Privacy policy

The controller within the meaning of Regulation (EU) 2016/679 (GDPR) is DiveIn Productions EOOD, company number 208565384, with its seat at 3 Popovo St, entrance B, apt. 3, Lozenets district, Sofia 1421, Bulgaria.

For anything to do with your personal data, and to exercise your rights, write to privacy@findmytalent.bg.

When a company reviews applications and selects performers, it acts as a separate controller for its own purposes. The company itself is responsible for the processing it carries out once it has received the data.

Account data

Email address, phone number, role (talent, company, administrator), preferred language, registration date, account status.

Talent profile

First and last name, date of birth and age, category, city and country, biography in both languages, gender (optional), physical attributes — height, weight, shoe size, clothing size, hair and eye colour, languages and proficiency, skills.

Photos and video

A portfolio of photographs, a showreel and video material, and self-tapes recorded for a specific application.

Identity documents

An image of a national ID card, passport or residence permit, the holder’s name, the document type, the issuing authority and its validity dates. The document number is not stored — see the separate section below.

Guardian data

For talent under 18: the parent or legal representative’s name, relationship, email, phone, address, the date and version of the consent given, and the guardian’s identity document.

Company data

Name, EIK, contact person, website, logo, city, description and verification status.

Activity on the Platform

Castings and roles published, applications submitted and their status, a company’s notes on a candidate, invitations, saved talent, reports, and profile view counts.

Messages

The content of correspondence between talent and company on the Platform, with sent and read timestamps.

Payments

Plan, period, subscription status, training bookings, Stripe identifiers. Card details are handled directly by Stripe and never reach us.

Technical data

Data needed to run and secure the service — session identifiers, language setting, error reports, and aggregate traffic statistics without profiling.

Where we rely on legitimate interests, we have assessed that they are not overridden by your rights. You may object at any time at privacy@findmytalent.bg and we will stop, unless we can demonstrate compelling legitimate grounds to continue.

A performer’s profile by its nature describes their appearance. A photograph or video may reveal data that the GDPR treats as a special category — ethnic origin, for example, or religious belief where religious dress is worn. We do not seek such data, do not infer it from your material, and offer no filters based on it.

• Public visibility is off by default. A profile becomes visible only once you switch it on — that is your explicit consent under Art. 9(2)(a) GDPR for your material to be accessible.
• You can switch visibility off again at any time from settings, with effect for the future.
• We do not process biometric data for the purpose of uniquely identifying anyone. We do not use facial recognition.
• We do not process health data. Please do not enter any in your biography or messages.

An identity document is the most sensitive thing the Platform holds. It is therefore processed under a separate and stricter regime:

• Images are held in a private store that no other user — and not even the owner by a direct path — can read.
• The only way a document can be opened is through a server action that first checks the requester’s authorisation and then issues a temporary link valid for one minute.
• The document number is not recorded. Only its last four characters are kept, so an administrator can match it against the image, plus an irreversible cryptographic digest with a secret pepper, so that one document used by two accounts can be detected.
• Only administrators carrying out the review have access, and only for as long as the review takes. Access is logged.
• Companies never get access to a talent’s identity document, and vice versa.

Please mask any detail on the document that the check does not need — in particular the Bulgarian national identity number, if it is visible. What the check needs is the name, the photograph, the document type and its validity.

The Platform accepts talent from the age of 14. Under Art. 25c of the Bulgarian Personal Data Protection Act, a child aged 14 or over can validly consent to information society services on their own. Even so, given the nature of this service, we additionally require a parent’s or legal representative’s consent for every user under 18.

• A minor’s profile stays invisible to other users until the identity check is approved and the guardian’s consent is on record.
• We record which revision of the consent wording the guardian accepted, so that a later change cannot rewrite consent already given.
• The guardian has access to the profile and the correspondence and may withdraw consent at any time; withdrawal hides the profile and, on request, the data is erased.
• We do not show advertising to minors and do not profile their data.
• Minors’ data is not used for analytics beyond an aggregate count of profiles.

• Visitors without an account see a talent profile only if that talent has switched public visibility on and the account is active. Phone numbers and email addresses are never shown publicly.
• A company with an active subscription can search the directory of talent who have switched visibility on.
• When you apply to a role, that company sees your profile, your cover note and any self-tape you submitted — regardless of the public visibility setting, because that is the point of applying.
• Correspondence on the Platform is visible only to the two participants in that conversation.
• Platform administrators have access to data where that is necessary for verification, moderation or support.

We do not sell personal data. We use the following providers, who process data on our instructions under an Art. 28 GDPR agreement:

Data may also be disclosed to competent authorities where we are legally obliged to do so, and to lawyers, accountants and auditors bound by professional confidentiality.

The database and files are stored in a European Union region. Some of the providers listed are US-based companies and part of the processing may take place outside the EEA. Where it does, the transfer relies on Standard Contractual Clauses adopted by the European Commission, together with supplementary technical measures.

A copy of the safeguards in place can be requested at privacy@findmytalent.bg.

Once a period expires the data is deleted or irreversibly anonymised. If a dispute is pending, the data relevant to it is kept until the dispute is finally resolved.

• Access to every row in the database is restricted at the database level by row-level security policies, not only in the application.
• Videos, self-tapes and identity documents are held in private buckets and reached only through temporary signed links.
• The connection to the site is encrypted. Passwords are stored only as irreversible hashes.
• Changing a password requires re-entering the current one, and deleting an account requires confirmation with the owner’s email address.
• If a security breach is likely to result in a high risk to you, we will inform you without undue delay and notify the Commission for Personal Data Protection (CPDP) within 72 hours.

• Access to the data we hold about you, and a copy of it.
• Rectification of inaccurate or incomplete data.
• Erasure (the “right to be forgotten”) where there is no ground for us to continue.
• Restriction of processing while a dispute about accuracy or grounds is examined.
• Portability — receiving your data in a structured, commonly used format.
• Objection to processing based on legitimate interests.
• Withdrawal of consent at any time, without affecting the lawfulness of processing before then.

Most of this you can do yourself from account settings — edit your data, toggle visibility, delete material and delete the account entirely. For anything else, write to privacy@findmytalent.bg. We reply within one month, extendable by a further two for complex requests, of which we will inform you.

You have the right to lodge a complaint with the Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd, 1592 Sofia, Bulgaria, email kzld@cpdp.bg, www.cpdp.bg, and with the courts.

We take no decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you. The Platform does not score or rank candidates using artificial intelligence. Who is invited or chosen is decided by a person at the relevant company.

Notifications about new castings are sent on simple rules — category and city — and do not amount to profiling with legal effects.

Which cookies we use and why is set out in the separate Cookie Policy.

When this policy changes we publish the new version here with a new date. For material changes we notify registered users by email at least 30 days in advance.