within our sub-pages. Furthermore, the use of the cookie ensures that the person logging in can only access his or her own data, which is not technically feasible without identification via a cookie.

The data processing by the cookie is carried out within the framework of our legitimate interests on the legal basis of Art. 6 (1)(1)(f) GDPR.

Cookies are text files that are stored in the Internet browser or by the Internet browser on the user’s computer system. When a user accesses a website, a cookie may be stored on the user's operating system. This cookie contains a characteristic string of characters that enables the browser to be uniquely identified when the website is visited again. The following data is stored and transmitted in the cookies:

1. A character string for browser recognition (session ID)
2. Creation date and expiry date of the cookie

We require these cookies for the following applications:

1. User registration and login
2. Project access for production companies

The data processed by cookies is not used for any other purposes than those mentioned above.

Cookies are stored on the user's computer. Therefore, you as a user also have full control over the use of cookies. By changing the settings in your Internet browser, you can deactivate or restrict the storage of cookies. Cookies that have already been stored can be deleted at any time. This can also be done automatically. If cookies are deactivated for our website, it may no longer be possible to use all the functions of the website (e.g. registration, login, project access) to their full extent.

2. Use of your profile data

a. General
Insofar as you provide us with personal data when registering/logging in, we use this data to respond to your enquiries, to carry out pre-contractual measures or to fulfil a contract and in particular for the purpose of making suggestions to film, TV and advertising productions about your person which may lead to a booking. As part of the registration process, your consent to the processing of this data is obtained (see above). This consent is the legal basis for the abovementioned data processing (Art. 6 (1)(1)(a) GDPR).

For the purpose of fulfilling the contract, namely to meet the users’ interest in booking them for productions as expressed by their registration in our database, we present the candidates we have selected on the basis of the criteria of the production requests to the production companies. For this purpose, the following data will be forwarded to interested production companies:

1. Photos and videos after selection by starboxx employees
2. Starboxx ID, gender, first name and last name
3. Eye colour, hair length, hair colour, body size and confection
4. Postcode and city
5. Project-related candidate texts

This serves the purpose of determining in advance to which of our registered members we will submit an offer to conclude a production contract with us. Every registered member agrees to this presentation to interested production companies by applying to be included in our casting database, so that the requirements of Art. 6 (1)(1)(a) GDPR are also met.

If starboxx sends the data as a proposal to a production company, this serves to initiate a contract, as the confirmed selection of the model to be booked by us is the prerequisite for us to offer this person the conclusion of a production contract with us. The transmission is therefore an indispensable preliminary stage for the offer to conclude a production contract with us and thus also serves to initiate the contract. It is justified according to Art. 6 (1)(1)(b) GDPR.

b. Activating the 'Online-Sedcard' option
In the default setting, the user profile created is not publicly visible. However, the user has the possibility to provide his/her data and photos for publication on the starboxx websites by activating the option 'Release an Online Sedcard' in the login area. There is no entitlement to publication.
If starboxx releases the requested publication, the following data of the user will be made available on the starboxx website for an unlimited number of users:

• Photos and videos after selection by starboxx employees
• Starboxx ID, gender, first name and last name
• Eye colour, hair length, hair colour, body size and confection
• Postcode and place of residence.

The publication of the data above is at the express request of the user and is not a prerequisite for inclusion in our casting database. The legal basis for the public provision is exclusively the consent given voluntarily, which is revocable at any time in accordance with Art. 7 and Art. 6 (1)(1)(a) GDPR.

The deactivation of the 'Online-Sedcard' feature is possible at any time independently by the member in his/her own member area under 'Settings'.

c. Use of your contact details such as address, email address and telephone number
We use the contact data you provide to us within the scope of our casting activities to contact you and for the purpose of submitting contractual offers, in particular to send booking enquiries or other information as well as for queries/contacting you in the case of production orders, for carrying out a password or user name reset and, if necessary, for billing purposes.

The legal basis for the aforementioned processing activities is, on the one hand, the fulfillment of the casting agency contract, Art. 6 (1)(1)(b) GDPR, and on the other hand, your consent expressly given during registration, pursuant to Art. 6 (1)(1)(a) GDPR.

A transfer to third parties only takes place if you expressly or impliedly agree to this by positively answering our concrete availability request for a specific production. Only in this case will we forward your candidate contacts as well as the application text you have optionally formulated on a voluntary basis to the production company carrying out the requested production. The production company will then contact the model or actor/actress if they are also interested.
Otherwise, data will only be passed on to third parties if we are legally obliged to do so.

3. Feedback and testimonials

We use the email address and telephone number of our registered members to send them a link to a feedback form and/or a testimonial form by email after the completion of a production, to which we also refer by SMS.

The link contains a unique key with the member's identification details so that the form for entering feedback or a field report can be opened and used in the personal member area without a separate login.

