Privacy Policy

1.1 This Privacy Policy explains how Artit London Ltd ("ARTIT", "we", "us", "our") collects, uses and protects your personal data when you use www.artit.net (the "Platform") and our services. We are the data controller for the personal data described in this policy, except where we act as processor for an Opportunity Provider or where a Provider is a separate controller (see clause 6).

1.2 We are a company registered in England and Wales (company number 10024386), with our registered office at Second Floor Belgrave Court, 23A, 36 Westferry Circus, London, E14 8RL.

1.3 We process personal data in accordance with UK data protection law — the UK GDPR and the Data Protection Act 2018. ARTIT is registered with the UK Information Commissioner's Office (ICO) under registration reference CSN1195127.

1.4 This policy should be read together with our Terms and Conditions. Words defined in the Terms (such as Creator, Opportunity Provider, Opportunity, Creator Profile and Creator Portfolio) have the same meaning here.

1.5 We have designated an internal data protection lead who is responsible for overseeing compliance with this policy. We are not required to appoint a statutory Data Protection Officer (DPO), and have not done so. If you have any questions, or wish to exercise your rights, contact us at contact@artit.net.

We are specific below about what we collect from Creators, what we collect from Opportunity Providers (organisers), what an organiser can see about you, and what we collect to verify organisers. For each, we explain why we need it.

2.1 Basic account data (everyone). When you register (as a Creator, an Organisation, or an Art Curator), we collect your email address, a password (stored securely/hashed), your account type, and an invite code if you have one. *Why we need it:* to create your account, sign you in securely, and give you the right experience for your role.

2.2 Creator profile data (public). During onboarding and in your profile we collect: first and last name, an optional artist name, username, date of birth, optional pronouns, country, city and (for the US) state, nationality, a profile photo, short and long bio, education and events, website and social-media links (Instagram, Facebook, Twitter and others), and your artistic details — experience level, goals, artistic fields, subjects, styles and materials. In your Portfolio you add your works (title, materials, year, description, dimensions, and images or videos, including work-in-progress photos). *Why we need it:* your name, artist name, username and photo identify you to organisers and the public; your date of birth confirms you are 18 or over, which is a condition of using ARTIT; your location and artistic details power the matching that suggests relevant opportunities; and your portfolio is the work you showcase and submit. Your Creator Profile and Portfolio are public, and selected content may also be shown to visitors who are not signed in.

2.3 Creator application data (when you enter an Opportunity). When you apply to an opportunity you may submit: selected works, a CV/résumé, an artist statement, a bio, proof of eligibility, and your answers (text or files) to the organiser's specific questions, together with the entry fee and payment status. *Why we need it:* organisers set their own entry requirements, and this is the material they need to judge your entry fairly against their published criteria. You choose what to upload — if you would rather not provide something, you can decide not to enter (see clause 5).

2.4 Opportunity Provider (organiser) data (public). If you register as an Organisation or Art Curator, we collect: your organisation or display name, type and industry, a logo/profile photo, bio, social-media links, and the details of the opportunities you create (title, description, dates, prizes and eligibility criteria). Payouts are handled through Stripe (see 2.8). *Why we need it:* to build your public organiser profile, let you create and run opportunities, help artists find and trust you, and pay out the fees you collect.

2.5 What an Organiser can see about you (Creators). When you apply to an organiser's opportunity, that organiser can see your public profile identity (name or artist name, username and profile photo) and the materials you submitted to their opportunity (selected works, CV/résumé, artist statement, bio, proof of eligibility, and your answers to their questions). An organiser does not see your private account details — for example, your password, login email, date of birth, or payment/card details are not shared with them. *Why it is set up this way:* organisers need enough information to identify applicants and judge entries, but not your private account or payment data.

2.6 Verification data — individual organisers. An organiser can apply to become Verified. For an individual organiser we collect: first and last name (as shown on your ID), date of birth, a government-issued ID document (uploaded), and a phone number. *Why we need it:* to confirm that a real, identifiable person is behind an organiser account before they run opportunities and handle artists' entries, fees and prizes. This protects Creators from fake or fraudulent organisers. We verify to the best of our knowledge (see Terms clause 20.4).

