Privacy Policy

This policy explains what Lanced does with personal data. It is long, because Lanced does a lot of different things with data and we would rather be complete than short.

If you only read one section, read Section 2. It explains the single most important thing about how data works on Lanced: your information sits in two separate places, looked after by two different organisations. That affects what you can ask us to do, and what you have to ask a company to do.

• "you" means whoever is reading it — an artist, someone working at a company that uses Lanced, or a visitor to the site.
• "artist" means an individual holding a Lanced artist account.
• "company" means an organisation using Lanced Business — a theatre, dance company, casting agency, ensemble or similar.
• "we", "us", "Lanced" means Lanced B.V.

Lanced B.V. is a private limited company registered in the Netherlands, at Lutonhof 481, 1043 JJ Amsterdam, Chamber of Commerce number 86371479.

For the processing described in this policy, Lanced B.V. is the controller — the organisation that decides why and how your personal data is used — except where Section 2 says otherwise.

How to reach us about data protection

Data Protection Officer. We have not appointed a Data Protection Officer. Data protection questions and requests are handled directly by our own team, and you can reach us at privacy@lancedhq.com. We keep the question of whether a Data Protection Officer is required under review as Lanced grows.

We are established in the Netherlands, so our lead supervisory authority is the Dutch Autoriteit Persoonsgegevens. Section 16 explains how to complain to them.

Almost everything we hold comes from you — you type it in, upload it, or generate it by using the product.

We also receive data:

• From companies, where they write notes, scores or decisions about you inside their workspace, or where they add records about you to their own talent pool after you have consented to being saved there.
• From our authentication provider, which confirms a successful sign-in and returns basic account identifiers.
• From our payment provider, which confirms payment and subscription state.
• Automatically, from your device and browser when you use the site — IP address, user agent, and the pages you request.

We do not buy personal data, and we do not enrich profiles from third-party data brokers.

Where we rely on legitimate interests, we have weighed our interest against your rights and freedoms. You have the right to object to that processing at any time — see Section 15. If you object, we stop, unless we can demonstrate compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims.

Where we rely on consent, you can withdraw it at any time. Withdrawing consent does not affect the lawfulness of what we did before you withdrew it, and it does not automatically reach back into an application you have already submitted — see Section 6.

6.1 Having a field on your profile does not share it. The four sensitive fields are held separately from the rest of your profile. They are excluded from ordinary profile views, and they are not visible through network search or general talent discovery.

6.2 Disclosure happens per application, on your choice. When you apply to a call, you decide which sensitive fields, if any, to share with that company for that application. Nothing is disclosed unless you affirmatively choose it.

6.3 The company must be able to say why. Where Lanced requires it, a company must state on the call why it is requesting a particular field. Our Business Terms and Call Policy set out the limits: a company may request restricted information only where it has a specific and legitimate reason connected to the role, opportunity, eligibility requirement or contract type. Unless the information genuinely determines eligibility and its use is lawful, you must be able to decline, and declining must not by itself remove you from consideration.

6.4 What you shared is fixed at the moment you applied. We record the values as they stood when you submitted. The company's review screen reads that record, not your live profile. This cuts both ways, and both are deliberate:

• Editing your profile later does not retroactively change what a company has already seen.
• Adding information to your profile later does not retroactively disclose it into an application you have already sent.

6.5 Anything you write yourself may be shared. Motivation letters, free-text answers, CVs and uploaded media go to the company as you wrote them. They may contain information that is legally sensitive — health, disability, religion, ethnicity, personal circumstances. Please think about what you want to include. Lanced does not require you to put sensitive information in free text.

6.6 Your consent does not make the company's use of it lawful. Agreeing to share information with a company is not the same as agreeing to any use they make of it. Companies remain independently responsible for complying with equal treatment, non-discrimination and data protection law when requesting, receiving, filtering on or otherwise using your information. Our Business Terms require them to identify a valid Article 9 GDPR condition before processing special category data.

6.7 Being saved to a talent pool. A company can save you to its records or talent pools only if you agree. You can withdraw at any time from your privacy settings; when you do, we notify the company and the saved record is deleted or anonymised. Being saved is separate from any application: withdrawing from a pool does not withdraw an application, and deleting an application does not remove you from a pool.

