Privacy Policy
Privacy Policy
Last updated 21 September 2026
1. Introduction and scope
1.1 Art-WOD BV (Artwod, we, us or our) operates the Artwod learning platform for visual artists. This privacy policy (the Policy) explains how we process personal data in connection with the website www.artwod.com, the Artwod mobile application, the Online Video Library, the Feedback Tool, the community functionality, our e-mail and support communication, our marketing activities and any other service we make available (together, the “Platform”).
1.2 This Policy covers all interactions with Artwod, whether or not you have an account, and whether the interaction takes place on the Platform, by e-mail, through a third-party community server, through an app store or through a promotional partner. Any suggestion in an earlier version of this policy that it applies only to online activities on the website no longer applies.
1.3 Terms defined in Regulation (EU) 2016/679 (the “GDPR”) have the meaning given to them in that Regulation. Terms defined in the Artwod terms of service have the meaning given to them there.
1.4 This Policy forms an integral part of the Artwod terms of service. Where the terms of service and this Policy conflict in respect of the processing of personal data, this Policy prevails.
2. Who is responsible for your personal data
2.1 The controller is Art-WOD BV, a private limited company incorporated under Belgian law, registered with the Belgian Crossroads Bank for Enterprises under company number 0760.835.138. Our registered office and postal address are available in our Legal Notice and Terms of Service.
2.2 You can reach us as follows:
General contact and privacy requests
Data protection officer
Artwod has not appointed a data protection officer. Artwod has assessed that it is not required to do so under Article 37 GDPR. The contact above is the point of contact for all matters covered by this Policy.
Postal address
Stated in the Legal Notice on the Platform and in the Belgian Crossroads Bank for Enterprises
2.3 Where you process the personal data of other users outside the Platform, you act as a controller in your own right and this Policy does not apply to that processing.
2.4 Where a Creator sells its own content through the Platform, Artwod and the Creator each act as a controller for their own processing. The Creator is responsible for its own communication with buyers.
3. Categories of personal data we process
3.1 Depending on how you use the Platform, we process the following categories of personal data:
- Identification and contact data: name, username, e-mail address, telephone number where you provide it, country, language, and the profile picture and profile text you choose.
- Account data: account identifier, authentication data, the identity provider used where you sign in through a third party, membership tier, account status and the version of the terms you accepted and when.
- Content you create: artwork and other images you upload, feedback requests, written feedback, paint-overs, comments, replies, likes, progress records, before and after comparisons, and messages you send through the Platform.
- Learning and onboarding data: your answers to onboarding questions, your stated goals and interests, the courses, learning roads, workouts and exercises you start, complete or abandon, your practice history and your self-assessments.
- Behavioural and event data: pages and screens viewed, features used, session duration and frequency, clicks and scroll behaviour, search queries within the Platform, device type, operating system, browser, application version, IP address, approximate location derived from IP address, and cookie and other identifiers.
- Inferred data: your assumed reason for using Artwod, your assumed skill level, recurring weaknesses identified in your work, artistic interests, the cohort or segment you are placed in, the stage of your learning journey, and the recommendations generated for you. Article 6 sets out how we treat this category.
- Transaction data: membership and other purchases, prices, currency, invoices, payment method type, the last four digits of a payment card where our payment provider makes that available, refunds, chargebacks and, for Creators, payout data including bank details and tax identifiers.
- Support and moderation data: your support and complaint correspondence, notices you submit or that concern you, moderation decisions and their reasons, and appeals.
- Marketing and attribution data: whether you opened an e-mail or clicked a link, your subscription and objection status, the campaign or channel through which you reached Artwod, and conversion events.
3.2 We do not ask you for special categories of personal data within the meaning of Article 9 GDPR, and we ask you not to provide them. We do not seek to infer health data, religious or philosophical beliefs, political opinions, sexual orientation or any other special category from the subject matter or the style of your artwork, and we have instructed our providers accordingly.
