privacy policy the ART
clear about data. no legal jargon.
| data controller: Hi DESIGN Sebastian Siwy, 21 różana st., 55-010 Radomierzyce, tax ID (NIP): 8941704766 contact regarding privacy matters: lp.tra-eht@nimda |
this policy describes how the ART processes the personal data of individuals using the service, including artists, art galleries, collectors, interior designers, buyers, and website visitors. this document covers data processed in connection with accounts, public profiles, reservations, purchases, payments, communications, and use of the website.
the ART is a brand operated by Hi DESIGN Sebastian Siwy. under the GDPR, Hi DESIGN Sebastian Siwy is the controller of personal data. address lp.tra-eht@nimda is used to contact the administrator regarding personal data matters.
1. who is responsible for your data?
the controller of the personal data processed on the website the ART Hi DESIGN Sebastian Siwy, 21 różana st., 55-010 Radomierzyce, tax ID (NIP): 8941704766.
for matters related to privacy, the exercise of rights under the GDPR, or data security, please contact us at: lp.tra-eht@nimda.
2. what data may be processed?
2.1. account and login
- email address, account ID, encrypted authentication information, and technical data related to logging in;
- selected account type and role on the platform, e.g., artist, art gallery, collector, or architect;
- information about account status, completion of onboarding, plans, or access to website features.
2.2. artist and art gallery profiles
if you are creating a profile for an artist or gallery, the ART may process the data provided during onboarding and subsequent profile editing, specifically:
- first and last name, artist name, or gallery name;
- description, biography, information about the company’s activities, and the artists it represents;
- logo, profile photo, main photo, visual materials, and information about the artworks;
- contact information provided for publication or for contact within the service;
- website address and links to social media profiles;
- information about the plan, publication limits, and sales status.
data intended to build a public profile, in accordance with the website’s function, is published in the ART. they may be available to other users, website visitors, and search engines.
2.3. collector and interior designer
for collector and architect accounts the ART may process identification and contact information, account data, information related to reservations, purchases, saved works, communications, and the use of features intended for a specific role.
2.4. reservations and communication between users
regarding the reservation of a work of art the ART may process data necessary for its creation and operation, including the user’s ID, contact information, information about the artwork, the date and status of the reservation, and the history of activities related to the reservation. if necessary for further communication or to fulfill arrangements, the relevant data may be shared with the artist or gallery associated with the reservation.
2.5. purchases, payments, and settlements
for purchases made through the ART data necessary for placing and processing orders, payments, commission settlements, deliveries, complaints, returns, or disputes may be processed, including, in particular, buyer data, order data, billing data, payment information, and transaction statuses.
full payment card details are not stored by the ART. payments and certain verification processes are handled by specialized payment providers, specifically Stripe. for sellers using Stripe express, the information required to verify their identity or business is submitted directly to Stripe in accordance with its kyc/kyb procedures.
2.6. technical specifications and security
while using the website, technical data such as your ip address, device and browser information, timestamps, session data, security logs, error information, and data necessary to protect against spam, abuse, and unauthorized access.
2.7. communication
if you are contacting the artwhen you submit a form, reply to a message, or use account management features, the data contained in the correspondence and the information needed to respond and maintain service continuity are processed.
3. why? the ART processes data and on what basis
3.1. account management and service provision
data is processed for the purposes of creating and maintaining an account, completing the onboarding process, providing role-specific features, managing a profile, publishing works, handling reservations, and providing services the ART. the legal basis is article 6(1)(b) of the GDPR—performance of a contract or taking steps prior to entering into a contract.
3.2. orders, payments, and billing
data is processed for the purposes of handling sales, payments, commissions, returns, complaints, disputes, and settlements related to the transaction. the legal basis is article 6(1)(b) of the GDPR, and with regard to tax, accounting, or other statutory obligations, also article 6(1)(c) of the GDPR.
3.3. security and protection against abuse
the ART may process data to secure accounts, detect abuse, spam, and fraud attempts, ensure the stability of the service, establish and defend claims, and maintain necessary technical logs. the legal basis is article 6(1)(f) of the GDPR—the controller’s legitimate interest in protecting the platform, its users, and its operations.
3.4. communication and handling of inquiries
the data provided in correspondence is processed for the purpose of responding to a question, handling a request, or performing an action related to your account. the legal basis is, as applicable, article 6(1)(b) or (f) of the GDPR.
3.5. marketing and optional communication
if the ART it conducts marketing communications that require consent; data is processed on the basis of the consent provided—article 6(1)(a) of the GDPR—and in accordance with the relevant regulations governing electronic communications. consent may be withdrawn at any time, without affecting the lawfulness of actions taken prior to its withdrawal.
3.6. analytics and website development
to the extent that analytics require consent for cookies or similar technologies, they are conducted after consent is obtained. in all other cases, data may be used in an aggregated form or as technically necessary to evaluate the website’s performance and its development.
4. the public nature of profiles and content
the ART is a platform for showcasing art, artists, and galleries. some of the information provided by the artist or gallery is, by design, public. this applies in particular to the profile name, biography or description, photos, information about works, selected contact details, website, and social media links, if the user has chosen to publish them or if they are part of the profile’s public features.
public content may be indexed by search engines, cached, or shared by other users. once content is removed from the ART copies of this content may remain available for some time beyond the administrator’s control, such as in search results or external archives.
