Privacy policy

Preamble

This privacy policy (hereinafter the "Policy") describes the conditions under which KJC Productions processes the personal data of persons who use the wearekjc.com site and the internal production management platform Aurore (hereinafter, together, the "Services"), or whose data is processed in connection with the association's activity.

It is established in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter the "GDPR"), with Act No. 78-17 of 6 January 1978 on information technology, data files and civil liberties (hereinafter the "French Data Protection Act"), and with Directive 2002/58/EC known as "ePrivacy" as transposed into French law.

KJC Productions undertakes to process data in compliance with the principles of lawfulness, fairness, transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity and confidentiality set out in Article 5 of the GDPR.

Article 1. Definitions

In this Policy, the terms below have the following meaning.

• Personal data: any information relating to an identified or identifiable natural person.
• Processing: any operation performed on personal data, in particular collection, recording, consultation, use, storage, disclosure or erasure.
• Controller: the person who determines the purposes and means of the processing, in this case KJC Productions.
• Processor: the person who processes data on behalf of the controller.
• Data subject: the natural person whose data is processed.
• Aurore: the internal production management platform published by KJC Productions.
• Registration form: the public form available at aurore.wearekjc.com/apply, allowing an application to be submitted.

Article 2. Identity and contact details of the controller

The controller is:

KJC Productions, a declared association governed by the French Law of 1 July 1901, identified under RNA number W743007236 and SIREN number 934827270, whose registered office is located at 50 Impasse Pré Carré, 74520 Valleiry, France.

KJC Productions has not appointed a data protection officer, not being required to do so within the meaning of Article 37 of the GDPR. Any question or request relating to the processing of data may be sent to the following contact point, which centralises these matters:

• Email address: contact@wearekjc.com
• Postal address: KJC Productions, 50 Impasse Pré Carré, 74520 Valleiry, France.

Article 3. Scope and categories of data subjects

This Policy applies to the processing carried out via the Services and in connection with the association's activity. The following categories of persons are concerned in particular:

• persons submitting an application via the Registration form;
• actors, performers and talent appearing in the association's casting database;
• members and volunteers of the association holding access to Aurore;
• actors holding personal access to an area dedicated to their role;
• professional contacts and partners in the association's network;
• visitors to the wearekjc.com site;
• third parties whose data may appear in projects, documents or production notes, such as extras or persons mentioned in connection with a project.

Article 4. Categories of data processed

Depending on the data subject's relationship with the association, the following categories of data may be processed:

• Identification and contact data: surname, first name, email address, telephone number, city or place of residence.
• Casting profile data: age or age range, gender identity where voluntarily disclosed, languages spoken, physical characteristics relevant to casting (height, hair colour, eye colour, presence of a beard), availability, casting tags and categories.
• Content submitted voluntarily: photographs, presentation photographs, demo reels and showreel links, audition material.
• Production data: history of participation in projects, allocation of roles, exchanges relating to casting and production.
• Account management data: email address used as an identifier, password in protected form, assigned role, display preferences (language, theme).
• Technical and browsing data: aggregated site audience measurement data, technical connection and activity logs.
• Professional assessments: notes entered by the team in fields provided for that purpose, limited to elements useful to the casting and production activity.

Article 5. No processing of sensitive data

KJC Productions does not process special categories of data within the meaning of Article 9 of the GDPR, namely data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, health data, or data concerning sex life or sexual orientation. The Registration form contains no field of that nature. Photographs submitted are subject to no facial recognition processing and no biometric analysis allowing a person to be uniquely identified.

Should a person spontaneously disclose such data in a free-text field, KJC Productions would not make use of it and would proceed to delete it.

Article 6. Origin of the data

KJC Productions collects data in two ways.

6.1. Direct collection. Data is collected directly from the data subject when they complete the Registration form, submit an application, communicate with the team or use their access to Aurore. In accordance with Article 13 of the GDPR, this Policy constitutes the information provided on that occasion.

6.2. Indirect collection. Certain data is not collected from the data subject. This is the case where a record is created from an application received by email, imported from the association's professional contact books, or entered by a team member following a professional exchange. In those cases, the sources of the data are professional exchanges, unsolicited applications and the association's earlier archives. In accordance with Article 14 of the GDPR, KJC Productions informs the data subject of the existence of the processing and of their rights at the latest at the time of the first communication with them, and in any event within one month of obtaining the data. Making this Policy available forms part of that information.

Article 7. Purposes and legal bases of the processing

Each processing operation meets a determined purpose and rests on an identified legal basis within the meaning of Article 6 of the GDPR.

Where the processing rests on legitimate interests, KJC Productions has carried out a balancing exercise between that interest and the rights and freedoms of the data subjects, and has considered that the processing was not of a nature to cause disproportionate harm to those rights, having regard to the professional purpose, the restricted nature of access and the security measures put in place. The data subject may obtain information on that balancing exercise by writing to the contact point.

Article 8. Data of minors

The Registration form is reserved for persons aged at least fifteen. In accordance with Article 8 of the GDPR and Article 45 of the French Data Protection Act, a minor aged at least fifteen may consent alone to the processing of their data. Persons under the age of fifteen may not register.

The exploitation of a minor's image and their participation in a production are strictly regulated and are the subject of a separate contract, signed by the holders of parental authority, outside the platform. Where the law so requires, the employment of a minor in a production is furthermore subject to the administrative authorisations provided for by Articles L.7124-1 et seq. of the French Labour Code. Registration on Aurore does not amount to authorisation for a shoot and entails no undertaking to participate.

