Client Privacy Notices

SENTENCE DRAFTED BY LEGAL EXPLAINING THAT WE HAVE TWO CLIENT POLICY NOTICES, ONE FOR US, ONE FOR EX-US, AND BOTH OF THEM CAN BE FOUND BELOW.

  1. US CLIENT PRIVACY NOTICE

Effective: January 1, 2023.

Creative Artists Agency, LLC

Client Privacy Notice

This privacy notice (“Notice”) describes to our valued clients the U.S. privacy policies (“Policy”) of Creative Artists Agency, LLC and CAA Sports LLC (“CAA, “us” or “we”). 

Who is Covered by this Privacy Notice?

As a leading talent and sports agency, our clients are some of the most successful entertainment and sports professionals.  We have long served our clients in a manner that respects their desire for discretion and confidentiality.  This Notice is intended to summarize our data handling practices and applies to both current and former clients who are individuals residing in the United States.  The Policy does not apply to those clients residing outside the U.S., or to partnerships, corporations, trusts or other clients and entities that are not individuals.

This Notice summarizes our business practices regarding your privacy; how we collect and share personal information about you; and how you can limit our sharing or certain uses by others of this information. We may amend our Policy at any time and will provide notice of changes to our Policy in accordance with applicable law.

We Respect Your Privacy

We appreciate that, in engaging us, you provide us with your personal and financial information. We understand your concerns about how we handle that information.  We continue to follow our long-standing commitment to treat that information with care.  Doing so is an important part of how we conduct our business.

What Personal Information Do We Have and Share About You?

In performing services for you, we regularly receive, process and maintain certain personal information about you.  All such information is referred to as “your information” in this notice.  This information may include:

  • Information provided by you, including information from documents and other forms we receive from you or while performing services for you;
  • Information about your professional activities related to transactions with us or our affiliates; and
  • Information about your professional activities related to transactions with nonaffiliated third parties.

For example, we obtain information, such as your name, address, email address, telephone/fax numbers, bank account numbers, and other information from documents you submit to us.

How do We Protect Your Information?

We maintain physical, electronic, and procedural safeguards intended to protect information.  Threats to information are ever-evolving, so no safeguard is perfect.  We also rely on you to help us identify threats to your information. So, if you notice any suspicious activity, or become a victim of identity theft or fraud, please alert us as soon as possible.

With Whom Do We Share Your Personal Information?

CAA needs to share your personal information to provide services to you.  The ways we may share your information include:

  • We may disclose your information in connection with activities we undertake for you, such as in our efforts to procure engagements or employment, to process payments in connection with your professional activities, to respond to legal process, or to perform other services on your behalf that you have asked us to perform.
  • We may share your information with our affiliates (entities related to us through common ownership), so they may offer services to you and help us serve you better.
  • We may share your information with non-affiliated service providers such as attorneys, banks, administrators, and custodians, to facilitate your professional activities, enable them to perform services on our behalf, or as otherwise permitted or required by law.
  • If you prefer that we limit our sharing of your information to our affiliates or others for the purpose of offering you services, please email us privacy@caa.com.

How this Privacy Policy Relates to Your Agency or Representation Agreement

This notice is designed to help you better understand how we treat personal information we may have about you, and is intended to incorporate the terms of our representation agreement we may have with you.  Where terms of this notice differ from those contained in your representation agreement, the terms of your agreement will control our use of any information you choose to provide or give us access to. 

How to Contact Us About Privacy Matters

If you have any questions regarding this privacy policy or would like to contact us for any reason concerning our privacy practices, please email us at privacy@caa.com.

CCPA Client Privacy Notice for California Residents

CAA collects your personal information, as defined under California Consumer Privacy Act (Cal. Civ. Code § 1798.100, et. seq.) to support its business operations, including for the business purposes listed below.

We do not sell the personal information we collect from our clients. We also do not share client personal information with third parties for cross-context behavioral advertising.

We may collect the personal information categories listed below. Also listed, for each category, are CAA’s business purpose for collecting the information and our expected retention period.  Please note that in some situations, we may need to retain certain categories of personal information for longer than the disclosed period in order to comply with our legal or regulatory obligations, resolve disputes, defend against legal claims, or in other exigent circumstances.

 

Personal Information Category set forth in Cal. Civ. Code § 1798.140

Personal identifiers, including real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license or passport number, or other similar identifiers.

