ArTatoO! — Privacy Policy (including cookies)
© 2002-2026 ArTatoO!
This policy explains how personal data are processed on ArTatoO! (artatoo.com and www.artatoo.com, the « site »), in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, « GDPR ») and Spanish Organic Law 3/2018 on the protection of personal data and the guarantee of digital rights (LOPDGDD).
1. Controller
The controller is Frédéric Andrieux, established in the Balearic Islands, Spain, publisher of the site (the « publisher »).
- Contact for any data protection question: contact@artatoo.com
- No data protection officer has been designated, as none is required for the site.
Supervisory authority. You have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD), https://www.aepd.es, or with the supervisory authority of your country of residence. We encourage you to contact us first so that we can try to resolve your concern.
2. Data we process
| Category | Data |
|---|---|
| Account | email address, password (stored only in hashed form), display name, interface language, account identifier, role (member, administrator) |
| Profile | biography and its translations, portrait |
| Content | works, titles, descriptions and their translations, exhibitions, messages you write in gallery conversations |
| Technical | IP address, connection and server logs, browser user-agent, session data |
| Contact | messages sent to contact@artatoo.com and our replies |
| Moderation | reports received, decisions taken and statements of reasons |
| Gallery conversations (visitors) | name, email address and message of visitors who write in a gallery, date of the message, any reports |
At sign-up you confirm that you are at least 14; no other age information is collected.
Members of the former site. ArTatoO! is an entirely new site into which existing members and their data (account, profile and works) have been carried over, so that the gallery continues. Accounts sharing the same email address may be merged after review.
We do not collect special categories of data (such as health or political opinions) for our own purposes. Please think carefully before including such information in your biography or public messages.
3. Purposes and legal bases
| # | Purpose | Legal basis |
|---|---|---|
| 1 | Creating and managing your account, authentication, displaying your profile and works | Performance of the contract formed by the Terms of Use (GDPR art. 6(1)(b)) |
| 2 | Thumbnails, format conversion and backups | Performance of the contract; legitimate interest in the security and continuity of the site (art. 6(1)(f)) |
| 3 | Translating biographies and work descriptions, and dynamic translation of gallery conversations | Performance of the contract (multilingual site) |
| 4 | Moderation, security of the site, handling of reports about content | Legitimate interest in keeping the site safe and lawful; legal obligation under Regulation (EU) 2022/2065 (Digital Services Act) (art. 6(1)(c)) |
| 5 | Replying to messages sent to contact@artatoo.com and handling requests to exercise rights | Legitimate interest in answering you; legal obligation for data protection requests |
| 6 | Service emails (account, security, essential notices such as changes to the Terms, and the email sending the temporary password at sign-up) | Performance of the contract; no consent is required |
| 7 | First-party, aggregated audience measurement | Legitimate interest in understanding how the site is used |
| 8 | Off-site promotion of works (optional licence) and any newsletter | Your consent, which you may withdraw at any time (art. 6(1)(a)) |
| 9 | Gallery conversations: displaying the visitor's name and message; passing the email address to the artist of the gallery only, so that they can reply | Performance of the service requested by the visitor (art. 6(1)(b)); legitimate interest in allowing a reply and preventing abuse (art. 6(1)(f)) |
Migration of former members' data. Carrying over the data of former members to the new site is based on the legitimate interest in ensuring the continuity of the public gallery they had chosen. At their first login, members accept the new Terms of Use. Members who do not log in again remain displayed under the necessary display licence only, and may ask at any time for their works or account to be removed.
Moderation of adult or violent content. Adult or violent content may be shown in a restricted or blurred form, either at the request of the member who published it, for their own content, or by moderation. This is part of moderation (purpose 4).
Temporary password at sign-up. When you create an account, a temporary password is sent to the email address you provide, to verify that address and allow a first login. You must then replace it immediately with a password of your choice. This message is a service email (purpose 6).
Sending of service emails. Service emails may be sent from a dedicated address that does not receive replies (noreply@artatoo.com). Any reply is directed to contact@artatoo.com.
Closure record. After an account is closed, we keep a minimal record containing the account's identifiers on the former site and the date of closure, without name or email address. Its only purpose is to ensure that a closed account is not restored by mistake from the data of the former site (legal obligation to give effect to erasure and legitimate interest, art. 6(1)(c) and (f)).
Gallery conversations. Your name and message appear in the conversation straight away; a message containing a link appears once the artist has approved it, and the artist may remove any message. Your email address is never published, exported or sent to a third party. Only the artist of the gallery can see it. Administrators see it only if the artist reports your message, for that message alone, and this access is recorded. The artist undertakes to use it only to reply to you. If the artist closes their account, the conversation of their gallery is hidden during the grace period and then deleted, with its messages and email addresses.
No promotional email without consent. We do not send promotional emails or newsletters without your prior consent.
No automated decisions. No decision producing legal or similarly significant effects for you is taken solely by automated means, and no profiling is carried out.
Audience measurement. If the site measures its audience, this is done first-party, in aggregated form, without cross-site tracking and without any external analytics service, for example from server logs. If measurement ever required non-essential cookies or trackers, your consent would be requested first.
