Privacy notice
Version:
This notice explains what personal data we process when you use Vernissaria (the public portal) and ArtiFolio (the app for artisans and organizers), why, on what legal basis, for how long, who receives it and what rights you have. The Romanian version prevails.
1. Who we are
The controller is Digital Travel Guide S.R.L., registered office 300096 Timișoara, str. Timocului nr. 17, bl. T10, ap. 7, Romania, Trade Register no. J35/1676/2019, VAT code RO40928916 ("we").
For any question or request about your data, write to privacy@vernissaria.com. We have not designated a data protection officer; requests are handled directly by our team.
2. Visitors of Vernissaria
When you visit Vernissaria, the server receives your IP address, browser type and the requested page. We use them to show pages and for security. Legal basis: our legitimate interest in running a secure site (Art. 6(1)(f) GDPR).
We measure visits with Matomo, hosted by us, without analytics cookies and without tracking you on other sites. Statistics are aggregated. Legal basis: our legitimate interest in understanding how the site is used.
When you scan a QR code on a label, our QR code service counts the scan and redirects you to the artwork's page. Organizers and artisans see only scan counts, not information about people.
3. Buyers and people who send inquiries
When you reserve a work or send an artisan a question, we process your name, email, message, the work concerned and when you accepted the terms. The form uses Cloudflare Turnstile to stop spam, which analyses technical browser signals.
We pass your request on to the artisan, who is the seller. The artisan uses your data as a separate controller, only to answer you and to complete and deliver the sale. Event organizers never receive your data.
Legal basis: steps before a contract at your request (Art. 6(1)(b)), and our legitimate interest in preventing abuse (Art. 6(1)(f)).
4. Artisans
Application: your name, email, description of your work, website, number of works, IP address and acceptance of the terms. We use them to assess the application and prevent abuse.
Account and catalogue: your name, email, profile and the contact details you publish, your works, images, prices, exhibitions, the reservations you receive and the sales you record. What you publish is shown on Vernissaria.
Sign-in: the email we send the sign-in link to, and the IP address and browser used to sign in, for account security.
Pro subscription: payment is processed by Stripe; we receive only the subscription status and a customer identifier, never card details. For the student plan we verify your institutional email address.
Writing assistant: when you ask for a title or description suggestion, we send the artwork's image and details to the AI provider. The default provider is Mistral AI (France, EU). If you choose another provider in your account, the image and details go to that provider (Google, OpenAI or Anthropic, based in the USA). We send no other personal data.
WordPress sync: if you turn it on, we send your published works to your own site on your instruction; access details are stored encrypted.
Legal basis: performance of our contract with you (Art. 6(1)(b)), legal tax and accounting obligations (Art. 6(1)(c)) and our legitimate interest in security and preventing abuse (Art. 6(1)(f)).
5. Organizers (galleries, fairs, museums, cultural centres, curators)
Applications. When you apply for an organizer account, we process the organization's details and your name, role and email, the date of your acceptance of the Organizer Terms and your IP address. We use them to assess and verify the application (we may check the organization's website, social media and public registers), to contact you about it and to prevent fraud and impersonation. Legal basis: steps before a contract at your request (Art. 6(1)(b) GDPR) if you apply in your own name; otherwise our legitimate interest in assessing applications from organizations and preventing abuse (Art. 6(1)(f)).
Organizer accounts. For members of an organizer account we process name, email, role, sign-ins and actions taken in the account (an audit log). Legal basis: performance of the contract with the organizer, and our legitimate interest in security and accountability.
Event participation. When an artisan takes part in an organizer's event, we show the organizer the information the artisan has chosen to share in the sharing settings (for example inquiry counts or sales recorded on that exhibition), together with the agreement terms they confirmed and the artisan's contact email. We do this because the artisan instructs us to as part of the ArtiFolio service (Art. 6(1)(b)). The organizer then uses that information as a separate controller, under its own responsibility, for running the event and its agreement with the artisan. Buyers' personal data is never shown to organizers.