  • Business or Commercial Purpose(s) for Collection/Use:
    • Effectively represent you and match you with booking opportunities; communicate with you; perform services requested by you or necessary for our representation of you; prevent, detect, and investigate fraud or other security incidents. 
  • Retention Period: 
    • The length of our representation of you plus any legally required additional retention period for this category of personal information following conclusion of our representation of you or seven years post-relationship, whichever is longer.

California Customer Records personal information (Cal. Civ. Code § 1798.80(e)), including name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.

  • Business or Commercial Purpose(s) for Collection/Use:
    • Effectively represent you and match you with booking opportunities; perform services requested by you or necessary for our representation of you.
  • Retention Period: 
    • The length of our representation of you plus any legally required additional retention period for this category of personal information following conclusion of our representation of you or one year post-relationship, whichever is longer.

Characteristics of protected classifications under California or federal law.

  • Business or Commercial Purpose(s) for Collection/Use:
    • Effectively represent you and match you with booking opportunities; to perform services requested by you or necessary for our representation of you.
  • Retention Period: 
    • The length of our representation of you plus any legally required additional retention period for this category of personal information following conclusion of our representation of you or seven years post-relationship, whichever is longer.

Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

  • Business or Commercial Purpose(s) for Collection/Use:
    • We do not collect.
  • Retention Period:
    • Not applicable.

Biometric information.

  • Business or Commercial Purpose(s) for Collection/Use:
    • We do not collect.
  • Retention Period:
    • Not applicable.

Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information about individual interactions with an Internet website, application, or advertisement.

  • Business or Commercial Purpose(s) for Collection/Use:
    • We do not typically collect from clients unless a client visits our website, in which case our website privacy policy covers this category of information.
  • Retention Period:
    • Not applicable.

Geolocation data

  • Business or Commercial Purpose(s) for Collection/Use:
    • We do not collect.
  • Retention Period:
    • Not applicable

Sensory data including audio, electronic, visual, thermal, olfactory, or similar information.

  • Business or Commercial Purpose(s) for Collection/Use:
    • Effectively represent you and match you with booking opportunities; perform services requested by you or necessary for our representation of you.
  • Retention Period:
    • The length of our representation of you plus any legally required additional retention period for this category of personal information following conclusion of our representation of you or seven years post-relationship, whichever is longer.

Professional or employment-related information.

  • Business or Commercial Purpose(s) for Collection/Use:
    • Effectively represent you and match you with booking opportunities; perform services requested by you or necessary for our representation of you.
  • Retention Period:
    • The length of our representation of you plus any legally required additional retention period for this category of personal information following conclusion of our representation of you or seven years post-relationship, whichever is longer.

Non-public education information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. § 1232g; 34 C.F.R. Part 99)

  • Business or Commercial Purpose(s) for Collection/Use:
    • We do not collect.
  • Retention Period:
    • Not applicable

Inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

  • Business or Commercial Purpose(s) for Collection/Use:
    • We do not collect.
  • Retention Period:
    • Not applicable
       

Sensitive Personal Information Category as set forth in Cal. Civ. Code § 1798.140

Social security number, driver’s license number, state identification card, or passport number.

  • Purposes for Collection; Use:
    • Effectively represent you and match you with booking opportunities; perform services requested by you or necessary for our representation of you; protect and secure our workforce and environment.
  • Retention Period:
    • ​​​​​​​The length of our representation of you plus any legally required additional retention period for this category of personal information following conclusion of our representation of you or one year post-relationship, whichever is longer.

Account access credentials (user names, account numbers, or card numbers combined with required access code, security code or password to access an account).

  • Purposes for Collection; Use: 
    • Effectively represent you and match you with booking opportunities; perform services requested by you or necessary for our representation of you; protect and secure our workforce and environment.
  • Retention Period:
    • The length of our representation of you plus any legally required additional retention period for this category of personal information following conclusion of our representation of you or one year post-relationship, whichever is longer.

Precise geolocation (location within a geographical area of a circle with a radius of 1850 feet or less).​​​​​​​

  • Purposes for Collection; Use:
    • ​​​​​​​We do not collect.
  • Retention Period:
    • ​​​​​​​Not applicable.

Racial or ethnic origin

  • Purposes for Collection; Use:
    • Effectively represent you and match you with booking opportunities; perform services requested by you or necessary for our representation of you.
  • Retention Period:
    • The length of our representation of you plus any legally required additional retention period for this category of personal information following conclusion of our representation of you or seven years post-relationship, whichever is longer.