4. Recipients
Your data are accessible only to:
- persons authorised by the publisher and acting under the publisher's authority (technical operation, content and curation, communication), and the administrators designated by the publisher, each within the limits of their tasks;
- a hosting and email service provider established in the European Union (Germany), which hosts and backs up the site (backup copies are stored within the European Union) and provides the email service used for contact@artatoo.com and for service emails, acting as processor under a data processing agreement;
- where used, an external translation provider acting as processor, chosen preferably within the European Union;
- the artist of the gallery in which a visitor writes, for the email address given by that visitor, so that the artist can reply;
- authorities, where the law requires it.
Public profile information and works you publish are, by nature, visible to visitors of the site.
No other external service is used. Your data are not sold or rented.
Relations with processors are governed by a data processing agreement in accordance with the GDPR.
Transfers outside the European Union. We avoid transfers outside the European Economic Area. If a processor were nevertheless to process data outside it, the transfer would take place only with appropriate safeguards provided for by the GDPR (such as an adequacy decision or standard contractual clauses).
5. Retention periods
| Data | Retention |
|---|---|
| Account and profile, works | For the life of the account |
| After closure of the account | Public display ends and the profile is delisted immediately. The member's messages in other galleries, and the conversation of their own gallery with the visitors' messages and email addresses, are hidden during the grace period and then deleted. The member may cancel the closure for 14 days. Personal data are then erased or anonymised, or at once if the member expressly asks, except: (a) backups, which are overwritten as they are rotated (typically within 30 to 90 days — period to be set operationally); (b) data needed for a dispute or relating to a moderation decision, kept for as long as necessary for that purpose; (c) the closure record and the consent history described below |
| Closure record (former-site identifiers and date of closure, without name or email) | As long as data from the former site could be re-imported, and at most 3 years after closure |
| Connection logs and IP addresses | 12 months |
| Messages sent to contact@artatoo.com | For the time needed to handle them, then about 12 months |
| Consent to the off-site promotional licence (date, choice, version of the text) | For as long as it is in force, then 5 years after its withdrawal or the closure of the account, to prove the consent given |
| Log of service emails sent (date, recipient address, type of message, delivery status) | 12 months. The content of service emails is not kept for each member; temporary passwords and password reset links are not kept |
| Email address of a visitor in a gallery conversation | 12 months after the message, or at once if the message is deleted or the artist's account is erased |
| Name and message of a visitor | For as long as they are shown in the conversation, until removed by the visitor, the artist or moderation, or until the artist's account is erased |
| Record of administrators' access to a reported email address | 12 months |
| Invoices (only if a paid activity is introduced later) | For the periods required by Spanish tax and accounting law |
6. Your rights
You have the right to:
- access your data;
- rectification of inaccurate data;
- erasure of your data;
- restriction of processing;
- object to processing based on legitimate interest;
- portability of the data you have provided;
- withdraw your consent at any time for optional processing (the off-site promotional licence and any newsletter), without affecting processing carried out before withdrawal.
How to exercise them. From your account settings where the feature is available, or by writing to contact@artatoo.com. We verify your identity simply: the request must come from the email address of the account, or be made while you are logged in. If there is reasonable doubt, we may ask for additional information.
Response time. We respond within one month. This period may be extended by two further months where necessary, taking into account the complexity and number of requests; you will be informed of any extension within the first month.
Account deletion ends the public display of your works and profile, and with it the necessary display licence. You may cancel the closure within 14 days; after that, it is final.
Visitors who write in a gallery. You may delete your message with the code shown after sending it, for 30 days, and at any time after that by writing to contact@artatoo.com, indicating the gallery, the date and the text of the message, or writing from the email address you used. You have the same rights as members.
Portability. You may obtain an export of your data and of your files. At first, this export may be handled manually on request.
7. Cookies
The site uses only cookies that are strictly necessary for it to work or for a service you have requested:
| Cookie | Purpose | Duration |
|---|---|---|
| Session | Keeps you logged in and carries your session | Session, or until logout or session expiry |
| Language | Remembers the interface language you have chosen | [Duration to be confirmed operationally] |
| Security (CSRF) | Protects forms against forged requests | Session |
Under Spanish Law 34/2002 (LSSI), which transposes the EU rules on cookies, these cookies do not require consent; this is why the site does not display a consent banner. You can block them in your browser settings, but the site may then not work properly (for example, you will not be able to log in).
No advertising, social media or third-party analytics cookies are used. If non-essential cookies or trackers were introduced later, your prior consent would be requested and this policy would be updated.
8. Minors
Accounts are reserved for people aged 14 or over, in line with the LOPDGDD. People under 14 may not create an account. If we learn that an account has been created by a person under 14, it will be closed and its data erased. Members who publish images of identifiable minors must have the consent of their legal representatives.
9. Security
We take appropriate technical and organisational measures to protect your data, in particular encrypted connections, hashed passwords, restricted access and backups. No system is entirely secure; in the event of a personal data breach, we will take the measures and make the notifications required by law.
10. Users outside Spain
The site is open to users worldwide. The GDPR applies to all processing carried out by the publisher, and this policy is the standard applied to every user, whatever their country.
11. Changes
We may update this policy, in particular if new features are introduced (for example paid options, which would also be the subject of separate terms of sale). Members are informed of significant changes in advance by email or by a notice on the site. The date of the current version is shown at the top of this page.
12. Languages
This policy is available in English, Spanish, French, Chinese, Russian and Japanese. In case of discrepancy between versions, the English version prevails.
13. Contact
For any question about your data or to exercise your rights: contact@artatoo.com.