PRIVACY POLICY
Controller
Responsible for the collection, processing and use of your data is art.fair International GmbH Maria-Hilf-Str. 9 50677 Cologne, Germany Phone: +49 221 420 393 0 Fax: +49 221 420 393 29 contact@art-dus.de www.art-dus.de Managing Director: Walter Gehlen Data Protection Officer: Christian Krause, mail@dsb-dus.de
Personal Data
Personal data is any information relating to an identified or identifiable natural person, e.g. name, address, or email address.
Use, Publication and Disclosure of Personal Data
We collect, process, and use your data only to the extent necessary to enable your use of our website and the services offered on it. As part of providing services to admitted exhibitors, this includes publishing the name of your gallery among the participants on our website. We only disclose the personal data of admitted exhibitors to third parties where necessary for the performance of services related to participation in the fair, e.g. to security personnel commissioned by Art Düsseldorf during set-up and dismantling on the fairgrounds (Areal Böhler, Hansaallee 321, 40549 Düsseldorf, Germany). Third parties engaged by us process your personal data in accordance with these privacy provisions and the GDPR.
Data Collection
When you access our website, you transmit data to our web server out of technical necessity (see Section 6, Hosting). We additionally collect personal data that you provide as a user when registering for our newsletter, applying for VIP or press accreditation, or submitting contact inquiries, in particular name, postal address, email address, telephone number. For applications to exhibit as a gallery and for use of the Exhibitor Portal, a separate privacy policy applies (see Section 12).
Legal Basis
The legal basis for data processing is Art. 6(1)(a), (b), and (f) GDPR. Where processing is based on consent (e.g. newsletter), you may withdraw that consent at any time, informally, by email; the lawfulness of processing carried out before withdrawal remains unaffected. Otherwise, we process data for the performance of a contract (Art. 6(1)(b)) or on the basis of legitimate interest (Art. 6(1)(f)).
Hosting / Provision of the Website
Our website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). Server functions are configured for the Frankfurt am Main region in the EU; static content is delivered via Vercel’s global content delivery network. Vercel may also process data—for example, in the context of backups or the use of subcontractors—in the United States and other countries where Vercel or its subcontractors operate. When you visit the website, technically necessary connection data (IP address, date/time, requested URL, user agent) is processed to ensure the website is provided securely and reliably. Legal basis: Art. 6(1)(f) GDPR. A data processing agreement (Data Processing Addendum, part of Vercel’s Terms of Service) is in place with Vercel. Vercel is certified under the EU-U.S. Data Privacy Framework; in addition, the EU Standard Contractual Clauses (2021/914) and the UK IDTA apply.
Traffic Analysis (Vercel Web Analytics)
For anonymous traffic analysis, we use Vercel Web Analytics. Data is collected without cookies and without creating user profiles; aggregated, anonymized statistics are collected. No identification of individual persons takes place. Legal basis: Art. 6(1)(f) GDPR. As no cookies are set and no terminal equipment information within the meaning of Section 25 TDDDG is accessed, no consent is required.
AI-Powered Chatbot ("Concierge")
On our website, we provide an AI-powered chatbot that visitors can use to ask questions about ART DÜSSELDORF (e.g., regarding opening hours, tickets, the program, or directions). Use of the chatbot is voluntary. When you use the chatbot, the following data is processed: Content of chat inquiries (your text entries) Technically necessary connection data (IP address, timestamp) No user accounts are created, and no specific requests for personal data are made. Please do not enter any sensitive personal data into the chat. To generate responses, we exclusively use the AI language model from Anthropic PBC (San Francisco, USA). Your text inputs are transmitted to Anthropic to generate responses. Anthropic is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses also apply. According to contractual assurances, the transmitted inputs are not used to train the AI models. The chatbot’s editorial knowledge base is hosted by Supabase Inc., with servers located in the EU. Technical operations are handled by our hosting provider Vercel (see Section 6). Legal basis: Art. 6(1)(f) GDPR. Chat content is not stored permanently; processing is session-based. The IP address is used solely on a temporary basis to prevent abuse (rate limiting). You may object to the processing at any time by not using the chatbot.