2.7 Verification data — organisations. For an organisation organiser, what we collect depends on its legal status:

• Legal entity (registered business, non-profit or charity): legal name, country of registration, registration or VAT number, entity type (e.g. Ltd, LLC, non-profit, charity), legal/business address, and official business documents (uploaded).
• Non-legal entity (e.g. a collective or informal group): the group's name and any documents that help verify it.
• In both cases, an organisation contact: full name, role in the organisation, business email and phone number.

*Why we need it:* to confirm that the organisation genuinely exists and that the person acting for it is authorised to do so — again, to protect the Creators who submit work, pay entry fees and rely on the prizes being real.

2.8 Payment data. Payments are processed by Stripe. We do not store your full card details. We hold limited payment information — such as saved payment-method references, transaction records, fee amounts, currency and payment status — needed for entry fees, the Platform Fee, refunds and payouts. *Why we need it:* to take entry fees, pay organisers, process refunds, and meet our accounting and tax obligations.

2.9 Communications, usage and marketing data. We also collect: messages you send us (support requests, reports); usage and technical data (IP address, device and browser type, pages viewed) through cookies and Google Analytics, together with Google reCAPTCHA (spam and abuse protection) and Google Maps (location entry); and your marketing preferences (for example, the newsletter setting on your profile). *Why we need it:* to respond to you, keep the Platform secure and working, understand and improve it, and send you updates you can opt out of.

Under the UK GDPR we must have a lawful basis for using your personal data. Our uses and bases are:

3.1 To provide the Platform and your account — creating and managing your account, hosting your Profile and Portfolio, and enabling you to enter or run Opportunities. *Lawful basis: performance of our contract with you.*

3.2 To process payments, fees and refunds — taking Entry Fees, collecting the Platform Fee, and handling refunds and payouts via Stripe. *Lawful basis: performance of our contract; and compliance with legal obligations (e.g. accounting and tax).*

3.3 To confirm you are 18 or over — age-gating at registration. *Lawful basis: performance of our contract and compliance with our legal obligations.*

3.4 To operate matching and recommendations — using automated tools, including AI, to analyse the theme and attributes of works and suggest relevant Opportunities, and to organise and categorise content. *Lawful basis: our legitimate interests in operating and improving the Platform. (See clause 9 on automated processing.)*

3.5 To keep the Platform safe and enforce our Terms — verification, fraud prevention, investigating reports, and taking enforcement action. *Lawful basis: our legitimate interests in protecting users and the Platform; and compliance with legal obligations.*

3.6 To communicate with you — sending service and transactional messages (for example, about your account, submissions, payments or important changes). *Lawful basis: performance of our contract; and our legitimate interests.*

3.7 To send marketing communications — we may send updates and newsletters to registered users about ARTIT, Opportunities and features. *Lawful basis: our legitimate interests in promoting the Platform.* You can opt out at any time using the unsubscribe link in any marketing email or by contacting us; we will stop sending marketing communications when you opt out.

3.8 To understand and improve the Platform — analytics about how the Platform is used. *Lawful basis: your consent for non-essential cookies (see clause 7); and/or our legitimate interests.*

3.9 Where we rely on legitimate interests, we have considered that these are not overridden by your rights, and you can object at any time (see clause 8).

4.1 When you enter an Opportunity, relevant information — such as your name/username, your Submission, and any information or documents the Opportunity requires — is shared with the Opportunity Provider running it, so they can receive, judge and administer the Opportunity.

4.2 The Opportunity Provider is a separate data controller for the personal data it receives and uses for its own purposes. This Privacy Policy does not cover a Provider's own handling of your data; you should review the Provider's own privacy information. ARTIT is not responsible for how a Provider uses personal data it receives.

5.1 Some Opportunities are aimed at specific groups, and the information you choose to provide (for example, for eligibility or a discount) could reveal special category data — such as racial or ethnic origin, health or disability information. We only process such data where you choose to provide it, and our lawful condition for doing so is your explicit consent, given when you decide to submit it.

5.2 You are never required to provide special category data; you may choose not to take part in the relevant Opportunity instead (see Terms clause 3.3). You can withdraw your consent, though this may mean you can no longer take part in an Opportunity that requires the information.

5.3 Verification and identity documents. When an organiser applies to become Verified, we collect identity or organisation documents — for example a government-issued ID and date of birth (for individual organisers), or official business documents (for organisations). These may contain sensitive identity information. We use them only to verify the organiser, store them with restricted access, and rely on your explicit consent where any of this information is special category data. See clause 2.6–2.7 for exactly what is collected and why.

