Privacy Policy — Applicant and Exhibitor Portal
Data Controller
art.fair International GmbH Maria-Hilf-Str. 9 50677 Cologne, Germany Tel.: +49 221 420 393 0 Fax: +49 221 420 393 29 contact@art-dus.de www.art-dus.de Managing Director: Walter Gehlen Data Protection Officer: Christian Krause, mail@dsb-dus.de Contact for data protection inquiries: dataprotection@art-dus.de
What Data Is Processed Through the Application and Exhibitor Portal
In connection with the application and exhibitor portal, the following categories of personal data are processed: access and account data such as gallery name, primary email address, additional activated access addresses, role, preferred language, and invitation code; usage behavior in the form of the time of each login, including role and year, without IP address or browser identifier; gallery and company data such as address, additional locations, phone number, website, year founded, and profiles on Instagram, Facebook, and LinkedIn; contact information for up to five roles per gallery (owner, management, primary contact, press, accounting) including title, first and last name, position, email, and phone number; billing and tax data such as billing address and VAT identification number; data on artists, such as first and last name, year of birth, nationality, place of residence and work, living status or year of death, and Instagram profile; works and content, such as images of works with title, year, dimensions, and photo credit, as well as booth concepts, booth sketches, 3D designs, video links, PDF uploads, and notes; the handwritten signature as an image file with the signatory’s name and timestamp, embedded in the terms and conditions; payment data such as payment status, amount, tax calculation, payment reference, and receipt email, though no card or account information is collected on the portal itself; evaluation data such as jury status, acceptance, waitlist, and rejection; voluntary feedback associated with the logged-in gallery, which also serves as the basis for a raffle; additional exhibitor data such as passport photos for exhibitor badges, orders for furniture and parking passes, and booth details; as well as email addresses unsubscribed as part of the advertising opt-out process, including the time and source of the unsubscription. A significant portion of this data (employees, artists, photo credits) is not provided to us by the data subject themselves, but rather by the gallery. The gallery warrants that it will inform the individuals concerned about this disclosure.
Purposes and Legal Bases
The account and login enable access to the portal and the resumption of a draft that has been started (Art. 6(1)(b) GDPR). The application process, jury selection, and booth allocation serve to carry out the application and admission procedures (Art. 6(1)(b) GDPR). The registration fee, receipt, and accounting serve the purposes of payment processing and statutory record retention (Art. 6(1)(b) and (c) GDPR). Confirmation and status emails serve to acknowledge receipt and to notify applicants of acceptance, placement on the waiting list, or rejection (Art. 6(1)(b) GDPR). Deadline reminders to exhibitors are used to ensure the timely submission of documents (Art. 6(1)(b), or (f) if applicable, of the GDPR). Newsletters and general mailings are used to provide information about the trade show (Art. 6(1)(a) of the GDPR, with the option to opt out at any time). The tracking of email opens and clicks serves to monitor delivery and reach based on legitimate interest (Art. 6(1)(f) GDPR); you may object to this at any time or unsubscribe from the mailings via the unsubscribe link in every email. Login statistics are used to determine whether and how galleries use the portal (Art. 6(1)(f) GDPR). Free-text feedback and the associated prize drawing are used to improve the product and to award a prize (Art. 6(1)(f) GDPR and (a) for the prize drawing). Synchronization with the Insightly CRM system is used to assign users to an already known gallery (Art. 6(1)(f) GDPR). Data on artists is used to evaluate the booth concept, the catalog, and communications (Art. 6(1)(b) and (f) GDPR, plus the obligation to provide information under Art. 14 GDPR).
Recipients and External Service Providers
The following service providers are used in connection with the application and exhibitor portal: Vercel handles the hosting and operation of the application and processes all requests and technical logs; the server functions are configured for the Frankfurt (EU) region, and data transfers are governed by the EU Standard Contractual Clauses and the UK IDTA. Supabase provides the database and file storage and processes all application data, uploads, and signatures; its location is Frankfurt (EU). Stripe handles payment processing and processes email addresses, amounts, reference numbers, and payment methods. Brevo handles access links as well as status and bulk emails, including attachments, and processes email addresses, email content containing the access link, the complete registration PDF, the signed terms and conditions, and open and click statistics. During registration, Insightly compares email addresses, gallery names, and link IDs with its customer database; this involves a transfer to the U.S., secured by Insightly’s certification under the EU-U.S. Data Privacy Framework and supplemented by standard contractual clauses. Pixx.io serves as an image database for artwork images as well as other image and video material; the provider is headquartered in Germany and hosts its servers there, so there is no transfer to a third country. The jury reviews the complete application documents.
