Privacy Policy

1. Data Controller

The data controller is AGOP MTÜ, a non-profit organisation registered in Estonia.

AGOP MTÜ processes personal data in accordance with the European Union’s General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and applicable laws of the Republic of Estonia.

For questions about personal data processing or exercising your rights under the GDPR, contact us at agop@globalpainters.net.

2. Personal Data We May Collect

The personal data collected depends on how an individual interacts with AGOP.

When an individual applies to join AGOP or take part in an exhibition, an Artsy programme or another project, we may receive:

• first name and surname;
• country and city of residence;
• email address;
• links to the artist’s website and professional pages;
• biographical and professional information;
• an artist statement and other information provided by the artist;
• information about education and exhibition activity;
• photographs of artworks;
• artwork titles, dimensions, medium, year of creation and prices;
• other information voluntarily provided to AGOP by the applicant.

When participation fees or service fees are paid, contact, payment and accounting data may be processed, together with information about the chosen programme, exhibition or service, the payment amount and payment status.

When an individual contacts AGOP by email or through a contact form, we may process their name, email address, the content of the message and information needed to respond.

When the website is visited, technical data may be processed automatically, including the IP address, device type, operating system, browser, date and time of access, server logs and other information needed to operate and secure the website.

3. How We Use Personal Data

AGOP may use personal data to:

• review applications to take part in programmes and exhibitions;
• carry out curatorial selection;
• organise exhibitions and other art projects;
• communicate with artists and applicants;
• prepare exhibition catalogues and publications;
• present artists and their work through AGOP’s channels;
• publish information on Artsy and other partner platforms as part of the chosen programme or project;
• maintain records of participation in AGOP programmes;
• process payments;
• maintain accounting and tax records;
• arrange delivery and return of artworks where necessary;
• handle questions and enquiries;
• ensure the website’s technical operation and security;
• fulfil AGOP’s legal obligations.

If an individual has separately subscribed to AGOP’s informational or marketing emails, their contact details may be used for those emails until consent is withdrawn.

4. Legal Bases for Processing

Depending on the circumstances, AGOP processes personal data on one or more grounds provided for by the GDPR.

Where processing is necessary to review an application, join AGOP, participate in an exhibition or an Artsy programme, or fulfil other arrangements with an artist, the legal basis is the performance of a contract or steps taken at the individual’s request before entering into a contract.

Where data must be processed or retained for accounting, tax or other mandatory record-keeping purposes, the legal basis is compliance with AGOP’s legal obligations.

To ensure website security, maintain necessary business correspondence, protect AGOP’s rights and maintain a documented history of completed exhibition projects, processing may be based on legitimate interests, unless overridden by the data subject’s rights and freedoms.

Where consent is required for particular processing, such as certain marketing communications or non-essential tracking technologies, the legal basis is the user’s consent. Consent may be withdrawn at any time.

5. Google Forms and Application Forms

AGOP may use Google Forms and other online forms to receive applications.

Data entered by the user in such a form is transmitted to AGOP through the relevant service.

If a form allows file uploads, Google may require the user to sign in to a Google account.

Data processing by Google’s services is also governed by Google’s terms and privacy policies.

AGOP uses information received through a form to review the application and organise the relevant programme, exhibition or other project.

6. Payments

AGOP may use Stripe or other payment providers to accept online payments.

The payment provider processes bank card data and other information needed to carry out the payment.

AGOP may receive the payer’s name, contact information, payment amount, currency, date, transaction status and other information needed to confirm payment, fulfil obligations and maintain accounting and tax records.

7. Artsy and Other Partner Platforms

If an artist participates in an online exhibition, an Artsy listing programme or another project involving publication on a third-party platform, AGOP may share with that platform the information needed to provide the relevant service.

This information may include:

• the artist’s name;
• biographical information;
• images of artworks;
• artwork titles and descriptions;
• dimensions and medium;
• year of creation;
• price;
• other professional information needed to publish the works.

Only data necessary for the relevant project or service is shared.

8. Publication of Artist Information

Exhibition activity by its nature involves presenting the artist and their work to the public.