We do not sell your personal data. We share it only as described here:

6.1 Opportunity Providers — as described in clause 4, when you take part in their Opportunity.

6.2 Public display — your Creator Profile and Creator Portfolio are public, and selected content may be shown to visitors (see clause 2.2).

6.3 Our service providers (processors), who act on our instructions under contract, including:

• Stripe — payment processing;
• Hosting and infrastructure — Vercel (hosting of our website/front end) and DigitalOcean (hosting of our back-end application and database);
• Mailchimp (Intuit Mailchimp) — sending transactional and marketing emails;
• Google — Google Analytics (website analytics), Google reCAPTCHA (spam/abuse protection) and Google Maps (location entry).

6.4 Authorities and legal — we may disclose data where required by law, to comply with legal process, or to protect our rights, users or the public.

6.5 Business transfers — if ARTIT is involved in a merger, acquisition or sale of assets, personal data may be transferred as part of that transaction, subject to this policy.

6.6 AI providers — we use AI internally for matching and recommendations (Terms clause 11.7). We do not share your Content or personal data with third parties to train their AI models, and do not use it to train third-party AI models, without your specific opt-in consent (Terms clause 11.6).

7.1 We use cookies and similar technologies. Strictly necessary cookies are needed to run the Platform (for example, to keep you logged in and to keep the Platform secure). We also use Google Analytics to understand how the Platform is used and to improve it.

7.2 Non-essential cookies (including analytics) are used only with your consent, which we request through our cookie banner; you can change your preferences at any time.

7.3 You can also control cookies through your browser settings. Blocking some cookies may affect how the Platform works.

8.1 Under UK data protection law you have the right to:

• access the personal data we hold about you;
• request correction of inaccurate or incomplete data;
• request erasure of your data (in certain circumstances);
• restrict or object to our processing (including objecting to processing based on legitimate interests, and to direct marketing at any time);
• request portability of data you provided to us;
• withdraw consent at any time where we rely on consent (without affecting processing already carried out); and
• not be subject to a solely automated decision with legal or similarly significant effects (see clause 9).

8.2 To exercise any of these rights, contact us at contact@artit.net. We will respond within the time limits required by law (normally one month).

8.3 You also have the right to complain to the UK regulator: the Information Commissioner's Office (ICO), www.ico.org.uk. We would appreciate the chance to address your concerns first. For full detail on each processing activity we carry out (purposes, lawful bases, recipients, transfers, retention and security), you can also view our Record of Processing Activities (ROPA).

9.1 We use automated tools, including AI, to suggest relevant Opportunities and to organise content (Terms clause 11.7). These are recommendations and organisational tools; they do not make decisions that produce legal effects or similarly significant effects on you. We do not carry out solely automated decision-making of the kind restricted by Article 22 of the UK GDPR.

10.1 Where our hosting or database is located in the European Economic Area (EEA) (for example, in an EU region of DigitalOcean), transfers of personal data from the UK to the EEA are permitted under the UK's adequacy regulations, and no additional safeguards are required.

10.2 Some of our providers (for example, Stripe, Mailchimp, Google and Vercel) may process personal data in the United States or other countries outside the UK and EEA. Where they do, the data is protected by an appropriate safeguard recognised under UK law — such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as set out in each provider's data-processing terms.

11.1 We keep personal data for as long as your account is active and for as long as needed to provide the Platform. After that, we keep personal data only for as long as necessary — for example, to comply with legal, accounting, tax or regulatory obligations, to resolve disputes, and to enforce our agreements — after which it is deleted or anonymised. Backup copies may persist for a limited period.

12.1 We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse or alteration. No system is completely secure, so we cannot guarantee absolute security; you are responsible for keeping your login details confidential (see Terms).

13.1 The Platform is for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, contact us at contact@artit.net and we will take appropriate steps.

14.1 We may update this Privacy Policy from time to time. Where changes are material, we will take reasonable steps to notify you (for example, by email or a notice on the Platform). The current version is always available on this page.

15.1 For any privacy question or to exercise your rights, contact us at contact@artit.net, or write to us at Artit London Ltd, Second Floor Belgrave Court, 23A, 36 Westferry Circus, London, E14 8RL.

15.2 You can also contact the Information Commissioner's Office (ICO) at www.ico.org.uk.