Newsletter (Double Opt-in)
When you subscribe to our newsletter, we process your email address and the language you have selected. The newsletter is sent via Brevo (Sendinblue GmbH, Cologne / Sendinblue SAS, Paris, EU). Registration is done using the double-opt-in process: You will first receive a confirmation email; your registration will not take effect until you have confirmed it. We track the open and click-through rates of our newsletter to improve its content and timing. This analysis is conducted in a pseudonymized manner by our service provider, Brevo. You may object to this at any time or unsubscribe from the newsletter using the unsubscribe link in every email. Legal basis: Art. 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time using the unsubscribe link in each issue.
Contact / Business Inquiries
If you use our inquiry form ("Business meets Art") or any other contact option, we process the data you provide in order to handle your inquiry. Transmission to our inbox occurs technically via Brevo's transactional email service (EU). Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
Tickets, Exhibitor Application Fees, and Payments
Tickets are sold by vivenu GmbH, Völklinger Straße 33, 40221 Düsseldorf. Payments—for tickets as well as for gallery application fees, including Apple Pay and PayPal—are processed through the payment service provider Stripe (Stripe, Inc., USA / Stripe Payments Europe, Ltd., Ireland). Stripe is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses also apply. We do not collect or store credit card information. Legal basis: Art. 6(1)(b) GDPR.
Exhibitor Application and Exhibitor Portal
The exhibitor portal for applying as an exhibitor will be accessible during the application period from September 1 to October 28, 2026. A separate privacy policy applies to the application process and the use of the exhibitor portal during this period; you can find this policy as part of the application process and within the portal itself.
Content Management System
Editorial content on our website (text, images, magazine, exhibitor directory) is managed via the headless CMS Sanity (Sanity AS, Norway). No personal data of website visitors is processed via the CMS.
Embedded Content
Google Maps: We link to Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to provide directions. The map is not embedded; clicking the link takes you to a different website. No data is transmitted to Google prior to clicking, so no consent is required.
Security Standards
The exchange of personal data between you and our website generally takes place via secure connections that reflect the current state of the art. We do not collect credit card information beyond the one-time transaction processing, without further storage.
Right of Withdrawal, Right of Access & Deletion
Consent to the collection, processing, or use of your data may be withdrawn at any time with future effect. To do so, send an email to dataprotection@art-dus.de. Under Art. 15 GDPR, you may at any time request, free of charge, information about the data stored about you in the form of a written or electronic summary in a portable format. You further have the right to rectification of inaccurate data concerning you, as well as the right to erasure or restriction of processing. You may also object to processing. To exercise these rights, please contact dataprotection@art-dus.de. We delete your data as soon as it is no longer required for the purposes stated above, unless a statutory retention period requires otherwise.
Right to Lodge a Complaint
Under Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data does not comply with applicable law. State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia Kavalleriestr. 2-4, 40213 Düsseldorf, Germany www.ldi.nrw.de
Overview of Services Used
18. Overview of Services Used In connection with the operation of our website, we use the following service providers and data processors: Vercel Inc. (U.S.) provides hosting, a content delivery network, and web analytics for our website. Server functions are configured for the Frankfurt region in the EU; data transfers to the U.S. are based on the EU-U.S. Data Privacy Framework and, additionally, the EU Standard Contractual Clauses. The legal basis for processing is Article 6(1)(f) of the GDPR. Anthropic PBC (U.S.) provides the AI language model for our chatbot. Data transfers are based on the EU-U.S. Data Privacy Framework and, in addition, the EU Standard Contractual Clauses. Legal basis: Article 6(1)(f) of the GDPR. Supabase Inc., with servers located in the EU, provides the editorial knowledge base for the chatbot. Legal basis: Article 6(1)(f) of the GDPR. Brevo (Sendinblue GmbH, Cologne / Sendinblue SAS, Paris, EU) handles the distribution of our newsletter and our transactional emails. Legal basis: Art. 6(1)(a) and (b) of the GDPR. vivenu GmbH (Germany) handles ticket sales for our trade show. Legal basis: Art. 6(1)(b) of the GDPR. Stripe (Stripe, Inc., USA / Stripe Payments Europe, Ltd., Ireland) processes payments for tickets and application fees, including Apple Pay and PayPal. Data is transferred based on the EU-U.S. Data Privacy Framework and, additionally, the EU Standard Contractual Clauses.