3.3 We do not process criminal-offence data other than what is strictly necessary to handle a notice or a report to a competent authority under our child safety policy or our moderation procedure.
4. Purposes, legal bases and retention
4.1 This Article sets out, for each processing activity, the personal data concerned, the purposes, the legal basis under Article 6 GDPR and the applicable retention period or retention criteria. The purposes are assessed separately: analysing your own activity in order to recommend your next exercise is not the same purpose as analysing the activity of all users in order to decide which courses to produce, and neither is the same purpose as advertising Artwod on third-party platforms.
4.2 Creating and managing your account
Personal data
Identification and contact data, account data.
Purposes
Creating and securing your account, authenticating you, providing customer support, keeping a record of which version of the terms you accepted.
Legal basis
Performance of the contract with you (Article 6(1)(b) GDPR). For the record of acceptance, our legitimate interest in being able to demonstrate the contractual relationship (Article 6(1)(f) GDPR).
Retention
For the duration of the account. After the account is deleted or becomes inactive, the associated personal data is deleted or anonymised in accordance with Section 12. Records of acceptance of the terms: 5 years after deletion of the account.
4.3 Providing the Platform and the learning functionality
Personal data
Account data, content you create, learning and onboarding data, behavioural and event data.
Purposes
Making the Content available, tracking your progress, operating the Feedback Tool, operating community functionality, delivering the functionalities of your membership tier.
Legal basis
Performance of the contract with you (Article 6(1)(b) GDPR).
Retention
For the duration of the account. Progress and practice history: 24 months after the last activity, unless you delete it earlier.
4.4 Personalising your own learning path
Personal data
learning and onboarding data, behavioural and event data, content you create and inferred data, including your stated goals, assumed skill level, learning stage, recurring weaknesses, interests and recommendations.
Purposes
Determining your level, detecting recurring weaknesses in your work, recommending your next exercise, learning road or workout, adapting the interface and the onboarding flow to your assumed goal.
Legal basis
Performance of the contract with you under Article 6(1)(b) GDPR to the extent that the personalisation is an integral and necessary part of the learning functionality you request. Where personalisation is optional or goes beyond what is necessary to provide the requested service, our legitimate interest in providing and improving the learning experience under Article 6(1)(f) GDPR. In the latter case, you may object or opt out as described in Section 6.3.
Retention
Inferred profiles and recommendations are retained for the duration of the account. They are deleted when your account is deleted, subject to Section 12.
4.5 Understanding demand and developing new Content
Personal data
Aggregated and pseudonymised learning, behavioural, inferred and feedback data across users. Inferred data is used in this context only in aggregated or pseudonymised form.
Purposes
Identifying which subjects artists struggle with, which mistakes recur, which content is in demand, and deciding which courses, learning roads, workouts and marketing topics to produce. Anonimyse Personal data for statistics and developing new Content.
Legal basis
Our legitimate interest in developing and improving our educational offering under Article 6(1)(f) GDPR. We use aggregated or pseudonymised data where reasonably practicable, do not use this processing to make decisions about an individual user and do not use inferred data to create or refine an individual profile for advertising.
Retention
Aggregated, pseudonimysed statistics: 36 months. Underlying pseudonymised event data: 24 months.
4.6 Public community content
Personal data
Username, profile data, content you post to the community, likes and replies.
Purposes
Displaying public profiles, public galleries, public feedback requests and community pages, and where the relevant page is indexable, allowing it to be found through search engines.
Legal basis
Performance of the contract, at your request, where you post content to the community (Article 6(1)(b) GDPR). Content posted to the community is public by default, as described in Section 8. Our legitimate interest in operating a community and in the visibility of the Platform (Article 6(1)(f) GDPR).
Retention
For as long as the content remains public. After you make it private or remove it, we remove it from the Platform without undue delay and request de-indexing where relevant. We cannot control copies made by third parties or search engine caches.
4.7 Payments and memberships
Personal data
Identification and contact data, transaction data.