As part of an exhibition or another project, AGOP may publish:

• the artist’s name;
• country or city;
• biographical and professional information;
• images of artworks;
• artwork titles and characteristics;
• information about exhibitions and the artist’s participation in AGOP projects.

This information may be published on AGOP’s websites, in digital catalogues, on social media, in press materials, on Artsy and on other platforms directly connected with the relevant project.

Materials from completed exhibitions may remain in AGOP’s public archive as a documented history of exhibition activity.

If an artist wishes to discuss the correction, amendment or deletion of published personal data, they may contact agop@globalpainters.net.

9. Who May Receive Personal Data

Depending on the particular service or project, access to necessary personal data may be provided to:

• hosting and technical infrastructure providers;
• Google and the Google services used;
• payment providers, including Stripe;
• Artsy and other professional art platforms;
• accounting and administrative service providers;
• exhibition venues and partners;
• logistics and postal companies;
• specialists and contractors who need the information to carry out a particular task for AGOP.

Personal data may also be disclosed to public authorities where AGOP is required to do so by law.

10. Transfers outside the European Economic Area

Some international services used by AGOP may process personal data outside the European Economic Area.

Where such a transfer is subject to GDPR requirements, it is carried out using the mechanisms and safeguards provided for by law, including European Commission adequacy decisions, standard contractual clauses or other applicable legal mechanisms.

11. Data Retention

AGOP retains personal data for no longer than is necessary for the purposes for which it was obtained, unless longer retention is required by law or to protect legitimate interests.

Data relating to current applications and projects is retained for the period needed to review the application and carry out the project.

Professional materials from participants in completed exhibitions may be retained in AGOP’s archive as part of the documented history of completed projects.

Business correspondence may be retained for the period needed for the relationship with the artist, the resolution of possible issues and the protection of AGOP’s legitimate interests.

Accounting documents and related data are retained for the period required by Estonian law. As a general rule, accounting documents are retained for seven years.

Data processed solely on the basis of consent is retained until consent is withdrawn or the purpose of processing ends, unless another lawful basis for retention exists.

After the applicable period ends, the data is deleted, anonymised or retained only to the extent required by law.

12. Cookies and Technical Data

AGOP’s website may use strictly necessary cookies and similar technologies needed for the website’s normal operation, security and the functioning of individual services.

The website may also contain elements provided by third-party services, such as forms, videos, maps, payment elements or other embedded content. When users interact with these elements, the relevant services may receive the user’s IP address, device information and other technical data.

If the website uses analytics, advertising or other non-essential cookies for which consent is required under applicable law, users are given the option to provide or refuse that consent.

13. Protection of Personal Data

AGOP takes reasonable technical and organisational measures to protect personal data against unauthorised access, unlawful use, alteration, disclosure, loss or destruction.

Access to personal data is granted only to people who need the information to perform their duties or a particular task.

14. Your Rights

Where provided for by the GDPR, data subjects have the right to:

• find out whether AGOP processes their personal data;
• access their personal data and obtain a copy;
• request correction of inaccurate or incomplete data;
• request deletion of personal data where there are legal grounds to do so;
• request restriction of processing;
• object to processing based on legitimate interests;
• receive data in a portable format where the right to data portability applies;
• withdraw consent previously given;
• lodge a complaint with a competent supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise your rights, contact AGOP at agop@globalpainters.net.

Where necessary to protect personal data, AGOP may request additional information to verify the identity of the person making the request.

15. Complaints

If an individual believes that their personal data is being processed in breach of applicable law, they may contact AGOP at agop@globalpainters.net so that we can review the situation.

Data subjects also have the right to lodge a complaint with the competent data protection authority.

The data protection supervisory authority in Estonia is Andmekaitse Inspektsioon (Estonian Data Protection Inspectorate).

16. Automated Decision-Making

AGOP does not use solely automated decision-making or profiling that in itself produces legal effects concerning an individual or similarly significantly affects them.

Decisions on accepting works for exhibitions and participation in curatorial projects are made by people.

17. Changes to This Privacy Policy

AGOP may update this Privacy Policy from time to time in response to changes in legislation, services used or organisational processes.

The current version of the Policy is published on AGOP’s website with the date of its last update.