We use a small number of service providers. Each processes personal data only on our instructions and under a written data processing agreement, and each is listed with its purpose, location and transfer mechanism on our Sub-Processor Register, which is the authoritative and current list. In summary:

Where the data actually lives

Two providers carry substantially all of it:

• DigitalOcean, LLC — application hosting, the managed PostgreSQL database, and database backups. Amsterdam, the Netherlands. This holds every record: accounts, profiles including the sensitive fields, applications and answers, messages, reviewer notes, votes and outcomes, audit trails and billing state.
• Cloudflare, Inc. — object storage, media delivery and media processing, with the storage region pinned to the EU. European Union. This holds every file: headshots, portfolio media, self-tapes, audio, documents, CVs and signed contracts.

Everything else is narrow

One function each, and most receive only a name and an email address.

Committed, but not yet in use

We publish planned providers in advance, so there is notice before any data moves to them. Today this is Google Calendar (optional calendar integration), which does not process any personal data at present.

Others we may share with

• Companies you apply to or interact with, as described in Sections 2 and 6.
• Other users, where you have chosen to be publicly visible. Your public profile, Studio site, works and portfolios are visible to whoever you have made them visible to.
• Professional advisers — lawyers, accountants, auditors — under confidentiality.
• Authorities, courts and regulators, where we are legally required to disclose, or where disclosure is necessary to establish, exercise or defend legal claims.
• A buyer or successor, if Lanced is acquired, merges or reorganises. We would tell you before your data became subject to a different privacy policy.

Sometimes our staff need to look at an account to fix a fault, investigate a report, or deal with a security problem. This includes the ability to view the product in the context of your account, so that we can see what you are seeing.

We think you should know this plainly, rather than find it in a technical annex.

How it is constrained:

• Access requires an internal staff account type, an assigned administrative role, a specific per-action permission, and a non-disabled administrative flag. It is not available to staff generally.
• Support-level staff can read and assist, but cannot alter accounts, billing or published content.
• A session viewing the product as a user expires after 60 minutes on the server, is bound to the individual staff member who opened it, and is ignored if anyone else signs in.
• Such a session is blocked from the administration tools entirely, and never carries the staff member's own workspace into your view.
• Start and end are always recorded, and every action taken during the session carries the responsible staff member's identity in its audit record.

You can ask for the record. Write to privacy@lancedhq.com and we will tell you when your account was accessed in this way.

Our core infrastructure is in Europe. The database, application infrastructure and database backups are hosted in Amsterdam, the Netherlands. Uploaded media and contract documents are stored in EU-jurisdiction object storage, with the EU setting enforced when the application starts, rather than left as a deployment option that can be forgotten.

Some limited categories do go outside the European Economic Area:

Sentry is used in its EU data region, and is additionally certified under the EU–U.S. Data Privacy Framework.

You can ask us for a summary of our transfer assessments, and for a copy of the relevant Standard Contractual Clauses, at privacy@lancedhq.com.

You can delete your artist account at any time from your settings.

What happens. Before you confirm, we show you a preview of what will be affected. You then confirm by email. There is a 30-day grace period, during which you can cancel with a one-click link.

When the grace period ends, your account is erased. Your name and email address are replaced with an anonymised placeholder, pronouns and settings are cleared, the account is marked deleted and disabled, and every session is revoked. On your profile, display name, handle, headshot, banner, biographies and location are cleared, and visibility is forced to private. The four sensitive fields — date of birth, nationality, ethnicity and gender — are emptied. Your media and message attachments are marked for deletion and are physically removed from storage within seven days. In conversations, your identity is replaced with a non-identifying placeholder, so that the other participants are not left with broken threads.

On timing, precisely: erasure at the end of the grace period is carried out by our privacy team rather than fully automatically. It completes within 30 days of the grace period ending. If it has not, tell us at privacy@lancedhq.com.

One case where we may hold a request. If a contract is actively awaiting your signature, we will tell you which contract is blocking the request. Once that contract is signed, declined, withdrawn or expired, the erasure proceeds.

What deleting your account does not do. It does not delete applications you have already sent to companies, or copies companies have downloaded or printed. See Section 2. If you want an application deleted too, tell us and we will forward the request to the company; in most cases they will have to delete it, though there are limited situations in which they can refuse — for example where they need the record to defend a legal claim. If the call is still open, withdrawing your application is quicker, and removes the materials you submitted with it.