Cookies and Local Storage
The portal uses only technically necessary cookies; a consent banner is not required for this. The portal_session cookie maintains the user’s login to the portal for 7 days. The eric_session cookie is used for the team’s login to the trade show backend and is valid for 48 hours. The NEXT_LOCALE cookie stores the selected language until it is overwritten. The cookies “portal_test_now” and “portal_preview_flow” are used for the team’s internal test views and remain valid for 24 hours. A draft of a partially completed application is retained in the browser’s local storage until it is submitted or deleted. Backend settings such as access keys, fair year, and view in the trade show backend remain in local storage until the user logs out.
Retention Periods
Rejected applications are deleted after 12 months. Data belonging to accepted and participating galleries is retained for a further 12 months after the fair. Images of works, booth sketches, and jury uploads are retained for a further 12 months after completion of the selection process. Login and access events are deleted after 90 days. Free-text feedback is deleted 12 months after evaluation. Accounts without a completed application are deleted after 12 months. Statutory commercial and tax retention periods apply independently to signed terms of participation and the application PDF.
Rights of Data Subjects
You may revoke your consent to the collection, processing, or use of your data at any time with future effect. To do so, please send an email to dataprotection@art-dus.de. Pursuant to Article 15 of the GDPR, you may at any time request, free of charge, access to the data we have stored about you. You also have the right to rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and the right to object (Article 21 of the GDPR). To exercise these rights, please also contact dataprotection@art-dus.de. Your data will be deleted as soon as it is no longer necessary for the purposes stated, unless a statutory retention period prevents this. Right to lodge a complaint: Pursuant to Art. 77 of the GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data is not lawful. State Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia Kavalleriestr. 2-4, 40213 Düsseldorf www.ldi.nrw.de Affected Third Parties: Artists, staff members, and photographers whose data is provided to us by the gallery rather than by the individuals themselves are informed about the processing in accordance with Article 14 of the GDPR through this publicly accessible privacy policy.
Automated Decision-Making
Automated decision-making within the meaning of Article 22 of the GDPR does not take place. The selection decision in the application process is made personally by the jury.
What the Portal Does Not Do
The portal does not perform web analytics and does not use tracking pixels on its pages. No external fonts or scripts are embedded; in particular, there is no connection to Google Fonts. The application does not store IP addresses or browser identifiers. Payment data is not collected within the portal itself. Direct external access to the database is not possible.
Changes to This Statement
This statement will be updated if the processing practices change.
Data Controller
art.fair International GmbH Maria-Hilf-Str. 9 50677 Cologne, Germany Tel.: +49 221 420 393 0 Fax: +49 221 420 393 29 contact@art-dus.de www.art-dus.de Managing Director: Walter Gehlen Data Protection Officer: Christian Krause, mail@dsb-dus.de Contact for data protection inquiries: dataprotection@art-dus.de
Purposes and Legal Bases
The account and login enable access to the portal and the resumption of a draft that has been started (Art. 6(1)(b) GDPR). The application process, jury selection, and booth allocation serve to carry out the application and admission procedures (Art. 6(1)(b) GDPR). The registration fee, receipt, and accounting serve the purposes of payment processing and statutory record retention (Art. 6(1)(b) and (c) GDPR). Confirmation and status emails serve to acknowledge receipt and to notify applicants of acceptance, placement on the waiting list, or rejection (Art. 6(1)(b) GDPR). Deadline reminders to exhibitors are used to ensure the timely submission of documents (Art. 6(1)(b), or (f) if applicable, of the GDPR). Newsletters and general mailings are used to provide information about the trade show (Art. 6(1)(a) of the GDPR, with the option to opt out at any time). The tracking of email opens and clicks serves to monitor delivery and reach based on legitimate interest (Art. 6(1)(f) GDPR); you may object to this at any time or unsubscribe from the mailings via the unsubscribe link in every email. Login statistics are used to determine whether and how galleries use the portal (Art. 6(1)(f) GDPR). Free-text feedback and the associated prize drawing are used to improve the product and to award a prize (Art. 6(1)(f) GDPR and (a) for the prize drawing). Synchronization with the Insightly CRM system is used to assign users to an already known gallery (Art. 6(1)(f) GDPR). Data on artists is used to evaluate the booth concept, the catalog, and communications (Art. 6(1)(b) and (f) GDPR, plus the obligation to provide information under Art. 14 GDPR).
Cookies and Local Storage
The portal uses only technically necessary cookies; a consent banner is not required for this. The portal_session cookie maintains the user’s login to the portal for 7 days. The eric_session cookie is used for the team’s login to the trade show backend and is valid for 48 hours. The NEXT_LOCALE cookie stores the selected language until it is overwritten. The cookies “portal_test_now” and “portal_preview_flow” are used for the team’s internal test views and remain valid for 24 hours. A draft of a partially completed application is retained in the browser’s local storage until it is submitted or deleted. Backend settings such as access keys, fair year, and view in the trade show backend remain in local storage until the user logs out.
