This Privacy Policy describes how the personal data of users who register and use the showbizinc.it Platform are processed, pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”).

Last revised: 3 June 2026 — Version 2.0

---

1. Data Controller

The Data Controller is Showbiz Movies Srl, with registered office at Via Ugo Lenzi 12, 40122 Bologna (BO), Italy, VAT no. IT03382321200.

• Email: [email protected]
• Certified email (PEC): [email protected]

For any request concerning your personal data and the rights granted by the GDPR, you may contact the Data Controller at the contact details above.

2. Categories of data processed

Depending on how you use the Platform, we may process:

• Identification and contact data: first name, last name, email, telephone/WhatsApp number;
• Access credentials;
• Professional profile data: category (model, hostess, actor and similar roles), declared physical characteristics, languages spoken, availability, area/city of residence, photos, videos and portfolio materials uploaded by the user;
• Application data for castings and related outcomes;
• Technical and browsing data (IP address, logs, cookies and identifiers — see the Cookies section).

Providing the data required for registration and profile management is a prerequisite for delivering the service: failure to provide it prevents registration and participation in castings.

3. Methods and place of processing

Data are processed using IT and electronic tools, adopting technical and organisational measures appropriate to ensure their security, confidentiality and integrity. Processing is carried out by authorised internal staff and by suppliers acting as data processors. Data are stored on servers located within the European Union; any processing involving a transfer outside the EU is governed by the “Transfers” section.

4. Purposes of processing and legal bases

We process your data for the purposes set out below, each with its relevant legal basis pursuant to Article 6 of the GDPR.

4.1 Creation and management of the account and profile (casting service)

• Purpose: registration, authentication, creation and management of the profile, publication of the profile on the Platform and application to castings.
• Legal basis: performance of a contract — Art. 6(1)(b) GDPR. Acceptance of the Terms and Conditions and acknowledgement of this Privacy Policy are necessary prerequisites of the relationship: they are not optional “consents”.

4.2 Service communications (multi-channel)

• Purpose: to send you communications connected to the service — alerts about castings relevant to your profile, updates on the status of your applications, notifications relating to your profile and account, legal and administrative communications. These are not promotional communications.
• Legal basis: performance of a contract — Art. 6(1)(b) GDPR. Without a channel to receive them, the casting service could not function.
• Channel choice: the acknowledgement concerns the fact of receiving such communications; how you receive them is a delivery preference managed in your personal area (“Channel preferences”). Email always remains active, as the minimum service channel and for legal and security alerts; WhatsApp can be freely enabled/disabled; the Push channel is set up for future use. Channel preferences are stored as user settings and do not constitute consent to processing.

4.3 Casting matching

• Purpose: to compare the professional characteristics of your profile (category, professional physical characteristics, languages, availability, area of residence) with casting requirements, in order to suggest relevant opportunities and make you discoverable by casting clients for compatible searches.
• Legal basis: legitimate interest of the Controller — Art. 6(1)(f) GDPR, consisting in offering an effective matching service between talent and opportunities. This interest is balanced against your rights through a documented assessment.
• Right to object: since the processing is based on legitimate interest, you have the right to object at any time (Art. 21 GDPR) to the use of your profile for matching, from your personal area. In the event of objection we will suspend the automatic matching of your profile (you remain able to apply manually to visible castings).
• Nature of the processing: matching ranks and suggests opportunities; it is not a solely automated decision within the meaning of Art. 22 GDPR, as the final selection always rests with the human assessment of the staff and casting clients.

4.4 Sharing the profile with casting clients

• Purpose: to make your profile visible to casting clients (agencies, brands, TV/film productions, event organisers) for the purpose of selection for work opportunities.
• Legal basis: performance of a contract — Art. 6(1)(b) GDPR: visibility to clients is the very reason for registering on a casting platform.
• Limits: the profile is shown to clients in the context of castings, to assess you as a candidate; the visibility of certain information can be configured from your personal area. Clients are required to use the data solely for selection and within the limits of their relationship with the Controller; this sharing does not authorise them to use your data for their own promotional purposes nor to transfer it to third parties.

4.5 Promotional communications (optional)

• Purpose: sending offers, news and commercial initiatives of the Controller not linked to your applications.
• Legal basis: consent — Art. 6(1)(a) GDPR. This is an optional choice, separate from service communications, which you may grant or refuse at registration and withdraw at any time from your personal area, without any consequence on the delivery of the service.

4.6 Cookies and tracking technologies

• Purpose: traffic measurement (analytics) and marketing/remarketing.
• Legal basis: consent (ePrivacy / Consent Mode), collected and managed exclusively through the cookie banner. You can change your choices at any time via the “Manage cookies” button available on the site and in your personal area. For details, see the Cookie Policy.

5. Recipients and data processors

Your data may be processed, for the purposes indicated above, by:

• authorised internal staff of the Controller;
• suppliers acting as data processors (hosting and infrastructure, email delivery services, the WhatsApp Business messaging provider, analytics tools), appointed pursuant to Art. 28 GDPR;
• casting clients, within the limits and for the purposes set out in point 4.4.

Data are neither disclosed publicly nor transferred to third parties for third-party promotional purposes.

6. Retention periods

Data are retained for the entire duration of the contractual relationship and, after the account is deleted, for the time necessary to comply with legal obligations and to establish or defend a legal claim. Channel preferences are retained until changed by the user or the account is deleted. Optional consents are retained until withdrawn. Tracking data are retained as indicated in the Cookie Policy.

7. Rights of the data subject

As a data subject you have the right to:

• access your data and obtain a copy (Art. 15);
• request its rectification (Art. 16);
• request its erasure (Art. 17);
• request the restriction of processing (Art. 18);
• obtain the portability of your data (Art. 20);
• object to processing based on legitimate interest, including casting matching (Art. 21);
• withdraw at any time the optional consents granted, without affecting the lawfulness of processing based on consent before its withdrawal;
• not be subject to a decision based solely on automated processing producing legal or significant effects on you (Art. 22).

You can exercise your rights by writing to [email protected]. Many of these actions (managing channel preferences, objecting to matching, withdrawing promotional communications, deleting your account) are available directly from your personal area.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) (www.garanteprivacy.it).

8. Transfers of data outside the EU

Some suppliers (for example messaging or analytics services) may involve processing outside the European Economic Area. In such cases the transfer takes place in compliance with the GDPR, on the basis of adequacy decisions of the European Commission or appropriate safeguards (e.g. Standard Contractual Clauses).

9. Changes to this Policy and transition

This Privacy Policy is versioned. Acknowledgements and consents are recorded with reference to the version in force at the time of collection. In the event of substantial changes you will be informed and, where necessary, asked to provide a new acknowledgement at the first available login. Choices expressed in the past remain valid within the limits of the law; any refusals previously expressed are not automatically converted.

10. Contact

For any questions regarding the processing of your personal data, you may contact the Controller at [email protected].