This data protection information for the casting and ticketing area fulfills the information obligations in accordance with the requirements of Art. 12 et seq. of the EU General Data Protection Regulation (hereinafter referred to as “GDPR”) and gives you an overview of the processing of your personal data (hereinafter referred to as “data”) in the casting and ticketing area.)

1. who is responsible for processing your data?
2. what data is processed?
3. for what purposes and on what basis is your data processed?
4. is there an obligation to provide your data?
5. who receives your data?
6. is your data processed outside the EU or the EEA (third country transfer)?
7. how long is your data stored?
8. what data protection rights do you have?

UFA SHOW & FACTUAL GmbH
Siegburger Straße 215
50679 Cologne
Phone: +49 221 9955 1000
Fax: +49 221 9955 2999
E-mail: info.usf@ufa.de

is responsible for the processing of your data in the area of casting and ticketing (hereinafter referred to as “UFA S&F”). This includes, for example, the processing of your data in the context of your application for a casting, when purchasing tickets for productions, for advertising contact (including newsletters) and participation in competitions, in each case for the areas of casting and ticketing. UFA S&F processes data in accordance with the provisions of the GDPR and the German Federal Data Protection Act (hereinafter referred to as “BDSG”).

The data protection officer of UFA S&F is Bertelsmann AG (Group Data Protection). You can reach our data protection officer by e-mail at datenschutz.usf@ufa.de or by post at the above address, in each case with the note “To the data protection officer”.

UFA S&F processes the data that you provide in the context of your request and the subsequent processing of your request. This essentially includes your contact details, data on your participation and – in the context of the casting – production-relevant characteristics and features as well as any image and video material created by yourself or by UFA S&F.

3.1 Casting: In the “Casting” section, your data will be processed to carry out the casting (in particular candidate selection). If you take part in a production, your data will be processed to create and carry out the production. The legal basis is Art. 6 para. 1 lit. b GDPR.

Insofar as you provide special personal data for production reasons, the processing is carried out on the basis of Art. 9 para. 2 lit. a and e GDPR.

If you have consented to the processing of your data, the data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). This applies in particular to the storage of your data in the casting database in order to contact you as a potential participant for other productions, for the sending of newsletters or other promotional contact for possible participation in other productions.

If you decide to contact us via WhatsApp, the terms of use of WhatsApp Ireland and WhatsApp Inc. apply, according to which WhatsApp receives access to your telephone number, contacts stored in your mobile device and your user behavior, for example. We have no influence on the terms of use and data processing by WhatsApp. You can find more information on this at https://www.whatsapp.com/legal/#terms-of-service and https://www.whatsapp.com/legal/#privacy-policy. Please understand that we are not liable for any damage caused by the use of WhatsApp. You are welcome to use one of our other contact options.

3.2 Ticketing: In the “Ticketing” business unit, your data is processed to handle your request, specifically your ticket request. If you transfer the ticket price to UFA, we also process the relevant data. In other cases (payment via external payment service providers such as your bank or PayPal), we may in some instances receive only the information that you have made a payment. In such cases, for example, we do not receive any specific bank details from you. If you choose a payment method whereby your financial institution provides us with this information, we will process it in accordance with this Privacy Policy and for the purposes specified herein. If you participate in the production, the processing is carried out to handle any winnings and to verify rights. The legal basis is Article 6(1)(b) and (c) of the GDPR. For the technical processing of our ticket sales, we engage specialized service providers such as Pretix. Unless otherwise indicated when you order your tickets, our collaboration with these service providers takes place by way of data processing on our behalf within the meaning of Article 4(8) and Article 28 of the GDPR. This means that these service providers are contractually obligated by us to process your data for no other purposes than those specified by us—in particular, not for their own purposes.

UFA S&F processes your data in the context of ticket allocation and the subsequent production in order to exercise its domiciliary rights. For individual productions, the allocation of tickets may be subject to special conditions (e.g. preference given to interested parties who have not yet been viewers). The legal basis in each case is Art. 6 para. 1 lit. f GDPR. The legitimate interest of UFA S&F is to enable as many interested parties as possible to attend a production, to show a diverse audience and to ensure the production process.

If the production is recorded, your data will be processed to create the production. The legal basis is Art. 6 para. 1 lit. b GDPR. They are also processed as part of the broadcast and exploitation of the production by the commissioning broadcaster/streamer. In this respect, the legitimate interest lies in the compensation of the investment made, Art. 6 para. 1 lit. f GDPR.

If you have consented to the processing of your data, the data processing is based on your consent (Art. 6 para. 1 lit. a GDPR). This applies in particular to the storage of your data in the ticketing database in order to contact you as a potential audience member for other productions, for the sending of newsletters or other advertising contact for other productions (e.g. for information on special promotions).

3.3 Competition: If you take part in a competition in the “Casting” or “Ticketing” section, your data will be processed to carry out and process the competition. The basis is Art. 6 para. 1 lit. b GDPR.

Information marked with * is mandatory, as we need it for further processing of your request (e.g. to determine whether you are eligible for a production (casting) or to process the ticket purchase and enable the evaluation of the production by the broadcaster/streamer (ticketing)). If the relevant data is not available, we cannot comply with your request.

Casting and Ticketing: If you are being considered for a production (casting), your data will be shared with the commissioning broadcaster/streamer for the purposes described above (e.g., selection, and, if applicable, subsequent production) (Art. 6(1)(b) GDPR). If you participate in a recording as an audience member, service providers (e.g., Pretix) or payment service providers (e.g., PayPal) involved in the ordering process may receive data about you. The data processing associated with this is always limited to the specific purpose of your ticket order in accordance with Art. 6(1)(b) GDPR. In addition, after filming is complete, the commissioning broadcaster may receive data from you in the form of recordings (e.g., if you appear as an audience member).

For online casting, UFA uses the solution from M.K. Advision LTD based in Israel. The adequate level of data protection for processing in Israel was determined by the European Commission by means of an adequacy decision (see section 6).

Your data is forwarded to and processed by an external service provider for the sending of newsletters, advertising text messages and advertising emails. This external service provider is currently Mailjet SAS, based in France.

Competition: If we use a third party to process the competition (e.g. dispatch of the prize by a third party), we will pass on your data to the third party commissioned to process the competition (Art. 6 (1) lit. b GDPR).

Your data is generally processed in the EU. In individual cases, processing may take place outside the EU and the EEA (e.g. IT infrastructure, commissioning sender/streamer is located abroad). If this is not the case and there is no adequacy decision by the European Commission, your data will only be transferred to a third country if suitable guarantees offer appropriate protection for your data (e.g. standard data protection clauses).

Your data will be stored for as long as is necessary for the stated purposes. Data will be stored for longer if statutory retention and protection periods or obligations to provide evidence (e.g. copyright or compliance with applicable law) require longer storage.

You have the right to information about your personal data stored by us at any time. If your personal data is incorrect or inaccurate, you have the right to request that it be corrected. You also have the right to request the deletion or restriction of the processing of your data in accordance with Art. 17 or Art. 18 GDPR. If deletion conflicts with legal obligations, in particular statutory retention periods, your data will be blocked instead of deleted. You may also have the right to receive the data you have provided in a commonly used and machine-readable format (right to data portability). In accordance with Art. 21 GDPR, you have the right to object to the processing of your data.

If you have given your consent to the processing of data for certain purposes, you can withdraw your consent at any time with effect for the future. The legality of processing in the past and on other legal bases (e.g. contract fulfillment) remains unaffected.

You can assert the above rights using the contact details given in section 1.

You also have the right to lodge a complaint with a data protection supervisory authority.

Date of Privacy Notice: July 24, 2026