Lost in Casting · Legal
Appropriate Policy Document
Controller: Lost in TV Limited, trading as Lost in Casting. Registered in England and Wales, company no. 04801855. Registered office: 82A James Carter Road, Mildenhall, Suffolk IP28 7DE. Contact: [email protected].
1. The data this covers
| Data | Category | Condition relied on |
|---|---|---|
| Ethnicity, where an artiste chooses to provide it | Special category (Article 9) | Explicit consent – Article 9(2)(a) |
| DBS certificate information: type, date of issue, certificate number, the fact and date of our sighting, and a temporary copy of the certificate | Criminal offence data (Article 10) | Consent – Schedule 1, Part 3, DPA 2018 |
Neither is required to register with us, to build a profile, or to be put forward for work. An artiste who provides neither is treated no differently, save that a production asking for a DBS check will not see one.
2. Compliance with the data protection principles
Lawfulness, fairness and transparency. Both categories are provided voluntarily by the artiste. What we do with them, and how long we keep them, is set out in our Privacy Policy in plain terms. We make no claim we cannot support: in particular we do not describe a DBS certificate as verified, because it cannot be verified after the event.
Purpose limitation. Ethnicity is used for casting searches. DBS information is used to tell a production that a check exists and what it said on the day it was issued. Neither is used for marketing, profiling or any automated decision-making.
Data minimisation. We record what a certificate prints and who looked at it. The certificate copy itself is kept only long enough to be examined and queried, then deleted.
Accuracy. The record states the date we sighted the document and the date the certificate was issued, so its age is always visible rather than implied. Once a certificate is more than 18 months old it is shown to productions with its age against it. An artiste may correct or replace the record at any time.
Storage limitation. See section 3.
Integrity and confidentiality. Certificate copies are held in private storage that is not reachable from the public website. They are opened only through an authenticated administrator route, are never attached to an email, and are never given a shareable link. Access to personal data is restricted to our own team on a need-to-know basis. Every disclosure of certificate information to a third party is recorded: who received it, what they were given, who released it and why.
Accountability. This document is reviewed at least annually and whenever the processing changes. It is retained while the processing continues and for six months after it ends, and is available to the Information Commissioner on request.
3. Retention and erasure
| Data | Kept for |
|---|---|
| DBS certificate copy | 10 days from receipt, then deleted automatically, including from backups in the ordinary backup cycle |
| DBS record (type, issue date, number, sighting) | The artiste's registration term; deleted with the profile |
| Record of a disclosure to a third party | Six years, as part of the booking record |
| Ethnicity | Until withdrawn by the artiste, who can delete it themselves at any time; otherwise with the profile |
Erasure is automatic where a period is stated, and on request in every case. Withdrawing consent for either category does not affect an artiste's registration or their ability to be booked for work that does not ask for a check.
4. Where this is enforced in the platform
dbs:maintain, daily: deletes certificate copies past the 10-day retention, clears any orphaned file, and reminds an artiste once when a certificate passes 18 months.- The certificate is served only by an authenticated administrator route; there is no public or signed URL to it anywhere in the system.
- Disclosures are written to a
dbs_disclosuresrecord and to the application log.
Last updated 6 September 2026.