Effective 12 October 2026
This notice explains personal-data processing in Castdesk, a casting-application service operated by Kequtech Innovations Kft. It does not describe Kequtech's separate consultancy website or other products.
1. Who is responsible
Kequtech Innovations Kft., Paulay Ede utca 56, 4th floor, door 1, 1061 Budapest, Hungary, is the controller for Castdesk accounts, saved profiles and photos, authentication, service security and support. Contact [email protected] for privacy requests. Full company details appear in the Impresszum / Imprint.
Each casting organizer determines why they collect and use applications and is the controller for their casting process. Kequtech processes application data on their behalf under the organizer processing terms in our Terms. The organizer should identify themselves and provide a privacy contact in the casting call. You can contact Kequtech if you need help reaching them.
2. Information processed
Accounts: your verified email address, optional saved contact and profile details, saved photos and captions, preferred workspace view, and authentication and session records.
Casting calls and applications: the organizer's published details, questions and deadline; your name and email; answers such as location, phone number, experience and portfolio links; any requested date of birth or appearance information; selected photos; submission time; and the terms version accepted. Organizers can add private notes, favorites, bookmarks and archived or reported status.
Technical information: browser and upload-session identifiers, rate-limit records, content-violation categories and timestamps, the authenticated uploader ID when available, the affected upload or call identifier, and ordinary request or security information. Infrastructure providers may process IP addresses, request times, URLs, browser headers and operational logs when delivering and protecting the service. Support requests include your correspondence and information needed to handle the request.
Your name and email are required to apply. The call identifies any other required answers or photos; without them the application cannot be accepted. An account is optional. When you apply while signed in, we fill empty saved-profile fields from your application and save its photos for reuse. If you apply without signing in, verifying that email address later links matching applications to your account and imports reusable details and photos from newly linked applications. Existing profile values are kept; newer applications fill empty fields first, and imported photos are added only while there is room in your saved collection. Castdesk is intended for adults aged 18 or over.
3. Purposes and legal bases
Kequtech uses account and saved-profile information to provide the service you request, relying on performance of its agreement with you. Verification and receipt emails support authentication and the requested application journey. We use necessary technical information to prevent abuse, protect accounts and diagnose faults, relying on our legitimate interests in a secure and reliable service. Support is handled to provide the service, answer enquiries and exercise or defend rights. Information may also be processed where required by law.
Organizers use applications to review candidates and communicate about casting. They are responsible for identifying and explaining their own lawful basis, such as steps requested before a possible engagement or a justified legitimate interest. Kequtech does not choose that basis for them. Accepting Castdesk's terms is not consent to every subsequent use by the organizer.
We send uploaded photos and brand images, application answers and casting-call text to OpenAI’s Moderation API to check for abuse, relying on our legitimate interests in protecting people and the service. Image checks happen during upload, including uploads to My photos and My brands, before an image can be saved or attached to an application. An image can therefore be checked even if you do not finish or submit an application. Content flagged under our abuse rules is rejected automatically; you can choose a different photo or revise your text. If you believe content was rejected incorrectly, contact support. Organizers can report an application, which archives it and hides its photos from their review and exports. These checks protect the service; they do not assess suitability for a casting role.
Castdesk does not sell applicant information, run advertising or audience analytics, use photos for biometric identification, or use application data to train AI. It does not automatically rank candidates or make casting decisions. Favorites, bookmarks and review decisions are made by organizers.
4. Who can access information
Published casting forms are public. Applications and photos are not a public directory: they are available to the organizer receiving them and, after verifying the application email address, the applicant. Organizer notes, favorites and bookmarks are not displayed to applicants. Authorized Kequtech personnel may access information when necessary for support, security, legal obligations or service operation.
The organizer receives the email address and other contact information you submit and can download the application and photos. They may contact you directly. Castdesk cannot prevent or erase copies held outside the service; the organizer must comply with applicable privacy and communication laws. Contact them about their copies or unwanted contact. You may also report misuse to Kequtech.
Railway Corporation provides production application, database and private object-storage infrastructure. SMTP2GO, operated by Sand Dune Mail Ltd, delivers transactional email through its EU API service. Email delivery necessarily also involves the recipient's email provider. SMTP2GO receives the recipient address and message contents, such as the call title and verification link, rather than the full application or uploaded photos.
OpenAI receives resized, normalized image content and text needed for the content check. For application text, we exclude the standard email and phone fields, but other answers may contain personal information, including your name or contact details you put in free text. Casting-call checks include the title, organizer and brand names, introduction, questions and instructions. We do not send sign-in credentials or organizer notes for this purpose.