The use of the email address/telephone number for sending the form links as well as the use of the information provided is for the purpose of giving the models booked by us the opportunity to comment on the production or their experiences with starboxx and to be able to follow up on any complaints. It is in our legitimate interest to learn in this way how our work is perceived and, if necessary, to communicate this to others. The legal basis is Art. 6 (1)(1)(f) GDPR.

Since the sending of feedback or experience reports is voluntary, this also constitutes implied consent, so that the use is also justified in accordance with Art. 6 (1)(1)(a) GDPR.

a.
We use an electronic feedback form to communicate with registered users. We will send a link to this form by email to registered users eligible for a particular production when we enquire about his/her availability for that production or send him/her general offers. The requested user is free to reply to the email. However, if he/she wishes to express interest in participating in the requested production or his/her own time availability, this is done by using the feedback form. These can be general offers (newsletter – general offers by email) or general or specific availability requests of productions. The user can register as 'available' or 'not available' via two 'checkboxes' in the form, thereby expressing interest and his/her time availability. In some cases, the user can write application texts or, for example, specify blocking periods for holidays, etc. This data will be forwarded to us and – if interest in a production has been expressed – to the production company, if applicable.

The use of an electronic form for responding to our offer by email is for the purpose of simplifying communication processes through the uniform and electronic collection of data, which is in our legitimate interest and is legitimate according to Art. 6 (1)(1)(f) GDPR.

As soon as we no longer need the data from the feedback forms, it will be deleted. If it is a commitment to a production and we subsequently book the user for this production, the deletion will not take place before the production has been fully completed and only insofar as no longer legal and/or contractual retention periods exist. This longer storage takes place within the framework of the implementation of the production contract on the legal basis of Art. 6 (1)(1)(b) GDPR and in the case of legal retention periods on the basis of Art. 6 (1)(1)(c) GDPR.

b. Testimonials
The testimonials are primarily aimed at other members of our casting database as well as potentially interested parties. We are entitled, but not obliged, to publish these on our website and to store them permanently with us. For this purpose, the author grants us consent in accordance with Art. 6 (1)(1)(a) GDPR by sending his/her testimonial. Consent can be revoked at any time and the comment will be removed from the website after revocation. If a user's account is deleted, we will also delete all associated testimonials.

c. Minors
Feedback and experience reports from underage users will only be accepted or published with the express consent of the parent or guardian. In case of doubt about the consent, starboxx will immediately delete the information.

4. Production orders

If starboxx concludes a contract with one of the members of the casting database for the realisation of a production, starboxx will use the data mentioned in the production order within the framework of the fulfillment of the contract as well as for its own administration and accounting purposes and for the fulfillment of legal obligations of proof and documentation. The use of the data for the fulfillment of the contract is based on Art. 6 (1)(1)(b) GDPR.

Insofar as the data collection and data processing is also carried out for the legitimate interests of starboxx and no more serious interests of the contracting partner are opposed, this is based on Article 6 (1)(1)(f) GDPR.

starboxx points out that the creation of the recordings as stated in the production contract also constitutes data processing in the sense of data protection law. Since the production and the evaluation of the recordings within the framework of the production are carried out exclusively by the client (the production company) and its employees, the client and, if applicable, the photographer employed by the client are responsible for this data processing in relation to the recordings within the meaning of Art. 4 (7) GDPR. The creation and subsequent use of the recordings are carried out as part of the performance of the contract with starboxx on the basis of Art. 6 (1)(1)(b) GDPR. The purpose and scope of the data processing in relation to the recordings result from the production order. starboxx points out that the contractual partner is entitled to the rights mentioned in section VIII of this data protection declaration vis-à-vis the client.

V. Disclosure of data to third parties

1. General
We will only share your personal information with third parties if:

• you have given your express consent to this in accordance with Art. 6 (1) (1)(a) GDPR;
• the disclosure is necessary in accordance with Art. 6 (1)(1)(f) GDPR for the assertion, exercise or defence of legal claims and there is no reason to assume that you have an overriding interest worthy of protection in the non-disclosure of your data;
• there is a legal obligation for the disclosure pursuant to Art. 6 (1)(1)(c) GDPR, and/or
• this is legally permissible and necessary for the processing of a contractual relationship with you in accordance with Art. 6 (1)(1)(b) GDPR.

In cases other than those mentioned above, your personal data will not be passed on to third parties.

2. For the purpose of booking for a production

For the purpose of presenting suitable candidates, we pass on the data mentioned under IV. 2.a. to production companies. These can also be located in non-EU countries. For this reason, we limit the data disclosed to what is absolutely necessary to select a suitable person.

We do not pass on personal contact data such as email, telephone number and address to third parties unless the interested user has consented (Art. 6 (1)(1)(a) GDPR), the transfer serves to initiate and/or execute a contract (Art. 6 (1)(1)(b) GDPR) or we are obliged to do so for legal reasons (Art. 6 (1)(1)(c) GDPR). The data is only passed on for the purposes of contacting and communicating with regard to productions in which the user is participating or in which his/her interest can be assumed. The mobile phone number will be passed on to the production company after booking, in particular for the purpose of quick accessibility in emergencies, in the event of delays, etc., in the event of last-minute changes, postponements of the starting time or exact location arrangements as well as, if necessary, the arrangement of outfit/styling directly with production staff.

