1. Introduction
ART SA ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This policy explains how we handle your information when you use artsa.com.
2. Data We Collect
Information you provide
- Account data: name, email address, password (encrypted), account type
- Profile data: bio, city, country, profile image (artists/galleries)
- Transaction data: purchase history, bids, payment information (processed by Stripe — we never store card numbers)
- Communications: messages, support requests, newsletter preferences
Information collected automatically
- Usage data: pages viewed, features used, time spent on platform
- Device data: browser type, operating system, screen resolution
- Network data: IP address, approximate location (country/city level)
3. How We Use Your Data
We use your data to:
- Provide and improve the ART SA platform
- Process transactions and deliver artworks
- Send transactional emails (purchase confirmations, auction updates, verification)
- Send marketing communications (only with your consent — you can unsubscribe anytime)
- Prevent fraud and enforce our Terms of Service
- Generate anonymized analytics to improve the platform
4. Legal Basis (GDPR)
We process your data under these legal bases:
- Contract: to fulfill our service agreement with you
- Consent: for marketing emails and optional cookies
- Legitimate interest: for security, fraud prevention, and platform improvement
- Legal obligation: for tax records and regulatory compliance
5. Data Sharing
We do not sell your personal data. We share data only with:
- Stripe: for payment processing
- Amazon SES: for transactional and marketing emails
- Shipping partners: for artwork delivery (name and address only)
- Law enforcement: when required by law
6. Data Retention
We retain your data for as long as your account is active. If you delete your account, we will remove your personal data within 30 days, except for transaction records which we retain for 7 years for tax and legal purposes.
7. Your Rights
Under GDPR and applicable law, you have the right to:
- Access your personal data
- Rectify inaccurate data
- Delete your account and data ("right to be forgotten")
- Export your data in a portable format
- Object to processing based on legitimate interest
- Withdraw consent for marketing at any time
To exercise these rights, email privacy@artsa.com.
8. Security
We protect your data with:
- Encrypted connections (TLS/HTTPS) for all communications
- Hashed and salted passwords — we cannot read your password
- Secure payment processing via Stripe (PCI DSS compliant)
- Regular security audits and monitoring
9. International Transfers
Your data may be processed on servers in multiple jurisdictions worldwide. We ensure all international transfers comply with applicable data protection requirements through appropriate safeguards.
10. Children
ART SA is not intended for users under 16. We do not knowingly collect data from children. If you believe a child has provided us personal data, contact us to have it removed.
11. Contact
Data Controller: ART SA
Email: privacy@artsa.com