OpenAI states that API content is not used for model training by default. Its current API data controls list no abuse-monitoring or application-state retention for the Moderation endpoint. Provider processing remains subject to applicable legal requirements and the limitations in those controls. Castdesk’s own moderation-log retention is described below.
Some provider operations or recipients may be outside Hungary or the European Economic Area. We do not promise that all data remains exclusively in the EU. Where a restricted transfer requires safeguards, we use an applicable adequacy decision, standard contractual clauses or another lawful safeguard. You may request information about the safeguards that apply to your data. Information may be disclosed where required by law or necessary to protect legal rights and safety.
5. Photos and security
Castdesk automatically resizes and compresses supported photos and stores normalized images and thumbnails in private storage. Original upload files are processed temporarily and are not kept; unnecessary embedded metadata is removed. When your saved collection is full, new photos in a successful application replace the least recently used saved photos. Removing a photo from your saved collection does not remove a copy attached to an earlier application or a copy held by an organizer.
We restrict access through the application, protect sign-in links and use protected transmission in production. No system can guarantee absolute security. Keep email access and verification links private, and avoid providing information unnecessary for casting.
6. Retention
Applications, organizer notes, favorites, bookmarks and associated receipt records are removed from active Castdesk records after the call has been closed for 12 months. A scheduled cleanup runs regularly. Reopening starts a new intake period and the next closure starts a new retention period; already expired records are removed before reopening and cannot be restored. Deleting the call removes these records sooner. The empty call form may remain in the organizer's account for reuse.
Account information and saved details/photos remain while the account is maintained. You can remove saved details or photos in your account and request account closure at [email protected]. You can delete an application from My applications after verifying its email address, including an application you did not submit yourself. Receipt emails link to this verification flow. Deletion removes the application, organizer notes and selections, associated bookmarks, and access to stored exports. Saved account details and photos, and photos used by other applications, remain until separately removed. Closing an applicant account does not by itself erase applications held for organizers. Photos are removed from storage when no remaining saved collection or retained application uses them. Requests involving an organizer's application records are handled with that organizer where appropriate.
Content-violation logs are removed after 90 days. They contain upload or call identifiers, an account or upload-session identifier where available, the flagged categories, the moderation model and decision identifier, and a timestamp, not copies of rejected image or text content. Reported applications remain subject to the same application retention and deletion rules as other applications.
Unattached uploads are eligible for cleanup after 24 hours. Temporary export downloads expire after one hour. Sign-in links expire after 15 minutes; expired sign-in token records are removed after a further seven days. Receipt-link records remain only while the relevant application remains, so an expired receipt can request a fresh link. Sessions expire after 30 days. Routine completed queue records are retained for a short operational period, normally one day after completion; failed jobs may remain during retries and investigation.
Support correspondence is normally retained for up to 24 months after the last meaningful exchange. Information genuinely needed for a statutory obligation or legal claim may be retained for the applicable period and restricted to that purpose. Infrastructure and email providers retain operational records under their service policies; SMTP2GO's ordinary email activity/header retention is up to 35 days unless a different account setting is enabled. Secure backups expire under the configured recovery cycle, and deleted information is not reintroduced into ordinary use after a restore. Deletion does not affect lawful copies held independently by an organizer.
7. Cookies and browser storage
Castdesk uses a necessary first-party session cookie for sign-in, lasting up to 30 days, and an upload-context cookie lasting up to 24 hours to keep temporary uploads associated with your browser. In production their names are __Host-castdesk-session and __Host-castdesk-upload. Development uses the same names without the __Host- prefix.
Browser session storage temporarily preserves unfinished forms and application answers while you complete the journey. This storage is not used for advertising or cross-site tracking. Blocking necessary cookies or storage may prevent sign-in, uploads or draft recovery; clearing them may remove unfinished work.
8. Your rights and requests
Subject to the GDPR and its limitations, you may request access, correction, deletion, restriction or portability of your information, and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. We may ask for enough information to verify your identity and locate the records. We respond within the legally required period, normally one month.
Send requests about Castdesk accounts or saved information to [email protected]. Send requests about a casting organizer's application processing to their published contact; we can assist and forward a request where appropriate. Submitted records cannot be edited through the ordinary interface, but that does not remove your data-protection rights.
You may complain to the Hungarian National Authority for Data Protection and Freedom of Information (NAIH) or the supervisory authority where you live or work.
9. Changes
We will update this notice when Castdesk or its processing changes and announce significant changes prominently. The effective date identifies the current notice. We will not treat an updated notice as permission for unrelated uses of existing data.