Privacy notice
Version 2.2 · draft for the test phase, to be reviewed before the service opens.
Who processes your data
Data controller: Clesidra Ltd, company registered in England and Wales no. 06844555, registered office c/o Brian Paul Limited, 159a Chase Side, Enfield, England, EN2 0PW. Contact for privacy matters: info@artevidence.com (Roberto Marchetti).
Whose data
- Users with an account.
- People named in the documents users upload (for example owners, sellers, intermediaries, signatories): we receive their data from the user who uploads it, not from them. Information for them
- Proponents asked for documents by email, and people who receive a report link.
What we process, why, on what basis, for how long
| Data | Purpose | Legal basis | Kept for |
|---|
| Email, name, profile, sessions (date, IP address, browser) | Account and sign-in | Contract | While the account exists; sessions 14 days |
| Dossiers: work details, declarations, documents, requests, decisions, reports, including data about other people | Reviewing the documentation of an offer | Contract; for people named in documents, the legitimate interest in checking an offer | Files: 12 months from the last activity; reports: 6 years |
| Name of the account holder | Check against the UK Sanctions List, with human review | Legitimate interest in not providing services to designated persons | While the account exists |
| Content of dossiers | Internal analysis to improve the service and the assessment method (never commercial use) | Legitimate interest | As for dossiers |
| Log of actions (who, what, when, IP address) | Security and evidence of what happened | Legitimate interest | 6 years |
| Encrypted copy of everything | Monthly backup, to restore the service and reconstruct a dossier | Legitimate interest | 12 months |
We do not ask for special categories of data (health, beliefs, etc.). Documents may contain information about offences relating to a work (for example theft): it is processed only to review the offer.
Who sees the data
- In a dossier, each person sees only what others chose to share with them, after seeing the list of names.
- Authorised staff of Clesidra Ltd, with two-step verification, for internal analysis; every consultation is logged.
- Our hosting provider Aruba S.p.A. (Italy), which stores the encrypted data and sends our emails. Italy is in the EU, recognised as adequate by the UK.
- We do not sell data and do not disclose it to third parties, except where the law requires it.
Security
Contents and names are stored encrypted, each object with its own key; sign-in links and session cookies are never stored in clear. Only technical cookies are used: session, language, and short-lived cookies that confirm an email. No tracking or advertising.
Your rights
You can ask for access, rectification, erasure, restriction and portability of your data, and you can object to processing based on legitimate interest, including the internal analysis. Internal analysis is part of the service: if a user objects, their dossiers are excluded from it at once and, as stated in the Terms, the account is closed after 14 days, during which they can download their data from Account → "Download my data". If a person named in documents objects, the dossiers concerning them are excluded from internal analysis. People named in documents exercise their rights by writing to info@artevidence.com. We answer within one month. You can complain to the UK Information Commissioner's Office (ico.org.uk).
In short
- If you upload data about other people (for example owners or intermediaries), you must be entitled to do so and you are responsible for informing them that ART EVIDENCE processes it, including the internal use.
- ART EVIDENCE makes encrypted backups every month and keeps them for 12 months, to restore the service and to reconstruct a dossier when needed.
- ART EVIDENCE reviews the documentation of dossiers: it does not authenticate, attribute or value works of art, and does not buy, sell or broker them.
- Clesidra Ltd, which runs ART EVIDENCE, may consult the content of dossiers (work data, declarations, documents, requests, decisions and assessments), including data about other people that you upload, for internal analysis to improve the service and the assessment method.
- This access is reserved to authorised staff with two-step verification; every consultation is logged. Contents stay encrypted and are decrypted only when consulted: we make no clear copies.
- We do not use this content for commercial purposes: we do not sell it, disclose it to third parties, or use it to contact you or others, or for brokerage activities, ours or of other companies.