Rights of Data Subjects
You may revoke your consent to the collection, processing, or use of your data at any time with future effect. To do so, please send an email to dataprotection@art-dus.de. Pursuant to Article 15 of the GDPR, you may at any time request, free of charge, access to the data we have stored about you. You also have the right to rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), data portability (Article 20), and the right to object (Article 21 of the GDPR). To exercise these rights, please also contact dataprotection@art-dus.de. Your data will be deleted as soon as it is no longer necessary for the purposes stated, unless a statutory retention period prevents this. Right to lodge a complaint: Pursuant to Art. 77 of the GDPR, you have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data is not lawful. State Commissioner for Data Protection and Freedom of Information, North Rhine-Westphalia Kavalleriestr. 2-4, 40213 Düsseldorf www.ldi.nrw.de Affected Third Parties: Artists, staff members, and photographers whose data is provided to us by the gallery rather than by the individuals themselves are informed about the processing in accordance with Article 14 of the GDPR through this publicly accessible privacy policy.
What the Portal Does Not Do
The portal does not perform web analytics and does not use tracking pixels on its pages. No external fonts or scripts are embedded; in particular, there is no connection to Google Fonts. The application does not store IP addresses or browser identifiers. Payment data is not collected within the portal itself. Direct external access to the database is not possible.
What Data Is Processed Through the Application and Exhibitor Portal
In connection with the application and exhibitor portal, the following categories of personal data are processed: access and account data such as gallery name, primary email address, additional activated access addresses, role, preferred language, and invitation code; usage behavior in the form of the time of each login, including role and year, without IP address or browser identifier; gallery and company data such as address, additional locations, phone number, website, year founded, and profiles on Instagram, Facebook, and LinkedIn; contact information for up to five roles per gallery (owner, management, primary contact, press, accounting) including title, first and last name, position, email, and phone number; billing and tax data such as billing address and VAT identification number; data on artists, such as first and last name, year of birth, nationality, place of residence and work, living status or year of death, and Instagram profile; works and content, such as images of works with title, year, dimensions, and photo credit, as well as booth concepts, booth sketches, 3D designs, video links, PDF uploads, and notes; the handwritten signature as an image file with the signatory’s name and timestamp, embedded in the terms and conditions; payment data such as payment status, amount, tax calculation, payment reference, and receipt email, though no card or account information is collected on the portal itself; evaluation data such as jury status, acceptance, waitlist, and rejection; voluntary feedback associated with the logged-in gallery, which also serves as the basis for a raffle; additional exhibitor data such as passport photos for exhibitor badges, orders for furniture and parking passes, and booth details; as well as email addresses unsubscribed as part of the advertising opt-out process, including the time and source of the unsubscription. A significant portion of this data (employees, artists, photo credits) is not provided to us by the data subject themselves, but rather by the gallery. The gallery warrants that it will inform the individuals concerned about this disclosure.
Recipients and External Service Providers
The following service providers are used in connection with the application and exhibitor portal: Vercel handles the hosting and operation of the application and processes all requests and technical logs; the server functions are configured for the Frankfurt (EU) region, and data transfers are governed by the EU Standard Contractual Clauses and the UK IDTA. Supabase provides the database and file storage and processes all application data, uploads, and signatures; its location is Frankfurt (EU). Stripe handles payment processing and processes email addresses, amounts, reference numbers, and payment methods. Brevo handles access links as well as status and bulk emails, including attachments, and processes email addresses, email content containing the access link, the complete registration PDF, the signed terms and conditions, and open and click statistics. During registration, Insightly compares email addresses, gallery names, and link IDs with its customer database; this involves a transfer to the U.S., secured by Insightly’s certification under the EU-U.S. Data Privacy Framework and supplemented by standard contractual clauses. Pixx.io serves as an image database for artwork images as well as other image and video material; the provider is headquartered in Germany and hosts its servers there, so there is no transfer to a third country. The jury reviews the complete application documents.
Retention Periods
Rejected applications are deleted after 12 months. Data belonging to accepted and participating galleries is retained for a further 12 months after the fair. Images of works, booth sketches, and jury uploads are retained for a further 12 months after completion of the selection process. Login and access events are deleted after 90 days. Free-text feedback is deleted 12 months after evaluation. Accounts without a completed application are deleted after 12 months. Statutory commercial and tax retention periods apply independently to signed terms of participation and the application PDF.
Automated Decision-Making
Automated decision-making within the meaning of Article 22 of the GDPR does not take place. The selection decision in the application process is made personally by the jury.
Changes to This Statement
This statement will be updated if the processing practices change.