Controller
Responsible for the collection, processing and use of your data is art.fair International GmbH Maria-Hilf-Str. 9 50677 Cologne, Germany Phone: +49 221 420 393 0 Fax: +49 221 420 393 29 contact@art-dus.de www.art-dus.de Managing Director: Walter Gehlen Data Protection Officer: Christian Krause, mail@dsb-dus.de
Use, Publication and Disclosure of Personal Data
We collect, process, and use your data only to the extent necessary to enable your use of our website and the services offered on it. As part of providing services to admitted exhibitors, this includes publishing the name of your gallery among the participants on our website. We only disclose the personal data of admitted exhibitors to third parties where necessary for the performance of services related to participation in the fair, e.g. to security personnel commissioned by Art Düsseldorf during set-up and dismantling on the fairgrounds (Areal Böhler, Hansaallee 321, 40549 Düsseldorf, Germany). Third parties engaged by us process your personal data in accordance with these privacy provisions and the GDPR.
Legal Basis
The legal basis for data processing is Art. 6(1)(a), (b), and (f) GDPR. Where processing is based on consent (e.g. newsletter), you may withdraw that consent at any time, informally, by email; the lawfulness of processing carried out before withdrawal remains unaffected. Otherwise, we process data for the performance of a contract (Art. 6(1)(b)) or on the basis of legitimate interest (Art. 6(1)(f)).
Traffic Analysis (Vercel Web Analytics)
For anonymous traffic analysis, we use Vercel Web Analytics. Data is collected without cookies and without creating user profiles; aggregated, anonymized statistics are collected. No identification of individual persons takes place. Legal basis: Art. 6(1)(f) GDPR. As no cookies are set and no terminal equipment information within the meaning of Section 25 TDDDG is accessed, no consent is required.
Newsletter (Double Opt-in)
When you subscribe to our newsletter, we process your email address and the language you have selected. The newsletter is sent via Brevo (Sendinblue GmbH, Cologne / Sendinblue SAS, Paris, EU). Registration is done using the double-opt-in process: You will first receive a confirmation email; your registration will not take effect until you have confirmed it. We track the open and click-through rates of our newsletter to improve its content and timing. This analysis is conducted in a pseudonymized manner by our service provider, Brevo. You may object to this at any time or unsubscribe from the newsletter using the unsubscribe link in every email. Legal basis: Art. 6(1)(a) GDPR. You can unsubscribe from the newsletter at any time using the unsubscribe link in each issue.
Tickets, Exhibitor Application Fees, and Payments
Tickets are sold by vivenu GmbH, Völklinger Straße 33, 40221 Düsseldorf. Payments—for tickets as well as for gallery application fees, including Apple Pay and PayPal—are processed through the payment service provider Stripe (Stripe, Inc., USA / Stripe Payments Europe, Ltd., Ireland). Stripe is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses also apply. We do not collect or store credit card information. Legal basis: Art. 6(1)(b) GDPR.
Content Management System
Editorial content on our website (text, images, magazine, exhibitor directory) is managed via the headless CMS Sanity (Sanity AS, Norway). No personal data of website visitors is processed via the CMS.
Security Standards
The exchange of personal data between you and our website generally takes place via secure connections that reflect the current state of the art. We do not collect credit card information beyond the one-time transaction processing, without further storage.
Right to Lodge a Complaint
Under Art. 77 GDPR, you have the right to lodge a complaint with a supervisory authority if you believe that the processing of your personal data does not comply with applicable law. State Commissioner for Data Protection and Freedom of Information North Rhine-Westphalia Kavalleriestr. 2-4, 40213 Düsseldorf, Germany www.ldi.nrw.de
Personal Data
Personal data is any information relating to an identified or identifiable natural person, e.g. name, address, or email address.
Data Collection
When you access our website, you transmit data to our web server out of technical necessity (see Section 6, Hosting). We additionally collect personal data that you provide as a user when registering for our newsletter, applying for VIP or press accreditation, or submitting contact inquiries, in particular name, postal address, email address, telephone number. For applications to exhibit as a gallery and for use of the Exhibitor Portal, a separate privacy policy applies (see Section 12).
Hosting / Provision of the Website
Our website is hosted by Vercel Inc. (440 N Barranca Ave #4133, Covina, CA 91723, USA). Server functions are configured for the Frankfurt am Main region in the EU; static content is delivered via Vercel’s global content delivery network. Vercel may also process data—for example, in the context of backups or the use of subcontractors—in the United States and other countries where Vercel or its subcontractors operate. When you visit the website, technically necessary connection data (IP address, date/time, requested URL, user agent) is processed to ensure the website is provided securely and reliably. Legal basis: Art. 6(1)(f) GDPR. A data processing agreement (Data Processing Addendum, part of Vercel’s Terms of Service) is in place with Vercel. Vercel is certified under the EU-U.S. Data Privacy Framework; in addition, the EU Standard Contractual Clauses (2021/914) and the UK IDTA apply.