Purposes
Processing your order, taking payment, managing renewals and cancellations, handling refunds and chargebacks, invoicing, accounting and tax compliance, preventing payment fraud.
Legal basis
Performance of the contract (Article 6(1)(b) GDPR). Compliance with our legal obligations, in particular accounting and tax obligations (Article 6(1)(c) GDPR). Our legitimate interest in preventing fraud (Article 6(1)(f) GDPR).
Retention
Invoices and accounting records: 7 years from the end of the financial year concerned, in accordance with Belgian accounting and tax law. Other transaction data: as long as reasonably required.
4.8 Payouts to Creators
Personal data
Identification and contact data, bank details, enterprise or VAT number, payout and sales data.
Purposes
Paying out amounts due to Creators, complying with our obligations in respect of the traceability of traders and with tax and accounting obligations.
Legal basis
Performance of the contract with the Creator (Article 6(1)(b) GDPR). Compliance with our legal obligations (Article 6(1)(c) GDPR).
Retention
For the duration of the Creator relationship and 7 years thereafter for accounting and tax purposes.
4.9 Service communication
Personal data
Identification and contact data, account data, learning data.
Purposes
Sending communication that is necessary for the service, including confirmations, invoices, security notices, renewal reminders, changes to the terms or to this Policy, and notices about your account or your content.
Legal basis
Performance of the contract (Article 6(1)(b) GDPR) and compliance with our legal obligations (Article 6(1)(c) GDPR).
Retention
For the duration of the account and 24 months thereafter.
Service communication is not marketing and you cannot unsubscribe from it while you hold an account.
4.10 Marketing communication by e-mail
Personal data
Identification and contact data, marketing and attribution data, and where you have an account, learning and inferred data used to select the content of the message.
Purposes
Sending newsletters, course announcements, offers and re-engagement messages, and measuring whether they are opened and acted upon.
Legal basis
Your consent (Article 6(1)(a) GDPR). For existing customers, our legitimate interest in promoting our own similar services, within the limits of the applicable rules on direct marketing (Article 6(1)(f) GDPR). You may withdraw your consent or object at any time through the unsubscribe link in every message or by contacting us.
Retention
Until you withdraw your consent or object, and 24 months thereafter in order to honour your objection. Objection and suppression records are kept for as long as necessary for that purpose.
4.11 Advertising, audiences and attribution
Personal data
Cookie and advertising identifiers, behavioural and event data, conversion events, and where you have an account, hashed contact data and inferred interests.
Purposes
Advertising Artwod on third-party platforms, creating and excluding audiences, retargeting, building lookalike audiences, and measuring which campaigns lead to registrations and purchases.
Artwod does not display third-party advertising on the Platform and does not sell advertising space. This Section concerns only the advertising of Artwod itself on other platforms.
Legal basis
We use advertising and attribution technologies only in accordance with the cookie notice and the choices you make through the consent management interface. Where your consent is required, we do not place the relevant advertising or attribution technology, upload your personal data to an advertising platform or use your personal data to create or activate an advertising audience before obtaining that consent.
Depending on the specific processing activity and the role of the relevant platform, ARTWOD may act as controller, joint controller or, where applicable, processor. The relevant role, the categories of data involved and the applicable platform-specific information are recorded in our advertising and vendor register and are described in the cookie notice or other notice presented when consent is requested. Where ARTWOD acts as a joint controller, the essence of the arrangement required by Article 26 GDPR is made available through the relevant notice or on request through the contact details in Section 2.2.
We do not rely on legitimate interest as the legal basis for advertising ARTWOD on third-party platforms where consent is required under applicable data protection or electronic communications law.
Retention
Advertising and attribution identifiers: 24 months, or the shorter period stated in the cookie notice. Audience lists shared with an advertising platform: 30 days, unless refreshed.
4.12 Using artwork and feedback in Artwod communication and advertising
Personal data
Artwork, feedback, before and after comparisons, and, only where you have separately consented, your username, a quotation from you or a statement about your progress.