Backups. Data held in routine backups is deleted in the ordinary course of the backup cycle, rather than immediately.

• In transit, everything runs over TLS 1.2 or 1.3 with strict transport security. At rest, the database and object storage are encrypted with AES-256 using provider-managed keys.
• Your sensitive fields and physical characteristics are held in dedicated tables protected by database-enforced row-level security, scoped to you. The application connects to the database as a restricted role, and refuses to start if that role could bypass those protections.
• Contracts are held in a separate private store from ordinary media, with no public route, readable only through short-lived authenticated links. The application refuses to start if the two stores are configured to the same place.
• Application materials, self-tapes and message attachments are held in a private scope, and served only through links that expire after ten minutes, or through authenticated endpoints.
• Publicly reachable media — what you have chosen to publish on your profile or portfolio — is served over long, random, unguessable web addresses that are not indexed by search engines. To be precise rather than reassuring: a link of this kind is protected by being unguessable, so anyone you share such a link with can open it, and it remains valid until the file is deleted.
• Audit trails record significant actions with the actor, target, IP address and user agent.
• Incident response follows a written procedure with defined severity levels, a named owner and a triage target, reviewed at least annually.

Certifications. Lanced does not currently hold SOC 2, ISO 27001 or an equivalent third-party attestation. We would rather say so than imply one.

No system is perfectly secure. If you believe your account has been compromised, contact us at security@lancedhq.com.

• Access (Article 15) — a copy of your personal data, and information about how it is used.
• Rectification (Article 16) — correction of inaccurate or incomplete data. Most profile data you can correct yourself.
• Erasure (Article 17) — deletion, in the circumstances the GDPR provides for. See Section 13.
• Restriction (Article 18) — to have processing paused while a dispute about accuracy or lawfulness is resolved.
• Portability (Article 20) — data you gave us, in a structured, commonly used, machine-readable format, where processing is based on consent or contract and carried out by automated means.
• Objection (Article 21) — to processing based on legitimate interests, including profiling. You can object to direct marketing at any time, and we will stop, without exception.
• Withdraw consent (Article 7(3)) — at any time, for anything we do on the basis of consent.
• Not to be subject to a solely automated decision (Article 22) — see Section 10.5.

How to exercise them. Some are self-service in the product. Otherwise, write to privacy@lancedhq.com. We log every request, and we will respond within one month, extendable by two further months for complex or numerous requests — in which case we will tell you within the first month, and explain why.

About access and export, specifically. The self-service export currently assembles your account record, application grants, organisation memberships, artist profile, applications and any previous privacy requests. It does not yet include the sensitive fields, uploaded media, messages, application answers and materials, the per-application consent records, or the audit trails. Those are compiled by our team on request, within the same deadline, and we are extending the automated export to cover them. If you want everything, ask at privacy@lancedhq.com and say so — we will not give you the partial version and call it complete.

We may need to verify who you are before acting, and we will ask for no more than is necessary to do that.

Exercising your rights is free. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive — and we will explain why.

If you are unhappy with how we have handled your personal data, please tell us first, at privacy@lancedhq.com. We would rather fix it.

You also have the right to lodge a complaint with a supervisory authority. In the Netherlands that is:

Autoriteit Persoonsgegevens
Postbus 93374, 2509 AJ Den Haag, the Netherlands
autoriteitpersoonsgegevens.nl

If you live or work in another EU or EEA country, you can complain to your own national supervisory authority instead. You also have the right to an effective judicial remedy.

You must be at least 16 to hold a Lanced account. This matches the age at which, under Dutch law implementing Article 8 GDPR, a young person can consent to information society services on their own behalf.

If you are under 18:

• You can use Lanced, but you cannot purchase a subscription without the consent of a parent or guardian.
• If a company wants to engage you, additional legal rules apply to your work, and the company is responsible for complying with them.

We do not knowingly collect data from anyone under 16. If you believe a child under 16 holds an account, tell us at privacy@lancedhq.com and we will remove it.

We update this policy when the product, our providers, or the law change.

For material changes — anything that meaningfully affects how your data is used — we will give you at least 30 days' notice by email and inside Lanced before the change takes effect. For minor changes, such as corrections and clarifications, we update the date at the top.

Previous versions are kept at lanced.tech/privacy-policy.