Religious or philosophical beliefs

  • Purposes for Collection; Use:
    • ​​​​​​​Perform services requested by you or necessary for our representation of you
  • Retention Period:
    • ​​​​​​​The length of our representation of you plus any legally required additional retention period for this category of personal information following conclusion of our representation of you or seven years post-relationship, whichever is longer.

Union membership

  • Purposes for Collection; Use:
    • ​​​​​​​Effectively represent you and match you with booking opportunities; perform services requested by you or necessary for our representation of you.
  • Retention Period:
    • ​​​​​​​The length of our representation of you plus any legally required additional retention period for this category of personal information following conclusion of our representation of you or seven years post-relationship, whichever is longer.

Genetic Data

  • Purposes for Collection; Use:
    • ​​​​​​​We do not collect.
  • Retention Period:
    • ​​​​​​​Not applicable.

Mail, email, or text messages where the content is not directed to us.

  • Purposes for Collection; Use:
    • ​​​​​​​We do not collect.
  • Retention Period:
    • ​​​​​​​Not applicable.

Unique identifying biometric information

  • Purposes for Collection; Use:
    • ​​​​​​​We do not collect.
  • Retention Period:
    • ​​​​​​​Not applicable.

Personal information collected and analyzed concerning health.

  • Purposes for Collection; Use:
    • ​​​​​​​We do not collect.
  • Retention Period:
    • ​​​​​​​Not applicable.

Personal information collected and analyzed concerning sex life, or sexual orientation.

  • Purposes for Collection; Use:
    • ​​​​​​​We do not collect.
  • Retention Period:
    • ​​​​​​​Not applicable.

Additional information about your privacy rights under California law can be found in our online privacy policy, available at https://www.caa.com/privacy-policy. If you have any questions about this Notice, please contact privacy@caa.com.

 

2. CAA GLOBAL PRIVACY NOTICE (EXCLUDING US)

  1. Introduction

Creative Artists Agency and its affiliates, (together "Company", “our” and “we”) are committed to the protection and promotion of individual privacy. This notice ("Notice") provides relevant information about the Company’s processing of our clients’ (“you” and “your”) personal data worldwide (excluding the United States which has a separate Client Privacy Notice). In connection with your use of our Services (see below), it is necessary for the Company to collect, store and use personal data about you for specified purposes in order to provide the Services. Personal data is information, or a combination of pieces of information that could reasonably allow you to be identified.

It is important that you read this notice carefully to understand your rights, and how we will process your personal data.

This Notice uses terminology derived from the GDPR. Where you are located in a jurisdiction outside of the UK or EEA, references to GDPR-specific terms (such as “personal data”, “data controller”, “data processor”, “special personal data”, and “lawful basis”) should be construed as references to equivalent or analogous concepts under the data protection laws applicable in your jurisdiction. 

  1. Identity of the Data Controller

A reference to “Company,” “we,” or “our” is a reference to Creative Artists Agency LLC and/or its relevant subsidiaries and affiliates involved in the collection, use, disclosure, or other processing of personal data. The entity you have entered into a contract with is responsible for handling your personal data and is the data controller (or the equivalent term under applicable laws in your jurisdiction, such as the “data user” if you are based in Hong Kong) in respect to your personal data. If you have any questions on who the data controller is in relation to your personal data, please contact us using the contact details are set out in Section 10 below.

In some cases, the Company may act as a data processor rather than a data controller (or, in each cash, the equivalent term under applicable laws in the relevant jurisdiction). This means that whilst the Company may process personal data similar to that described in this Notice, the Company does so on behalf of, and under the instructions of, another entity who is the data controller. In these circumstances, the Company is not responsible for, amongst other things, providing transparency information in respect of such processing, establishing a lawful basis for the processing, or responding to data subject rights requests. The relevant data controller in such cases will be a separate entity, and their privacy notice (or equivalent document under applicable laws in the relevant jurisdiction) will contain the relevant information regarding how your personal data is processed.

  1. Purposes for Processing Personal Data and Legal Bases for Processing
    • Acting, directing, producing, and writing;
    • Book publishing;
    • Brand consulting and marketing;
    • Consumer product licensing;
    • Endorsements;
    • Touring and live performances; 
    • Project Management; and
    • Brand Management.
    • To provide you with the information that you request from us;
    • To process payments;
    • To improve our Services;
    • For business administration and internal record management; and
    • To provide you with information about projects or Services we feel may interest you.

