Data Processing Agreement

This Data Processing Agreement ("DPA") forms part of the Art2App Terms and Conditions and applies where Art2App Ltd ("Art2App", "Company", "we", "us", or "our") processes personal data on behalf of a customer in connection with the Services. This document applies to all Art2App solutions, such as Art2App Collection Manager and Art2App Artist Studio.

Reading this DPA will help you understand how we process personal data on behalf of customers, the safeguards we apply, and how we use sub-processors when delivering the Services. If you still have questions, contact us at dpo@art2app.com or contact@art2app.com.

This summary provides key points from our Data Processing Agreement, but you can find more details below.

When does this DPA apply? This DPA applies where Art2App processes personal data on your behalf as a processor in connection with the Services.

What data may be processed? Depending on how you use the Services, this may include account data, contact details, collection-related data, support communications, technical usage data, and notification-related data where optional app notifications are enabled.

Do we use sub-processors? Yes. We use trusted sub-processors to support hosting, payments, optional AI features and optional push notifications.

Do we use customer data to train AI models? Not without your agreement. Content submitted for AI features is not used to train third-party AI models. We may use anonymised data, and content you choose to contribute through a setting we make available, to develop our own AI features (see section 12).

Where is data hosted? Our Services are primarily hosted in the United Kingdom. Certain services may be provided from the EEA where appropriate for service availability or functionality.

How do we handle new sub-processors? We will update the published sub-processor information and provide prior notice before a new sub-processor begins processing personal data on your behalf.

1. Scope and Role of the Parties

Where you act as a controller of personal data and Art2App processes personal data on your behalf in order to provide the Services, this DPA applies to that processing.

You remain responsible for determining the lawful basis, purposes, and means of your use of the Services. Art2App acts as your processor only to the extent required to provide the Services in accordance with your documented instructions, the Terms and Conditions, this DPA, and our Privacy Policy.

2. Definitions

In Short: This section explains the main terms used in this DPA.

• Customer, you, or your means the customer using the Services.
• Personal Data means any information relating to an identified or identifiable natural person processed by Art2App on your behalf.
• Data Subject means the individual to whom the personal data relates.
• Sub-processor means a third party appointed by Art2App to process personal data on your behalf in connection with the Services.

3. Details of Processing

In Short: We process personal data only as necessary to provide, secure, maintain, and support the Services.

Processing Details:

Category	Description
Subject matter	Provision of the Art2App platform, account administration, optional app notifications, payment-related administration, support, security, and optional AI-enabled features.
Duration	For the period during which Art2App provides the Services and for any limited retention period required under the Terms and Conditions or applicable law.
Nature and purpose of processing	Collection, storage, organisation, retrieval, hosting, consultation, transmission, deletion, and other processing strictly necessary to operate the Services. Anonymisation of personal data, as described in section 12.
Categories of data	Account data, contact details, collection-related data submitted by users, support communications, technical usage data, and limited notification-related data where push notifications are enabled. Content submitted to AI features that users choose to use (such as item details, photos, or spreadsheet column headers and sample values).
Categories of data subjects	Customers, account users, app users who enable notifications, and individuals whose information is included in customer-submitted content.

4. Customer Instructions

We will process personal data only on your documented instructions, unless otherwise required by applicable law. Your use of the Services, account settings, and instructions submitted through the Services form part of those documented instructions.

If we believe an instruction infringes applicable data protection law, we will immediately inform the Customer and we may suspend execution of that instruction and notify you where appropriate.

5. Confidentiality

We will ensure that persons authorised to process personal data are subject to appropriate confidentiality obligations.

6. Security Measures

In Short: We apply appropriate technical and organisational safeguards to protect personal data.

We implement and maintain appropriate technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access.

Such measures include access controls, encryption where appropriate, service monitoring, and reasonable safeguards proportionate to the nature of the processing and the risks involved.

7. Sub-processors

In Short: We use trusted sub-processors for limited parts of the Services and remain responsible for the processing they perform on our behalf.

You provide general authorisation for Art2App to engage sub-processors in connection with the Services, provided that we remain responsible for ensuring that any such sub-processor is bound by written obligations that are materially consistent with the applicable requirements of this DPA.