VI. Links to third-party sites

All links are researched to the best of our knowledge and belief. However, we cannot accept any liability for the content and existence of the links and websites listed by us. These third-party websites have separate independent privacy policies over which we have no control.
We would like to point out that the 'social media buttons' on our website are not plugins, but merely symbols behind which there is a simple link. Only by clicking on this link you will be redirected to the corresponding pages and data will be exchanged with these pages.

VII. Data transmission and security

Your personal data is transmitted securely through encryption when you connect to our homepage. For this purpose, our websites and the login are only accessible via SSL encryption. As a rule, this is a 256-bit encryption. If your browser does not support 256-bit encryption, we use 128-bit v3 technology instead. You can see whether an individual page of our website is transmitted in encrypted form by the closed display of the key or lock symbol in the lower status bar of your browser.
When communicating by email, we cannot guarantee complete data security, so we recommend that you send confidential information by post.

We attach great importance to the security and availability of our services. We therefore take appropriate technical and organisational measures to ensure a level of protection commensurate with the risk at all times. All data is stored and hosted in a secure TÜV-certified data centre in Berlin. We have concluded a legally effective contract processing agreement with them.

The databases and files are backed up there continuously and at other secure locations in Germany to enable recovery at any time. This is done on the legal basis of Art. 6 (1)(1)(f) GDPR, as we have a legitimate interest in securing our data and system settings by creating back-ups.

VIII. Your rights

As a person whose personal data is processed (so-called data subject), you have the following legal rights:

a. Right to withdraw your consent (Art. 7 (3) GDPR)
You can withdraw your consent to data processing at any time. This has the consequence that we may not and will not continue the data processing based on this consent in the future. The legality of the data processing carried out until your withdrawal of consent remains unaffected by the withdrawal.

b. Right of access (Art. 15 GDPR)
You can request information from us about your personal data processed by us, in particular about:

• the purposes of processing,
• the category of personal data,
• the categories of recipients to whom we have disclosed or will disclose your data,
• the planned storage period,
• the existence of a right to rectification, erasure, restriction of processing or objection,
• the existence of a right of appeal,
• the origin of your data, if this has not been collected by us, as well as about the existence of automated decision-making including profiling and, if applicable, meaningful information about its details

We have generally complied with this right to information with this data protection declaration. We will be happy to answer any further questions you may have.

c. Right to rectify or complete your data (Art. 16 GDPR)
You can demand that we rectify incorrect personal data or complete your personal data stored by us without delay.

d. Right to erasure of data (Art. 17 GDPR)
You can request that we delete your personal data immediately. As the controller, starboxx is obliged to delete your personal data without delay, unless the processing is necessary for the exercise of the right to freedom of expression and information, for compliance with a legal obligation, for reasons of public interest, or for the establishment, exercise or defence of legal claims.

e. Right to restriction of processing (Art. 18 GDPR)
You can request starboxx to restrict the processing of your personal data,

• insofar as the correctness of the data is disputed by you, the processing is unlawful, but you refuse its erasure, and starboxx no longer needs the data, but you yourself require it for the assertion, exercise or defence of legal claims.
  or
• if you have objected to the processing in accordance with Art. 21 GDPR.

f. Right to data portability (Art. 20 GDPR)
You have the right to receive your personal data stored by starboxx in a structured, common and machine-readable format and the right to have starboxx transfer this data to another controller without hindrance, provided that

• the processing is based on consent pursuant to Art. 6 (1)(1)(a) or Art. 9 (2)(a) GDPR or on a contract pursuant to Art. 6 (1)(1)(b) GDPR
  and
• the processing is carried out with the aid of automated procedures.

g. Right to lodge a complaint (Art. 77 GDPR)
You have the right to lodge a complaint with a data protection supervisory authority about the processing of your personal data by starboxx. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or the registered office of starboxx for this purpose.

h. Right to object (Art. 21 GDPR)
If your personal data is processed on the basis of legitimate interests pursuant to Art. 6 (1)(1)(f) GDPR, you have the right to object to the processing of your personal data pursuant to Art. 21 GDPR, insofar as there are grounds for doing so that arise from your particular situation or the objection is directed against direct advertising. In the latter case, you have a general right to object, which is implemented by starboxx without specifying a particular situation.

If you believe that the processing of your personal data is unlawful, please inform us immediately.

Please direct your enquiries, objections or revocations to the address given in section I. An email to datenschutz@starboxx.de suffices.

IX. Changes to the privacy policy

The responsible person reserves the right to change the privacy policy in order to adapt it to changed legal situations or in the event of changes to the service and data processing. Insofar as user consents are required or components of the data protection declaration contain provisions of the contractual relationship with the users, the changes shall only be made with the consent of the users.

Status 06/2021