5. to whom the data may be disclosed
data may be shared only to the extent necessary for operations the ART, the provision of services, or the fulfillment of legal obligations. recipients may include, in particular:
- providers of hosting, server infrastructure, backup, and security services;
- email and communication tool providers, including google workspace;
- payment and settlement providers, in particular Stripe and the Stripe connect / Stripe express services;
- providers of analytics, anti-spam, and fraud prevention tools, if they are active and used in accordance with consent settings;
- technical service providers supporting the operation of WordPress, WooCommerce, and the marketplace infrastructure, to the extent that they have access to data;
- accounting firms, legal advisors, auditors, or other entities assisting the administrator, if necessary;
- providers of sms communication services and telecommunications infrastructure, in particular twilio and operators involved in message delivery, to the extent necessary to carry out operational notifications;
- public authorities, if the obligation to provide the data is required by law.
in the case of a reservation or transaction, the relevant data may be transferred to the other party involved—e.g., the artist, gallery, or buyer—to the extent necessary for contact, fulfillment of the reservation, sale, delivery, complaints, or billing. if such a party uses the data it receives for its own purposes and based on its own obligations, it may act as a separate data controller.
6. Stripe and marketplace payments
the ART uses Stripe’s infrastructure to handle payments and operate its marketplace model. for art galleries, online sales may require linking an account to Stripe express. the seller verification process is conducted within the Stripe environment and may require the submission of personal information, business details, banking information, and documents required by financial regulations and security procedures.
the ART receives only the information and statuses necessary for the platform to operate and to settle transactions. the scope of data visible to the ART may be smaller than the scope of data provided directly to Stripe during verification.
Stripe may act as an independent data controller with respect to its own legal, regulatory, fraud prevention, aml/kyc/kyb, billing, and security obligations. the specific terms governing Stripe’s processing are set forth in Stripe’s documentation and policies presented to the user during the course of using its services.
7. transfer of data outside the European Economic Area
some technology providers used by the ART they operate globally. as a result, data may be processed outside the European Economic Area. in such cases, the transfer is carried out using the mechanisms provided for by the GDPR, in particular adequacy decisions, standard contractual clauses, or other legally permissible safeguards, depending on the provider and the location of processing.
8. cookies and similar technologies
the ART uses cookies and similar technologies necessary for the website to function, for security, to maintain sessions, to manage accounts, and to remember selected settings. essential cookies may be used without consent to the extent permitted by law.
analytics, marketing, or other optional cookies and technologies are enabled in accordance with the user’s consent settings. consent can be managed using the tool available on the website. withdrawing consent does not affect the lawfulness of processing carried out prior to its withdrawal.
a detailed list of active cookies, their providers, and their expiration dates may be displayed in the consent management panel or in a separate cookie policy, if one is available on the website.
9. how long is the data retained?
data is retained no longer than is necessary for the purpose for which it was collected, unless regulations require a longer retention period. in practice:
- account and profile data—for the duration of your use of the account, and after its termination, for the period necessary to resolve outstanding matters, safeguard claims, and fulfill legal obligations;
- order, payment, and billing data—for the period required by tax and accounting regulations, and for the time needed to handle claims, refunds, and disputes;
- reservation and correspondence data—for the period necessary to handle the matter, and thereafter until the statute of limitations for any potential claims expires, or for a shorter period if the data is no longer needed;
- data processed based on consent—until consent is withdrawn, unless there is another legal basis for continued processing;
- security logs and technical data—for a period justified by security, diagnostics, fraud prevention, and the protection of claims.
10. your rights
depending on the legal basis and circumstances of the processing, you have rights under the GDPR, in particular:
- the right to access data and obtain copies of it;
- the right to correct data;
- the right to request the deletion of data, provided the conditions set forth by law are met;
- the right to request restriction of processing;
- the right to data portability when processing is based on consent or a contract and is carried out by automated means;
- the right to object to processing based on the controller’s legitimate interests;
- the right to withdraw consent at any time when processing is based on consent;
- the right to file a complaint with the president of the office for personal data protection.
to exercise your rights, please write to lp.tra-eht@nimda. for security reasons, the administrator may request information to verify the identity of the person making the request. the scope of a specific right depends on the legal basis and the circumstances of the processing.
11. is providing this information required?
providing your information is voluntary, but some information is required to create an account, complete a transaction, make a reservation, make a purchase, receive payment, or perform other functions. the ART. if the data required for a specific service is missing, it may prevent the service from being provided.
for public profile information, the user decides on the content within the scope provided by the website’s forms and features, although some elements may be required to publish a complete profile.
12. automated decisions and profiling
the ART it does not make decisions regarding users that have legal effects or similarly significantly affect them based solely on automated processing, unless it explicitly informs users of such a mechanism in the future and provides the guarantees required by law.
payment, security, or fraud prevention providers may use their own automated risk assessment, fraud detection, or verification systems as part of the services they provide and in accordance with their own legal obligations.
13. data security
the ART it employs technical and organizational measures appropriate to the nature of the data being processed and the risks involved, including access control, authentication, encrypted connections, backups, security updates, anti-spam mechanisms, and restricting access to data to individuals and entities who need it to perform their duties.
no system can guarantee complete risk-free operation. if a data breach occurs, the controller will take the actions required by law, including—where necessary—reporting the breach to the supervisory authority and notifying the data subjects.
14. other people’s data
if you are translating the ART if you are sharing another person’s data, you must have a valid reason for doing so and—if required—notify that person of the data transfer. do not share the data of third parties whose the ART it does not require a specific function or request to be carried out.
15. changes to the privacy policy
this policy may be updated as features change the ART, technologies used, service providers, or legal provisions. the current version will be published on the website along with the date of the last update. if a change is significant from the users’ perspective, the ART may also announce it on the website or via email.
16. contact
for matters regarding privacy and personal data, please contact the data controller:
Hi DESIGN Sebastian Siwy
21 różana street
55-010 Radomierzyce
tax ID: 8941704766
last updated: september 3, 2026