Purposes
Promoting Artwod and the Platform, on the Platform, on our own channels, in press communication and in paid advertising campaigns.
Legal basis
Using artwork and feedback in ARTWOD communication and advertising
We may use artwork, feedback, before-and-after comparisons and related content to operate and promote the Platform where you have made the relevant content public or where the use is otherwise necessary to provide a feature you requested. The copyright and other intellectual-property permissions for that use are described separately in Article 21 of the Terms of Service.
We use your artwork, feedback, username, quotation, testimonial, statement about your progress or statement about your weaknesses in external or paid advertising only where you have given separate, specific consent for that use. You may withdraw that consent at any time through the same or an equally easy mechanism. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
We do not treat the existence or scope of a copyright licence as a substitute for the legal basis required for processing personal data.
Retention
Until you object or withdraw your consent. Creative archives kept as evidence of a campaign: as long as reasonably required for evidence purposes, not used for new communication after an objection.
You may object at any time by e-mail to the address set forth under Section 2.2 and, once that functionality is available, through the settings of your account. Article 21 of the terms of service sets out what we do on receipt of an objection and within which periods.
4.13 Artificial intelligence used in the Platform
Personal data
Artwork, feedback, learning and behavioural data, inferred data.
Purposes
Classifying artwork, analysing feedback, detecting recurring weaknesses, generating learning recommendations, and supporting moderation.
Legal basis
Performance of the contract, where the functionality is part of the service you requested (Article 6(1)(b) GDPR), and our legitimate interest in operating and securing the Platform (Article 6(1)(f) GDPR).
Retention
Inputs and outputs are retained for the periods set out in Articles 4.3 and 4.4. Prompts and outputs held by our providers are retained for no longer than reasonably required and are not used by them to train their models.
We may use automated and artificial-intelligence-enabled tools to provide features that you request or use, including analysing artwork or feedback, generating or organising learning recommendations, supporting moderation, detecting misuse and improving the operation and security of the Platform.
We do not use your artwork, feedback, prompts, outputs or other content containing your personal data to train, fine-tune or improve any artificial-intelligence or machine-learning model, whether developed by ARTWOD or by a provider, except where you have given separate, specific consent for that use. We do not permit our providers to use that content or personal data for training, fine-tuning or model improvement, and our contracts and technical configurations must prohibit and prevent such use.
Processing an input or generating an output for a feature that you request or use is not training, fine-tuning or model improvement for the purposes of this Section. Where an input or output is retained by ARTWOD or a provider, it is retained only for the applicable purpose and period described in this Policy. Provider access is limited to what is necessary to provide the relevant service, and providers must apply appropriate confidentiality, security, deletion and non-use safeguards.
Where our processing produces a profile, recommendation or other inference specific to you, it is used only for the purposes described in this Policy and is deleted or anonymised in accordance with Section 12 when your account or the relevant data is deleted. We will not use a future change to the Terms of Service to introduce training or model-improvement use of your artwork or feedback without providing the information and obtaining any consent required by applicable law.
Depending on the functionality, applicable law may require additional user-facing notices, disclosures or controls. We will provide those notices where required.
4.14 Security, fraud and abuse
Personal data
Account data, behavioural and event data, IP address, device identifiers.
Purposes
Detecting and preventing unauthorised access, abuse of free tiers or promotions, payment fraud, scraping and other misuse, and safeguarding the integrity of the Platform.
Legal basis
Our legitimate interest in the security and integrity of the Platform (Article 6(1)(f) GDPR) and compliance with our security obligations under Article 32 GDPR (Article 6(1)(c) GDPR).
Retention
Security logs: 24 months. Records relating to a specific incident: for as long as necessary to handle the incident and to defend a claim.
4.15 Support, complaints and disputes
Personal data
Identification and contact data, support and moderation data, transaction data.
Purposes
Answering questions, handling complaints, and establishing, exercising or defending legal claims.
Legal basis
Performance of the contract (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c) GDPR) and our legitimate interest in defending our rights (Article 6(1)(f) GDPR).
