Privacy Notice | Tonto Helsinki

Data controller

Tonto Helsinki Oy is the data controller responsible for the processing of personal data described in this notice.

When we process personal data on behalf of a client, we act in accordance with the client’s documented instructions and a separate data processing agreement. In that case, the client is the data controller responsible for the purposes of the processing and for providing information about it.

Business ID 2945940-5 Laivurinkatu 41 lh. 5, 00150 Helsinki

For questions and requests about data protection, please contact us at:

privacy@tonto.fi

What data do we collect?

When you contact us through a form, by email or by phone, we process the contact details you provide and the contents of your message. These may include your name, email address, phone number, the company you represent and information about a production or collaboration.

To manage customer relationships, we also record information about communications, proposals and agreed work. We receive this information from you or the organisation you represent.

The contact form requires an email address so that we can reply. All other fields are optional. The form is not intended for sending sensitive personal data.

Why do we process data?

We use personal data to respond to enquiries and prepare proposals and contracts. In productions, we need data to select crew and performers, carry out the work, pay fees and manage agreed usage rights.

Legitimate interests: we process enquiries, business contact details and unsolicited work samples to manage collaborations and find suitable people for productions.
Contract: if you are a party to a contract yourself, we process the data necessary to enter into that contract at your request and to perform it.
Legal obligations: we process payroll, tax and accounting data to comply with our legal obligations.
Consent: where processing or disclosure of data is based on your consent, we request it separately. At the same time, we explain the purpose and the recipients of the data.

Casting and work samples

Casting applications are usually received at info@tonto.fi or directly by the producers responsible for the production. Our producers handle applications, photos and videos in email and Google Drive.

For casting, we process applicants’ contact details and the applications, photos, videos and other information they provide that is necessary for casting. We use this material to cast the production in question and any follow-up productions for the same campaign.

We also receive unsolicited portfolios, work samples and modelling photos for future work opportunities. We generally process these in email to assess suitable opportunities.

Productions and crews

When you take part in a production as a performer, freelancer or crew member, we process the contact, contract, fee and payment details needed to manage the assignment or employment relationship. For payroll and taxation, we also process the identification and tax details required by law. We receive the information from you or the company you represent.

Photos, video and audio recordings created during a production may contain identifiable performers and crew members. The material is used to carry out the agreed production. Publication and usage rights are agreed separately in production and performer contracts.

Who receives the data?

At Tonto, data is processed by people whose responsibilities include enquiries, customer relationships, casting or production. Data is shared to the extent required by their work.

Webflow, Inc. provides the website and form service. Information submitted through the form is also stored in Webflow. Form messages are received at sales@tonto.fi.
Google Workspace Business Plus (Gmail and Google Drive) is used for email and file handling.
Visma Solutions Oy provides Visma Severa, where information relating to a potential customer relationship is stored.

Information needed for casting decisions and production may be shared with the production’s client, director, advertising agency and people managing the production. Information needed for payments and legal obligations is shared with accounting, payroll and, where necessary, public authorities.

If we collect an outstanding debt or handle a legal claim, we may disclose the information necessary to deal with the matter to a debt collection service or legal adviser. This processing is based on our legitimate interest in collecting debts and defending our rights.

The client and other parties to a production may be responsible for their own processing of personal data as independent controllers. Data processors acting on Tonto’s behalf are required to enter into a data processing agreement.

Webflow privacy information Severa privacy information

AI services

We use OpenAI’s ChatGPT Business and Google’s Gemini for research, preparing text, and assistance with handling messages and documents.

These services may process material supplied to them and content retrieved through Gmail and Google Drive connections. The material may include contact details and personal data in messages and documents. We use the services for the purposes described above and on the same legal bases.

We use company accounts for these services and keep settings that allow material to be used for training disabled. The providers process the material to fulfil requests. Storage and retention depend on the service, feature and settings used.