Current Sub-processors:

Sub-processor	Purpose	Notes
Amazon Web Services (AWS)	Cloud hosting, infrastructure, storage, and related technical services.	Primary hosting is in the United Kingdom (London). Certain services may be deployed in the EEA where appropriate and where specific functionality is not available in the UK region.
Amazon Web Services (AI services)	Processing of content submitted to optional AI features, only when users choose to use them: text suggestions and image enhancement (Amazon Bedrock), text-to-speech (Amazon Polly).	AWS states that, by default, Amazon Bedrock does not store content processed through it, does not use it to train models and does not share it with model providers, subject to limited exceptions for abuse detection described by AWS. Some of these services may be processed outside the UK and the EEA (see section 8).
Revolut	Payment processing and payment-related security controls.	Payment card information is handled and stored by Revolut. Art2App does not store full payment card details on its own systems.
Google Firebase	Push notification delivery for optional smart application notifications.	Applies only where a user installs the app and enables notifications.

Art2App may also use third-party services that do not process personal data on your behalf in a processor capacity. For example, where we send only item descriptors (such as a title, an artist name or keywords) to a search or content retrieval API to retrieve item-related images or data, that activity is outside the scope of the sub-processor list in this DPA.

Changes to Sub-processors

We may update our sub-processors from time to time. Where we intend to appoint a new sub-processor that will process personal data on your behalf, we will update the published sub-processor information and provide prior notice before the new sub-processor begins processing such personal data.

The applicable notice period will be stated in the relevant customer communication or service documentation. During that period, you may object in writing on reasonable data protection grounds. If we cannot reasonably accommodate a valid objection, either party may terminate the affected Services in accordance with the Terms and Conditions.

8. International Data Transfers

Our Services are primarily hosted in the United Kingdom. In some cases, specific services may be provided from the EEA or other jurisdictions where appropriate for service availability or functionality.

Where personal data is transferred internationally, we will apply appropriate safeguards as required by applicable law.

AI image enhancement, which only runs when users choose to use it, may be processed by AWS in the United States. In that case the transfer is covered by safeguards recognised under applicable law, such as the standard contractual clauses included in AWS's data processing terms.

9. Assistance to Customers

Taking into account the nature of the processing and the information available to Art2App, we will provide reasonable assistance to help customers respond to requests from data subjects and to support compliance with applicable obligations relating to security, breach notification, impact assessments, and prior consultation, where required.

10. Personal Data Breaches

If we become aware of a personal data breach affecting personal data processed under this DPA, we will notify the affected customer without undue delay and provide information reasonably available to us to assist the customer in meeting any applicable legal obligations.

11. Deletion and Return of Data

Upon termination or expiry of the Services, we will delete or return personal data in accordance with the Terms and Conditions, subject to any retention required by applicable law.

Under the current Terms and Conditions, cancelled paid accounts are retained for 30 days to allow account recovery before permanent deletion, unless earlier deletion is requested and can be lawfully completed.

12. AI Features

In Short: Optional AI features may process limited customer-provided data only to deliver the requested functionality.

We may offer optional artificial intelligence (AI) features. They are used only when customers choose to use them, and customers can switch them off at any time in their account settings. When a feature is used, limited customer-provided data (such as item details, a photo, a web page address, or spreadsheet column headers and sample values) is processed solely to deliver the requested result.

We use AWS services, including Amazon Bedrock and Amazon Polly, to support AI functionality. Content submitted for AI features is not used to train third-party AI models, and AI functionality is intended only to provide useful features within the Services.

Improving our own AI. You authorise Art2App to anonymise personal data contained in the Services and to use the resulting anonymised data to improve the Services and to develop Art2App's own AI features, as described in section 22 of the Terms and Conditions. If you choose to contribute content for this purpose through a setting that we make available, Art2App uses it for that limited purpose as an independent controller, as described in the Privacy Policy, after removing direct identifiers of individuals and any contact, payment or financial data; this does not change Art2App's role as your processor for all other processing. No other personal data processed on your behalf is used to train AI models. We never use such data to train models that create or imitate artworks; our AI is limited to helping the customer manage their data.

For consistency, the operational rules governing AI functionality, user responsibility, and service limitations remain primarily described in the Terms and Conditions.

13. Audit rights

Upon reasonable written request, Art2App shall make available information reasonably necessary to demonstrate compliance and shall allow audits no more than once annually, subject to confidentiality obligations.

14. Priority

In the event of a conflict between this DPA and the Terms and Conditions solely in relation to the processing of personal data on your behalf, this DPA will prevail to the extent of that conflict.

Except as expressly provided in this Data Processing Agreement, liability arising under or in connection with this DPA shall be subject to the limitations and exclusions of liability set out in the Terms and Conditions, unless prohibited by applicable law.

15. Contact Us

Art2App Ltd
12 Barker Close
Richmond TW9 4ET
United Kingdom
Email: contact@art2app.com
Data Protection Contact: dpo@art2app.com