We process personal data that, as an entertainment talent agency, allows us to provide a wide range of services to clients in varying industries including, but not limited to television, motion picture, theatre, music, sports, comedy, speaking, gaming, podcasts, publishing and marketing. In connection with these industries, the Company works to, among other things, make available to our clients, opportunities with regard to:

(the “Services”).

We may also use the information that you provide us, together with any information that we may receive about you from other sources, in the following ways:

The Company processes personal data relating to you necessary for the performance of the agreement with the Company for the Services. The Company endeavours to safeguard personal information and will only collect personal information that is required to effectively provide these Services, pursue its legitimate business interests, and remain in compliance with all applicable laws, or with your consent to such collection. Some of the personal data we collect is required to enter into or perform a contract with you, or to comply with our legal obligations, if you do not provide this data, we may be unable to provide our services or fulfil our obligations to you. Other personal data is provided voluntarily and is not a mandatory requirement.  Further information about the legal bases for processing your personal data is included at Annex 1.

The lawful bases set out in this Notice and Annex 1 are primarily based on GDPR principles. In some jurisdictions 'legitimate interest' is not recognised as a lawful basis for processing personal data. In those jurisdictions, we will rely on an alternative lawful basis such as consent, performance of a contract, or compliance with legal obligations. Where we rely on your consent as the basis for processing. Providing consent will not be made a condition of receiving our services unless that processing is directly and necessarily linked to the delivery of those services or the performance of your contract. For more information about the lawful basis we rely on to process your personal data in your jurisdiction, please contact us using the details provided in Section 10.

Where applicable, we will let you know at the time of the data collection, if the provision of the personal data is a statutory or contractual requirement and whether you are obliged to provide personal data and the possible consequences of the failure to provide such data.

  1. Categories of Personal Data that we Process

The categories of personal data that the Company processes about you are set out in Annex 1 to this Notice, which also identifies the lawful bases for the processing, including where the processing is for the Company’s pursuit of its legitimate business interests.

  1. Recipients of Personal Data and International Transfers

 The Company may disclose your personal data to certain third parties, including:

  1. Subsidiaries, affiliates and the parent company of the Company;
  2. Service providers;
  3. Regulatory authorities;
  4. Legal and other professional advisors;
  5. Prospective purchasers of the Company or Company assets;
  6. Buyers.

The Company is part of the global CAA group of companies. As a result, we may share your personal data with other companies in our group as well as with external third parties in order to provide our Services and otherwise in connection with the running of our business, including to enable us to comply with our legal obligations.

Where we share your personal data with selected service providers who are engaged by us to assist us to provide our Services or with the running of our business, we ensure that these service providers are bound by law and/or contract to protect the confidentiality and security of personal data and to only use the personal data to provide the requested services to us and in accordance with applicable law.  

Some of the companies in our group are located in territories that do not have the same level of protection for personal data as your local jurisdiction, (such as our parent company, Creative Artists Agency LLC located in the US), and some of our external service providers may also process your personal data outside of the jurisdiction in which you are based. 

If and when transferring your personal data outside of your jurisdiction (the “Relevant Jurisdiction”), CAA will comply with applicable local law requirements in respect of such transfers, and in particular we will only do so when we have an appropriate mechanism or safeguard in place, including: 

a)      ensuring the transfer is to a country that has been the subject of an adequacy decision by the appropriate body in the Relevant Jurisdiction (such as the UK Secretary of State in the UK, and the EU Commission in the EU); or 

b)      the transfer is covered by a contractual agreement which includes appropriate standard contractual clauses approved by the appropriate body in the Relevant Jurisdiction (e.g., in the UK, ICO's International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses). 

International transfers to our affiliates, subsidiaries and our parent company located outside of the UK/EEA are governed by the EU Commission's Standard Contractual Clauses and the UK's Information Commissioner's Office (ICO) Addendum.

Where you are located in another jurisdiction, different transfer requirements may apply. CAA will comply with applicable local transfer requirements, which may include obtaining your consent, conducting data protection impact assessments, or implementing other safeguards as required by local law.