Retention
24 months from the closure of the file, or for the duration of the applicable limitation period where a claim is reasonably foreseeable.
4.16 Notices, moderation and child safety
Personal data
Content notified, support and moderation data, account data, and where relevant the identity of the notifying party.
Purposes
Handling notices of unlawful content, taking moderation decisions, giving statements of reasons, handling appeals, cooperating with competent authorities, and applying our child safety policy.
Legal basis
Compliance with our legal obligations under Regulation (EU) 2022/2065 and applicable criminal law (Article 6(1)(c) GDPR), and our legitimate interest in a safe platform (Article 6(1)(f) GDPR). For data relating to a suspected criminal offence, the substantial public interest and the legal obligations that apply to us.
Retention
Moderation files: 24 months from the decision, or longer where necessary for an appeal, a claim or an investigation. Material relating to child sexual abuse is retained only for as long as necessary and lawful in order to transfer it to the competent authorities.
5. Where we obtain your personal data
5.1 We obtain most personal data from you directly, when you register, complete the onboarding, upload artwork, give or request feedback, purchase a membership, or contact us.
5.2 We also obtain personal data:
- from your device and browser, through cookies and similar technologies, in accordance with the cookie notice;
- from an identity provider, where you sign in through a third party, being your name, e-mail address and the identifier that provider gives us;
- from an app store, where you subscribe through that store, being the transaction and subscription status data the store makes available to us, and not your payment details;
- from our payment providers, being the transaction status and the limited card data referred to in Article 3.1;
- from a promotional partner, where you obtain access through a bundled offer, being the validation of your activation code and the limited data necessary to grant access;
- from an advertising platform, in aggregated form, being campaign and conversion statistics; and
- from another user or a third party, where they submit a notice about your content or conduct.
5.3 Where we obtain personal data other than from you, we inform you of the source, the categories, the purposes and the legal basis in accordance with Article 14 GDPR, at the latest within one month or at the moment of the first communication with you.
6. Inferred data and profiling
6.1 We generate inferred data about you, as described in Article 3.1. Inferred data about an identifiable person is personal data, and generating it is profiling within the meaning of Article 4(4) GDPR. You therefore have the same rights in respect of inferred data as in respect of the data you provided to us, including the right of access, the right to rectification and the right to object.
6.2 We generate and use inferred data only for the specific purposes described in Sections 4.4, 4.5 and 4.11. The applicable legal basis depends on the relevant purpose: Article 6(1)(b) GDPR where the processing is necessary to provide an integral learning functionality; Article 6(1)(f) GDPR where the processing is optional personalisation or product development based on our legitimate interest; and Article 6(1)(a) GDPR where the processing forms part of consent-based advertising or attribution. We do not treat inferred data as a single-purpose category.
6.3 Where inferred data is used for optional personalisation on the basis of our legitimate interest, you may object or opt out at any time through the functionality made available in the Platform or by contacting us through Section 2.2. Where the processing is based on consent, you may withdraw your consent at any time. Where personalisation is necessary to provide a functionality that you requested and is based on Article 6(1)(b) GDPR, an objection does not require us to stop the processing where doing so would prevent us from providing that functionality; where reasonably practicable, we will identify the consequences and offer a non-personalised alternative.
6.4 We may correct an inference we have drawn about you where you tell us it is inaccurate. We recognise that an assessment of your skill level or of a recurring weakness in your work is an opinion generated by our systems rather than a verified fact, and we do not present it as a verified fact.
7. Automated decision-making
7.1 We do not take decisions based solely on automated processing that produce legal effects concerning you or that otherwise significantly affect you within the meaning of Article 22 GDPR. Learning recommendations, the selection of a next exercise and the segment you are placed in do not, in our assessment, significantly affect you in that sense.
