Legal center
Privacy Policy
Who is responsible
The data controller for personal information collected through this website is [Legal entity name — to be confirmed], trading as The 717 Agency, [Business address — to be confirmed]. Privacy contact: [Privacy contact email — to be confirmed].
What we collect
| Source | Information |
|---|---|
| Contact form | Name, email, organization, message, inquiry route, and (for press) outlet and deadline. |
| Booking inquiry | Contact details, organization, event or campaign details, location, requested talent, budget range, project description and requirements. |
| Partnership inquiry | Contact details, role, organization and website, objectives, audience, timeline, budget range and project details. |
| Talent application | Name, stage name, email, phone, category, location, links to your work, experience and statement, supporting links, and confirmations that you are 18+ and consent. See the Talent Application Privacy Notice. |
| Automatically | Standard server and security data (IP address, browser, request time) handled by the hosting provider. If you accept analytics cookies, usage data from Google Analytics 4 (only if enabled). |
| Cookie choice | Your consent preferences, in a first-party cookie. |
We collect information directly from you. We do not buy lists or scrape profiles. Please do not submit sensitive personal information (such as health, government ID or financial account details) in free-text fields.
Why and on what basis
- Responding to inquiries and applications — to take steps at your request and our legitimate interest in running the agency (GDPR/UK GDPR Art. 6(1)(b) and (f)), and your consent where you give it.
- Spam and abuse prevention, security — legitimate interest. We use a hidden field, timing checks and rate limiting (using a salted hash of your IP address, held in memory) and may use Cloudflare Turnstile.
- Analytics — only with your consent.
- Legal compliance and record keeping — legal obligation / legitimate interest.
We do not sell personal information and do not share it for cross-context behavioral advertising. We do not make automated decisions with legal effect about you. [Confirm with counsel — to be confirmed]
Who we share it with
Submissions are delivered to the agency's team and may pass through service providers acting on our behalf. Depending on configuration these are: [hosting provider — to be confirmed]; an email delivery provider (Resend) if enabled; a webhook or CRM destination if enabled [name the tool — to be confirmed]; Cloudflare (Turnstile) if enabled; Google (Analytics 4) if enabled and consented. We may disclose information where required by law or to protect rights and safety. We may share application or booking details with talent, venues or partners only where needed to progress your request and, for applications, as described in the application notice.
International transfers
Providers above may process data outside your country, including in the United States. Where required, transfers rely on appropriate safeguards such as standard contractual clauses or the EU–US Data Privacy Framework. [Counsel to confirm providers and mechanisms — to be confirmed]
How long we keep it
Proposed retention (to be confirmed by the agency): general and press inquiries — up to 12 months; booking and partnership inquiries that do not proceed — up to 24 months; records of agreed engagements — as needed for contract and tax purposes; unsuccessful talent applications — up to 12 months; consent records — up to 180 days in your browser. [Agency to approve retention periods — to be confirmed]
Security
Forms are validated on the server, sent over HTTPS, and are rate limited. Submission contents are not written to application logs. No system is perfectly secure; we cannot guarantee absolute security.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to processing, port your data, withdraw consent, and complain to a regulator (in the EU/UK) or appeal a decision (in some U.S. states). California residents may request to know, delete and correct personal information and may opt out of sale or sharing (we do not sell or share). We will not discriminate against you for exercising rights. To exercise rights, email [Privacy contact email — to be confirmed] with your request and the email address you used. We may need to verify your identity. [Counsel to confirm which regimes (GDPR, UK GDPR, CCPA/CPRA, other state laws) apply to the agency — to be confirmed]
Children
This website is not directed at children under 13, and our applications require applicants to be 18 or older. If you believe a child has sent us personal information, contact us and we will delete it.
Changes
We will post changes here and update the effective date. This document is a draft: it is not yet in effect and has not been legally reviewed.