For more information on the appropriate safeguards in place and to obtain a copy of these, please contact us using the contact details provided in Section 10 below. These transfers of your personal data may be made subject to the above-mentioned safeguards, and/or where the transfer is occasional and necessary for the performance of a contract or the implementation of precontractual measures between you and the Company. Additionally, where it is in your interests, we may also transfer data relating to you that is necessary for the performance/conclusion of a contract between the Company and a third party. 

The Company may choose to sell, transfer, or merge parts of its business, or its assets. Or it may seek to acquire other businesses or merge with them. During any such process, the Company may share your data with other parties. It will only do this if the other parties agree to keep your data safe and private.

Where CAA requires your consent before sharing your personal data with third parties, we will obtain such consent in accordance with local law. 

  1. Your Rights

Depending on the local laws of the jurisdiction that you are in, you may have certain rights in relation to your personal data. These may include:

  1. to obtain access to your personal data – you may request information on how your personal data is handled by us and request a copy of such personal data;
  2. to request that we correct or update your personal data if it is inaccurate or out of date;
  3. to object to the processing of your personal data for the purposes of our legitimate interests, unless we:
    1. demonstrate compelling legitimate grounds which override your right to object; or
    2. the processing is necessary for the establishment, exercise or defence of legal claims;
  4. to ask us to erase your personal data held by us, for example data which is no longer necessary in relation to the purposes for which it was collected;
  5. to the processing of which you object to ask us to restrict the processing of your personal data, for example:
    1. where you would like us to verify the accuracy of the data; or
    2. where you object to the processing of it by us on the basis of legitimate interests (see para 6c) above) pending verification of whether we have overriding legitimate grounds to process the data; 
  6. to ask us to transmit personal data, you submitted to us back to you or to another organisation in certain circumstances;
  7. to be informed how we collect your personal data, the legal basis for collection and processing, how such data is processed, stored, destroyed, and to whom it will be disclosed; and
  8. in the jurisdictions where applicable data protection law gives such right, to claim compensation for material or moral harm suffered as a result of a violation of applicable data protection law.

The right to erasure and to restrict processing listed above may not apply or may be limited in certain circumstances, such as where the processing is necessary for compliance with our legal obligations or the establishment, exercise or defence of legal claims.

Where the processing of your personal data is based on your consent, you have the right to withdraw your consent at any time, but this will not affect the lawfulness of processing based on your consent prior to withdrawal. 

These rights are not absolute and may be subject to certain conditions under the law. Should you wish to exercise any of these rights, please contact the Company using the details in Section 10. If for some reason we cannot fulfil your request to exercise these rights, we will provide you with the reasons for our decision. 

Please note that the rights that you have in relation to your personal data may differ depending on the jurisdiction that you are in. For example, in jurisdictions such as Dubai (if you are based in the DIFC), you also have an anti-discrimination right, meaning you have the right to not be treated differently with regards to our provision of services, purely because you have exercised another right in respect of your personal data that we process.

  1. Security/Retention of Personal Data

The Company will take practicable steps to ensure that personal data we hold is protected against unauthorised or accidental access, processing, erasure, loss or use.

The Company will keep and process your personal data only for as long as is necessary for the purposes for which it was collected in connection with the Services, unless the Company has a legal right or obligation to retain the data for a longer period, or in order to establish, exercise, or defend potential legal claims. As a general framework, personal data is retained for the duration of our relationship with you and thereafter for a period reflecting relevant statutory limitation periods, unless a longer period is required by other law or regulation. Specific retention periods applicable to different categories of personal data are available on request. Once personal data is no longer required for the purpose for which it was collected, it will be securely destroyed or anonymised using methods that prevent recovery or further access, such as secure deletion, anonymisation, or physical destruction of paper records.

  1.  Automated Decision Making

We do not envisage that any decisions will be taken about you using solely automated means. We will notify you if this changes.

  1. Complaints

We strive to process your personal data in accordance with the applicable legal obligations but if you have any complaint(s) in that regard, please address your complaint(s) using the contact details set out in Section 10.

You also have the right to lodge a complaint with a supervisory authority for data protection in your jurisdiction. We ask that if you are not happy with how we handle your personal data that you reach out to us in the first instance so that we can try to provide you with a satisfactory resolution to your request. 

  1. Contact Details

If you have any questions about this Notice or information we hold about you, please contact us using via email at Privacy@caa.com.

Our Data Protection Officer can be contacted at the same details. 

We may update this Notice periodically. Where the changes made are substantive or material, we will inform you of these.