7.2 Automated tools may detect, classify, rank, restrict or temporarily disable content, accounts or functionality under our moderation, security and abuse-prevention procedures. We do not rely solely on automated processing to take a decision that produces legal effects concerning you or similarly significantly affects you, unless the conditions and safeguards of Article 22 GDPR and any other applicable law are satisfied. Where required by applicable law or our applicable platform rules, you may request an explanation, human review or appeal of an automated or automatedly assisted measure.
7.3 If we ever introduce processing that falls within Article 22(1) GDPR, we will update this Policy in advance and rely on an appropriate basis under Article 22(2) GDPR, with the safeguards that provision requires.
8. Public content, visibility and search engines
8.1 The Platform distinguishes two categories of content. Content you create in your learning path, including assignments and exercises, is private by default and visible only in your account unless you choose to share it. Content you post to the community, including a gallery item, a public feedback request or a community post, is public by default: it is visible to other users and to anyone on the internet, and the relevant page may be indexed by search engines. The Platform states clearly, at the moment you post, which of the two categories applies, and the setting is reversible at any time.
8.2 You may set your gallery, or individual items, to private at any time, in which case the content is removed from the public pages of the Platform.
8.3 Content you make public can be seen, copied and shared by anyone with access to that page. Consider carefully what you make public, in particular where your artwork contains personal information, a signature or an identifiable person.
8.4 You may make content private or remove it at any time. We remove it from the Platform without undue delay. At your request we will ask the relevant search engines to de-index the page. We cannot remove copies that third parties have already made.
8.5 For a user whom we know to be under 18, community content is private by default and the relevant pages are not made available for indexing by search engines. Such a user may choose to make content visible within the Platform.
8.6 We may use public community pages to improve the visibility of the Platform in search engines. We do not create a public page containing your content unless you have posted that content to the community or otherwise chosen to make it public.
9. Children and young users
9.1 The Platform is intended for persons of 14 years of age or older. Users under 18 may only use the Platform with the consent of the holder of parental responsibility, and paid memberships and Creator status are reserved to persons of 18 or older. We ask for the user's age at registration and record the answer.
9.2 We do not knowingly process personal data of a person below the applicable minimum age. Where we establish or reasonably suspect that an account belongs to such a person, we deactivate and delete the account, subject to the retention referred to in Article 4.16.
9.3 We do not use the personal data of a user whom we know to be under 18 to create or activate advertising audiences on third-party platforms, to retarget that user or to use that user’s artwork, feedback, username, testimonial or other identifiable content in advertising. We apply the relevant technical and organisational controls to support this restriction, including age-based audience suppression and access controls where those controls are available and appropriate.
9.4 If you believe that a person below the applicable minimum age has provided us with personal data, contact us at the address set out in Section 2.2 and we will act without undue delay.
10. Recipients and processors
10.1 We do not sell your personal data. We share personal data only with the following categories of recipients, and only with recipients that are necessary for the purposes set out in Article 4, including::
Hosting and infrastructure
Cloud hosting, storage, content delivery, database and back-up providers.
Authentication
Providers of sign-in and identity services.
Analytics and data platform
Product analytics, event collection, warehouse and customer data platform providers.
Advertising and attribution
Advertising and attribution platforms, where applicable and subject to the consent and role information described in Section 4.11 and the cookie notice.
E-mail and communication
Transactional and marketing e-mail providers.
Payments and payouts
Payment service providers, app stores and payout providers.
Support and moderation
Helpdesk, ticketing and moderation tooling.
Artificial intelligence
Providers of the models and services referred to in Article 4.13.
Community
Providers of community functionality, including any third-party community server.
Professional advisers
Lawyers, auditors, accountants and insurers, acting as separate controllers.
Authorities
Judicial, police, tax and supervisory authorities, where required by law or a court order, or where necessary to prevent a serious risk to the safety of persons.
Corporate transactions
A counterparty in a merger, restructuring or transfer of all or part of our business, subject to appropriate confidentiality and data protection safeguards.