Privacy information for ChatGPT connections Gemini privacy for business use

Where is data processed?

Webflow stores personal data processed in its service in the United States. Webflow states that it uses the EU–US Data Privacy Framework, and its data processing agreement includes the Standard Contractual Clauses approved by the European Commission.

The servers storing Severa customer data are located in Ireland, and backups are stored in the Netherlands. Providers’ current subprocessors and processing countries are listed in their privacy information. You can ask us for more information about the safeguards used when your data is transferred.

Google Workspace and AI services may also process data outside the EU and EEA. Appropriate safeguards, such as the Standard Contractual Clauses approved by the European Commission, are used for data transfers. Service-specific details are available in the providers’ data processing terms.

Google data processing agreement

Webflow data processing agreement

How long do we keep data?

Enquiries

If an enquiry does not lead to a customer relationship, we delete the related personal data no later than two years after the last contact. Data that is no longer needed is deleted sooner.

Casting applications

We delete unsuccessful applicants’ applications, photos and videos no later than one year after casting ends. During the retention period, the material may be used to cast follow-up productions for the same campaign. Material that is no longer needed is deleted sooner.

Unsolicited portfolios

We keep unsolicited portfolios, work samples and modelling photos sent for future work opportunities for no more than two years after the sender’s last contact about that collaboration. Material that is no longer needed or is out of date is deleted sooner.

Production contracts and material

Contract, fee and usage-rights information for people selected for productions is kept for as long as necessary to carry out the production, manage the agreed usage rights and meet legal obligations. Retention of photos, audio and video is determined by the agreed purpose and the production’s instructions for retention, return and deletion.

Accounting and payroll

Accounting vouchers are kept for at least six years from the end of the year in which the financial year ended. Payroll records are kept for ten years after the end of the financial year.

Complaints and legal claims

We keep the information necessary for outstanding invoices, complaints or legal claims for as long as needed to deal with the matter.

These retention periods apply to all copies held by Tonto, including personal data in email, Google Drive, Webflow, Severa and AI services.

How do we protect data?

Access to personal data and the sharing of material are limited according to work responsibilities and production needs. We use company accounts and access permissions to protect data. People involved in productions are required to follow the confidentiality and data protection instructions applicable to their roles.

Technical and external services on the website

We protect the contact form from automated spam using Cloudflare Turnstile. For verification, it processes technical information such as the IP address and characteristics of the browser and connection. This processing is based on our legitimate interest in keeping the website secure and functional.

Cloudflare Turnstile privacy information

The website includes Vimeo video players. When a player loads, your browser connects to Vimeo and sends technical information such as your IP address. According to Vimeo, its player may use cookies. The enabled Do Not Track setting limits new cookies, but does not prevent the browser from sending previously stored Vimeo cookies.

Vimeo player cookies

The website loads fonts from Google Fonts and Adobe Fonts. When fonts are loaded, the providers receive technical information such as your IP address and browser details.

Google Fonts privacy information Adobe Fonts privacy information

Your data and your rights

You may request access to your data and the correction of inaccurate or incomplete data. Depending on the circumstances and the legal basis for processing, you may also request deletion, restriction of processing or data portability. You may object to processing based on legitimate interests on grounds relating to your particular situation, and you may always object to direct marketing.

Where processing is based on your consent, you may withdraw it. Withdrawal does not affect the lawfulness of processing carried out before it.

Send your request to privacy@tonto.fi. Where necessary, we may ask for additional information to verify your identity. We respond without undue delay, usually within one month. If more time is needed, we will tell you within the applicable deadline and explain why.

If you believe your data has been processed in breach of data protection rules, you have the right to lodge a complaint with the Office of the Data Protection Ombudsman.

Office of the Data Protection Ombudsman

Updates to this notice

We review our personal data processing practices regularly and update this notice when needed. The current version and its update date are available on this page. We notify you separately of material changes where required by law, and request consent if new processing requires it.