Event pages and statistics. Statistics shown to organizers are counts (for example inquiries per work or QR scans), not information about individual visitors.
6. People invited to events
If an organizer invites you by email to take part in an event, we receive your email address from that organizer and use it only to send the invitation and at most two reminders. If you do not accept, we delete your address 90 days after the invitation expires, is declined or is revoked. Each invitation contains a link to stop further invitations; we then keep a coded (hashed) version of your address only to respect that request.
Legal basis: the legitimate interest of the organizer and ours in inviting artisans to events, with your right to object at any time through the link in the email.
7. Who receives the data
We do not sell personal data and do not use it for advertising.
Data goes to: artisans (buyers' requests addressed to them), organizers (only what artisans share, see section 5), the providers listed below, and authorities where the law requires.
Service providers that process data for us
These providers process data only on our instructions, under data processing agreements:
- netcup GmbH — hosting of the server, database and images (Germany (EU))
- Backblaze, Inc. — encrypted backups of the database and images (EU data centre)
- Resend (Plus Five Five, Inc.) — sending emails (sign-in, notifications, buyer inquiries) (USA)
- Stripe Payments Europe, Ltd. — payment of Pro subscriptions (Ireland (EU); Stripe may transfer data to the USA)
- Cloudflare, Inc. (Turnstile) — anti-spam check of the reservation and inquiry form (USA and global network)
- Mistral AI SAS — the ArtiFolio writing assistant (default provider): receives the artwork image and details when the artisan asks for a suggestion (France (EU))
- Matomo (găzduit de noi pe serverul nostru) — visit statistics, without cookies (Germany (EU))
- Serviciul de coduri QR Vernissaria (vernissaria.qraft.link, operat de noi) — generating QR codes and counting scans (EU)
8. Transfers outside the European Economic Area
Some providers are in the USA or may access data from the USA. These transfers rely on the EU–US adequacy decision (Data Privacy Framework) for certified providers, or on the standard contractual clauses approved by the European Commission. You can ask us for a copy of the safeguards at privacy@vernissaria.com.
9. How long we keep data
- Artisan account and catalogue: while the account exists; after closure we delete the data, except what the law requires us to keep (for example tax and accounting records, usually 5 years).
- Artisan applications: rejected ones for 12 months after the decision; IP addresses for 12 months.
- Sign-in links: 30 days; session data (IP, browser): up to 30 days after the session expires.
- Buyers' requests and inquiries: in the artisan's account while it exists, as a record of the sale; at most 3 years after the request, after which we anonymise them.
- Organizer applications: rejected ones for 12 months (up to 36 months if we suspect impersonation or fraud); approved ones while the account exists plus 3 years; IP addresses for 12 months.
- Organizer audit log: 3 years.
- Event claims: rejected ones for 12 months; confirmed ones while the event exists plus 3 years.
- Emails in invitations that were not accepted: 90 days after expiry, decline or revocation. The "don't send me invitations" list (hash only): as long as the request applies.
- Participation data seen by the organizer: while the participation is active and for 12 months after it ends (for settlement); the participation history (name, contact email, works, no payment data) stays visible to the organizer until the artisan closes the account.
- Backups: rotated automatically; deleted data disappears from them within 30 days at most.
11. Your rights
You have the right to ask for access to your data, its rectification, erasure or restriction, to receive it in a portable format and to object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time.
Write to privacy@vernissaria.com; we answer within one month. You also have the right to lodge a complaint with the Romanian supervisory authority, ANSPDCP (www.dataprotection.ro), or with the authority in your country.
We make no decisions based solely on automated processing that have legal effects on you. Some changes between artisan account standing tiers are automatic and can be appealed under the dispute policy.
12. Security
We use encrypted connections, password-free sign-in by link, database-level separation of each artisan's and organizer's data, encrypted backups and limited staff access. If a personal-data breach may affect you, we tell you and ANSPDCP as the law requires.
13. Changes
When we change this notice, we update the version at the top. We tell account holders about important changes by email or in ArtiFolio.