10.2 Each provider that processes personal data on our behalf is bound by a written data processing agreement that meets the requirements of Article 28 GDPR, may act only on our instructions, and is subject to appropriate confidentiality and security obligations.
10.3 An up-to-date list of the principal providers we use is available on request through the contact details in Article 2.
10.4 Other users see the personal data you choose to share with them, including your username, your profile and the content you make visible to them. Article 8 applies.
11. International transfers
11.1 We process personal data in the countries and regions in which ARTWOD, its group entities and its providers operate. This may include countries outside the European Economic Area. The principal countries or regions relevant to the current Platform are identified in the provider and transfer information available through the contact details in Section 2.
11.2 Artwod's own systems, including its servers and its data warehouse, are configured to store personal data in the European Union region. Certain providers, in particular for e-mail, infrastructure and analytics, operate globally, and personal data may be processed by them outside the European Economic Area.
11.3 Where personal data is transferred to a country that does not benefit from an adequacy decision under Article 45 GDPR, we put in place appropriate safeguards under Article 46 GDPR, in particular the standard contractual clauses adopted by the European Commission in Implementing Decision (EU) 2021/914, supplemented where necessary by additional technical, contractual and organisational measures identified through a transfer impact assessment. Where a recipient in the United States is certified under the EU-US Data Privacy Framework, we may rely on that adequacy decision.
11.4 You may obtain further information about the transfers we carry out and a copy of the safeguards in place through the contact details in Article 2. Commercially confidential elements may be redacted.
12. Retention
12.1 We retain personal data only for as long as necessary for the purposes for which it was collected. The periods or retention criteria applicable to each activity are set out in Article 4 and are implemented through our applicable deletion, anonymisation and suppression procedures.
12.2 Beyond those periods, we may retain personal data where necessary to comply with a legal obligation, to establish, exercise or defend a legal claim, or to enforce our terms.
12.3 Where you delete your account, or where we terminate it, we delete or anonymise the personal data associated with it within 30 days of the deletion taking effect. This does not apply to: content you have made public and with which other users have interacted, which is anonymised rather than deleted where deletion would remove the contribution of others; data we must retain under Section 12.2; records of acceptance of the terms; accounting and payment records; moderation files; and objection and suppression records kept in order to honour your objection.
12.4 Where an account has been inactive for 24 consecutive months, we delete or anonymise the personal data associated with it, subject to the same exceptions and after the notice provided for in Article 35.3 of the terms of service.
12.5 Once personal data has been deleted or anonymised, the behavioural and event data that remains is no longer linked to you and may be retained for statistical and product development purposes, subject to Section 12.7.
12.6 Back-ups are overwritten in the normal cycle and in any event within 90 days. Data in a back-up is not restored into production once it has been deleted, other than in a recovery scenario, in which case the deletion is reapplied.
12.7 Once personal data has been deleted or anonymised, the rights of access, rectification, erasure and portability can no longer be exercised in respect of that data.
12.8 We distinguish between identifiable data, pseudonymised data, aggregated data and anonymous data. We describe data as anonymous only where we can no longer reasonably reconnect it to a person, taking into account all the means available to us, including our own event and identity data. Pseudonymised and aggregated data that we can still reconnect to a person remains personal data and remains subject to this Policy.
13. Security
13.1 We maintain technical and organisational measures appropriate to the risk, within the meaning of Article 32 GDPR. These measures are designed to protect personal data against unauthorised or unlawful processing and against accidental loss, destruction or damage and may include access controls, confidentiality obligations, encryption, environment segregation, logging and monitoring, backup and recovery procedures, vulnerability management, incident response and periodic review. The specific measures may vary according to the nature of the processing, the system concerned and the requirements applicable to our providers.
13.2 We require our processors to implement appropriate measures and to assist us in complying with Articles 32 to 36 GDPR.
13.3 Where a personal data breach is likely to result in a risk to your rights and freedoms, we notify the Belgian Data Protection Authority within 72 hours of becoming aware of it, in accordance with Article 33 GDPR, and we inform you without undue delay where Article 34 GDPR requires us to do so.