KJC Productions may at any time request proof of age and a valid parental authorisation, and suspend any profile for which those elements are not provided.

Article 9. No automated decision-making or profiling producing legal effects

KJC Productions takes no decision based solely on automated processing, including profiling, which produces legal effects concerning a person or similarly significantly affects them, within the meaning of Article 22 of the GDPR.

The application sorting, suggestion and search functions present in Aurore rest on deterministic rules and merely assist the team's work. The acceptance or refusal of an application, as well as any allocation of a role, are systematically the subject of human assessment and human decision. No generative artificial intelligence model is used in connection with the Services.

Article 10. Recipients of the data

The data is intended solely for authorised persons of KJC Productions, within the limits of their duties. Access to Aurore is restricted and organised by role. The data is accessible only to authorised team members assigned to a project, to production managers and to the administrators managing the platform. An actor holding personal access has access only to the information relating to their own role and to the documents intended for them.

KJC Productions may generate temporary sharing links, protected by an expiring token, in order to transmit a document in a controlled manner within the production team. These links are not indexed by search engines and expire automatically.

KJC Productions does not sell the data and does not disclose it to any third party for commercial, advertising or third-party prospecting purposes. The data may be disclosed to administrative or judicial authorities where the law so requires.

Article 11. Processors

In order to operate the Services, KJC Productions uses processors which act on its behalf, on its documented instructions, and under a processing agreement compliant with Article 28 of the GDPR:

For the association's internal management, the team also uses office tools provided by Google Alphabet Inc. and by Apple, Inc., which may process certain data in that context. KJC Productions selects its processors on the basis of the safeguards they present and ensures that this list is kept up to date.

Article 12. Transfers of data outside the European Union

As certain processors are established in the United States, data may be transferred outside the European Union. KJC Productions configures its services to favour, where technically possible, storage within the European Union.

These transfers are governed by the appropriate safeguards provided for in Chapter V of the GDPR. Depending on the supplier concerned, the transfer is based either on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, where the supplier has certified under it, or on the standard contractual clauses adopted by Commission Implementing Decision (EU) 2021/914 of 4 June 2021, supplemented where appropriate by additional measures. Any data subject may obtain a copy or the details of the applicable safeguards by writing to the contact point.

Article 13. Retention periods

Data is retained for the period strictly necessary for the purpose pursued, according to the following periods:

On expiry of these periods, the data is deleted. Where a legal obligation requires its retention, it is archived securely and access to it is restricted to authorised persons only, for the sole duration of the obligation concerned.

Article 14. Data security

In accordance with Article 32 of the GDPR, KJC Productions implements appropriate technical and organisational measures in order to ensure a level of security appropriate to the risk. These measures include, in particular, the restriction and management of access by role, account authentication, storage of passwords in protected form, hosting on secure infrastructure, file sharing by means of temporary links protected by an expiring token, and the logging of access and of sensitive actions.

KJC Productions develops its security measures in line with the state of the art and the risks identified. As no system offers absolute security, KJC Productions cannot guarantee total inviolability, but undertakes to maintain a level of protection proportionate to the nature of the data processed.

In the event of a data breach likely to result in a risk to the rights and freedoms of individuals, KJC Productions notifies that breach to the French Data Protection Authority under the conditions and within the time limits provided for in Article 33 of the GDPR, and informs the data subjects where the risk is high, in accordance with Article 34 of the GDPR.

Article 15. Rights of data subjects

In accordance with Articles 15 to 22 of the GDPR, every data subject has the following rights:

• Right of access. To obtain confirmation that their data is being processed and, where applicable, to obtain a copy of it together with the information relating to the processing.
• Right to rectification. To obtain the correction of inaccurate data and the completion of incomplete data.
• Right to erasure. To obtain the erasure of their data in the cases provided for in Article 17 of the GDPR.
• Right to restriction. To obtain the restriction of processing in the cases provided for in Article 18 of the GDPR.
• Right to object. To object, on grounds relating to their particular situation, to processing based on the association's legitimate interests.
• Right to data portability. To receive the data they have provided, in a structured, commonly used and machine-readable format, and to transmit it to another controller, where the processing rests on consent or on a contract and is carried out by automated means.
• Right to withdraw consent. Where the processing rests on consent, to withdraw it at any time, without affecting the lawfulness of the processing based on consent given before its withdrawal.
• Right to give directives. To give directives concerning the fate of their data after their death, in accordance with Article 85 of the French Data Protection Act.

How to exercise these rights. These rights are exercised by writing to contact@wearekjc.com or to the postal address of the registered office. KJC Productions may request proof of identity in the event of reasonable doubt as to the identity of the requester. A response is provided within one month of receipt of the request, a period which may be extended by two months on account of the complexity or number of requests, the person then being informed of that extension and of the reasons for it.

Right to lodge a complaint. Any person who considers that their rights are not being respected may lodge a complaint with the French Data Protection Authority (Commission nationale de l'informatique et des libertés, CNIL), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

Article 16. Cookies and equivalent technologies

The use of cookies and equivalent technologies on the Services is described in the Cookie policy, available on the site, which supplements this Policy.

Article 17. Amendment of the Policy

KJC Productions may amend this Policy in order to take account of legal, regulatory or technical developments. The applicable version is the one in force on the date of access to the Services. Any substantial amendment is signalled by an update to the date shown at the top of the document and, where possible, by direct notice to the data subjects.

Article 18. Contact

For any question relating to this Policy or to the exercise of your rights:

KJC Productions
Association governed by the French Law of 1901, RNA W743007236
50 Impasse Pré Carré, 74520 Valleiry, France
contact@wearekjc.com