Privacy notice

1. Data controller and contact details

The data controller is C-Models Crew, Via Cristoforo Colombo 27, 81100 Caserta (CE), VAT number 04469750618.

For enquiries about the processing of personal data: info@cmcmodelscrew.com · +39 333 396 2234 · WhatsApp +39 333 396 2234.

2. Scope of this notice

This notice describes processing carried out through the website, including public boards, private selections and the “Become a model” application form.

3. Data processed, purposes and legal bases

3.1 Browsing, security and technical functions

The website processes technical data strictly necessary to provide pages, staff authentication functions and access to private selections. This includes session data and technical preferences stored in the browser.

Purpose: operation, security and proper delivery of the website and requested functions.

Legal basis: the controller’s legitimate interest in website security and operation, Article 6(1)(f) GDPR; performance of pre-contractual or contractual measures where the function is requested by the user, Article 6(1)(b) GDPR.

3.2 Public boards

For profiles included in public boards, the agency processes and publishes book photographs and the professional measurements of the model.

Purpose: presenting profiles and promoting the agency’s activity to prospective clients.

Legal basis: performance of the contractual relationship with the represented person, Article 6(1)(b) GDPR, and the controller’s legitimate interest in promoting profiles entrusted to the agency, Article 6(1)(f) GDPR, within the limits of applicable agreements.

3.3 Private selections

Selections sent to clients through a private link may contain photographs and measurements of selected profiles. The link is configured not to be indexed by search engines and may be password-protected.

Purpose: presenting selected profiles for castings, availability requests and professional opportunities.

Legal basis: performance of the contractual relationship with the represented person, Article 6(1)(b) GDPR, and the controller’s legitimate interest in managing client requests, Article 6(1)(f) GDPR.

3.4 Applications

The form collects first name, surname, age, gender, country, region and town, height, bust or chest, waist, hips, shoe size, mobile number, email address and one to six photographs. For applicants under 18, it also collects the parent or guardian’s name, surname, date of birth and declaration.

Purpose: assessing the application, contacting the applicant and, if successful, starting and managing the relationship with the agency.

Legal basis: performance of pre-contractual measures requested by the data subject, Article 6(1)(b) GDPR. The form is available from the age of 16. Applicants under 18 must provide a declaration from a parent or guardian. Article 8 GDPR governs children’s consent in the direct provision of information-society services where consent is the legal basis under Article 6(1)(a); it is not the legal basis for assessing an application.

Application photographs are not public. They are kept in a separate archive accessible only to authorised staff after authentication. The internal notification email has no attachments; it contains the necessary data and a link to the management panel.

4. Provision of data

Data required by the application form, including photographs, are necessary to assess it. Failure to provide them prevents submission or assessment of the application. For applicants under 18, the parent or guardian data and declaration required by the form are necessary; without them, the application cannot be considered.

Data not marked as necessary are optional. Not providing them may reduce the information available for assessment, without other consequences.

5. Source of data

Application data are provided directly by the applicant or, for minors, also by the parent or guardian. Published profile data come from the represented person within their relationship with the agency. The controller does not collect personal data from third-party sources for the purposes described in this notice.

6. Data recipients and processors

Data are processed by authorised C-Models Crew staff within their respective duties. They may be processed by suppliers providing technical services for the controller, appointed as processors where required by Article 28 GDPR:

• hosting provider using servers located in the European Union;
• provider of the SMTP service used for internal notifications.

Data may also be disclosed to parties that request them by law or by order of a competent authority.

7. Transfers outside the European Economic Area

The controller does not transfer personal data to countries outside the European Economic Area. The suppliers listed operate on servers in the European Union.

8. Retention

Unsuccessful applications, including photographs, are deleted within 6 months of the decision. Applications without an outcome are deleted within 12 months of submission. Accepted applications are incorporated into the model’s profile and kept for the duration of the relationship with the agency, subject to further legal obligations.

Technical session data are retained for the time necessary for the function: until logout for the staff session and 12 hours for access to a protected selection. The preference concerning closure of the information notice is retained in the browser for 1 year. Further details are available in the Cookie Policy.

9. Security measures

The controller adopts technical and organisational measures appropriate to the risk, including access controls, staff authentication, separation of the application archive from the public area and restricted access for authorised staff.

10. Data subject rights

In the cases provided by the GDPR, the data subject may ask the controller for access, rectification, erasure, restriction of processing, data portability and objection to processing (Articles 15–21 GDPR). They may also withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. They have the right not to be subject to decisions based solely on automated processing in the cases set out in Article 22 GDPR.

To exercise these rights, write to info@cmcmodelscrew.com. The controller responds within the time limits set out in Article 12 GDPR. For minors, a request may also be made by the holder of parental responsibility, within applicable limits.

11. Complaint to the supervisory authority

The data subject may lodge a complaint with the Italian Data Protection Authority, in accordance with the procedures published at garanteprivacy.it, or bring proceedings before the competent courts.

12. Automated decision-making

The controller does not carry out decision-making based solely on automated processing, including profiling, that produces legal effects or similarly significantly affects the data subject. Applications are assessed by staff.

13. Changes to this notice

The controller may update this notice to reflect legal, technical or organisational changes. The updated version is published on this page with its update date.