13.4 No system is entirely secure. You help us protect your account by keeping your credentials confidential and by notifying us of any suspected misuse.
15. Your rights
15.1 Subject to the conditions in Articles 15 to 22 GDPR, you have the following rights:
Access (Art. 15)
To obtain confirmation whether we process personal data concerning you, a copy of that data, and information about the processing. This includes the inferred data referred to in Article 6.
Rectification (Art. 16)
To have inaccurate personal data corrected and incomplete personal data completed.
Erasure (Art. 17)
To have your personal data deleted, in particular where it is no longer necessary, where you withdraw your consent or where you object and we have no overriding ground.
Restriction (Art. 18)
To have the processing restricted in the cases set out in that Article.
Portability (Art. 20)
To receive the personal data you provided to us, and the data generated by your use of the Platform where the processing is based on consent or contract and carried out by automated means, in a structured, commonly used and machine-readable format, and to have it transmitted to another controller where technically feasible.
Objection (Art. 21)
To object, on grounds relating to your particular situation, to processing based on our legitimate interest, and to object at any time and without giving reasons to processing for direct marketing purposes, including the use of your artwork in advertising under Article 4.12.
Withdrawal of consent (Art. 7(3))
To withdraw your consent at any time, as easily as you gave it, without affecting the lawfulness of processing carried out before the withdrawal.
Automated decisions (Art. 22)
Not to be subject to a decision based solely on automated processing that produces legal effects or similarly significantly affects you. See Article 7.
Complaint (Art. 77)
To lodge a complaint with a supervisory authority. See Article 17.
15.2 Exercising your rights is free of charge. We may charge a reasonable fee, or refuse to act, only where a request is manifestly unfounded or excessive, in accordance with Article 12(5) GDPR. Any statement in an earlier version of our documentation that we may charge a small fee for access no longer applies.
15.3 Where you object to processing based on our legitimate interest, we stop that processing unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims. Where you object to direct marketing, we stop without any assessment.
16. How to exercise your rights
16.1 Send your request to the privacy contact e-mail address set out in Section 2.2. Where the functionality is available in your account, you may also exercise a right there, in particular deletion of your account, export of your data and objection to the use of your artwork in advertising. You may also send a request by post to the postal address stated in our Legal Notice.
16.2 We respond within one month of receipt. Where a request is complex or where we receive a number of requests from you, we may extend that period by two further months, and we will inform you of the extension and the reasons for it within the first month.
16.3 Where we have reasonable doubts about your identity, we may ask for additional information necessary to confirm it, and we use that information only for that purpose.
16.4 Where your request concerns content that also involves another user, for instance feedback given to you by another user, we take account of that other person's rights and we tell you where that limits what we can provide.
17. Supervisory authority
17.1 If you consider that our processing infringes data protection law, you may lodge a complaint with the Belgian Data Protection Authority:
Authority
Gegevensbeschermingsautoriteit / Autorite de protection des donnees
Address
Drukpersstraat 35, 1000 Brussels, Belgium
Telephone
+32 (0)2 274 48 00
Website
www.gegevensbeschermingsautoriteit.be
17.2 You may also lodge a complaint with the supervisory authority of the Member State of your habitual residence or place of work, and you have the right to an effective judicial remedy.
18. Changes to this Policy
18.1 We may update this Policy. We indicate the date of the last update at the top of the document and keep the previous versions available.
18.2 Where a change is material, we inform you at least 30 days in advance by e-mail or through the Platform. Where a change concerns processing based on your consent, we ask for your consent again before the change takes effect.
18.3 A change to this Policy does not retroactively extend the purposes for which personal data collected earlier may be used, unless the new purpose is compatible with the original purpose within the meaning of Article 6(4) GDPR or unless you consent.
19. Contact
19.1 Questions, comments and requests about this Policy may be sent to the contact details set out in Section 2.2. Our registered office and postal address are stated in our Legal Notice and Terms of Service.