AI-Powered Chatbot ("Concierge")
On our website, we provide an AI-powered chatbot that visitors can use to ask questions about ART DÜSSELDORF (e.g., regarding opening hours, tickets, the program, or directions). Use of the chatbot is voluntary. When you use the chatbot, the following data is processed: Content of chat inquiries (your text entries) Technically necessary connection data (IP address, timestamp) No user accounts are created, and no specific requests for personal data are made. Please do not enter any sensitive personal data into the chat. To generate responses, we exclusively use the AI language model from Anthropic PBC (San Francisco, USA). Your text inputs are transmitted to Anthropic to generate responses. Anthropic is certified under the EU-U.S. Data Privacy Framework; standard contractual clauses also apply. According to contractual assurances, the transmitted inputs are not used to train the AI models. The chatbot’s editorial knowledge base is hosted by Supabase Inc., with servers located in the EU. Technical operations are handled by our hosting provider Vercel (see Section 6). Legal basis: Art. 6(1)(f) GDPR. Chat content is not stored permanently; processing is session-based. The IP address is used solely on a temporary basis to prevent abuse (rate limiting). You may object to the processing at any time by not using the chatbot.
Contact / Business Inquiries
If you use our inquiry form ("Business meets Art") or any other contact option, we process the data you provide in order to handle your inquiry. Transmission to our inbox occurs technically via Brevo's transactional email service (EU). Legal basis: Art. 6(1)(b) GDPR or Art. 6(1)(f) GDPR.
Exhibitor Application and Exhibitor Portal
The exhibitor portal for applying as an exhibitor will be accessible during the application period from September 1 to October 28, 2026. A separate privacy policy applies to the application process and the use of the exhibitor portal during this period; you can find this policy as part of the application process and within the portal itself.
Embedded Content
Google Maps: We link to Google Maps (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) to provide directions. The map is not embedded; clicking the link takes you to a different website. No data is transmitted to Google prior to clicking, so no consent is required.
Right of Withdrawal, Right of Access & Deletion
Consent to the collection, processing, or use of your data may be withdrawn at any time with future effect. To do so, send an email to dataprotection@art-dus.de. Under Art. 15 GDPR, you may at any time request, free of charge, information about the data stored about you in the form of a written or electronic summary in a portable format. You further have the right to rectification of inaccurate data concerning you, as well as the right to erasure or restriction of processing. You may also object to processing. To exercise these rights, please contact dataprotection@art-dus.de. We delete your data as soon as it is no longer required for the purposes stated above, unless a statutory retention period requires otherwise.
Overview of Services Used
18. Overview of Services Used In connection with the operation of our website, we use the following service providers and data processors: Vercel Inc. (U.S.) provides hosting, a content delivery network, and web analytics for our website. Server functions are configured for the Frankfurt region in the EU; data transfers to the U.S. are based on the EU-U.S. Data Privacy Framework and, additionally, the EU Standard Contractual Clauses. The legal basis for processing is Article 6(1)(f) of the GDPR. Anthropic PBC (U.S.) provides the AI language model for our chatbot. Data transfers are based on the EU-U.S. Data Privacy Framework and, in addition, the EU Standard Contractual Clauses. Legal basis: Article 6(1)(f) of the GDPR. Supabase Inc., with servers located in the EU, provides the editorial knowledge base for the chatbot. Legal basis: Article 6(1)(f) of the GDPR. Brevo (Sendinblue GmbH, Cologne / Sendinblue SAS, Paris, EU) handles the distribution of our newsletter and our transactional emails. Legal basis: Art. 6(1)(a) and (b) of the GDPR. vivenu GmbH (Germany) handles ticket sales for our trade show. Legal basis: Art. 6(1)(b) of the GDPR. Stripe (Stripe, Inc., USA / Stripe Payments Europe, Ltd., Ireland) processes payments for tickets and application fees, including Apple Pay and PayPal. Data is transferred based on the EU-U.S. Data Privacy Framework and, additionally, the EU Standard Contractual Clauses.