Privacy Policy

Version: 2.0

Effective date: January 6, 2026

1. Introduction

PickArt AG and PickArt Platform Ltd (together “PickArt”, “we”, “us”, or “our”) are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and protect your personal data when you use our website www.pickart.com and the services offered through it (collectively, the 'Service').

We process personal data in accordance with the Swiss Federal Act on Data Protection (DSG) and, where applicable, the EU General Data Protection Regulation (GDPR) and UK General Data Protection Regulation (UK GDPR).

This policy applies to all users of the service, including artists, hosts, property owners, guests, and website visitors.

Depending on your place of residence and the PickArt services you use, your personal data may be processed by PickArt AG (Switzerland), PickArt Platform Ltd (United Kingdom), or jointly by both entities, as further described below.

2. Data Controller and Joint Controllership

For the purposes of applicable data protection laws, including the Swiss Federal Act on Data Protection (DSG), the EU General Data Protection Regulation (GDPR), the UK GDPR, the following entities act as joint data controllers within the meaning of Article 26 GDPR:

PickArt AG and PickArt Platform Ltd act as joint controllers within the meaning of Article 26 GDPR for the operation of the PickArt platform and related services.

The respective roles and responsibilities of the joint controllers are defined in an internal arrangement in accordance with Article 26 GDPR. The essence of this arrangement is made available to data subjects in this Privacy Policy.

2.1 Essence of the Joint Controller Arrangement (Article 26 GDPR)

PickArt AG and PickArt Platform Ltd jointly determine the purposes and means of processing personal data in connection with the operation of the PickArt platform. In particular:

PickArt AG acts as the primary contact point for supervisory authorities. Regardless of the internal allocation of responsibilities, data subjects may exercise their rights under applicable data protection laws against either PickArt AG or PickArt Platform Ltd.

3. What personal data we collect and how

We collect personal data in the following ways:

• Directly from You: When you register for an account, upload information about artworks (AW) or properties/spots, make a purchase, sign contracts, fill out forms, or contact us.
• Automatically: When you interact with our Service, we may automatically collect certain technical and usage data.

The types of personal data we may collect include:

• Identity Data: First name, last name, username or similar identifier, artist display name.
• Contact Data: Email address, physical address (billing, delivery, property location), phone number.
• Profile Data: Profile photo or avatar (optional).
• Financial Data: Bank account details (name, address, account number - for artists/hosts for payouts), payment card details (processed by our payment provider, we do not store full card numbers).
• Transaction Data: Details about payments to and from you, details of products and services you have purchased or listed (including AW sales, ArtBonus fees).
• Technical Data: IP address (may be collected by third-party services like analytics or hosting, even if not directly used by PickArt for location), browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
• Usage Data: Information about how you use our website and Service, including browsing patterns, page views, interaction times (collected via analytics).
• Content Data: Information, descriptions, and photographs you upload related to Artworks (AW), Properties, and Spots.
• Contract Data: Information related to signed artist or host contracts.
• Communications Data: Records of your communications with us (e.g., support emails).

4. Legal Basis and Purposes for Processing Your Personal Data

We only process your personal data when we have a valid legal basis to do so. The table below outlines the main purposes for which we process your data and the corresponding legal bases under GDPR Article 6(1):

Where we rely on Legitimate Interests, we have balanced our interests against your rights and freedoms and determined that our interests are not overridden. You have the right to object to processing based on legitimate interests (see Section 8).

Where we rely on Consent, you have the right to withdraw your consent at any time by contacting us or using unsubscribe links in emails.

5. How we share your personal data

We do not sell your personal data. We may share it with the following categories of third parties:

• Between PickArt entities: Personal data may be shared between PickArt AG and PickArt Platform Ltd where necessary for platform operation, contract performance, payment processing, customer support, compliance, and security, in accordance with applicable data protection laws and the joint controller arrangement.
• Other Users: Necessary information may be shared between registered Artists and Hosts (e.g., name, contact details for AW delivery/installation coordination) or with Buyers (e.g., artist name, details for delivery/pickup).
• Third-Party Service Providers (Processors): We engage third-party companies to perform functions on our behalf. They only have access to personal data needed to perform their functions and are contractually obligated to process it securely and only for the specified purposes:
  • Hosting and Platform Infrastructure: Vercel (likely based in the US). For hosting our website, application deployment, and potentially running backend functions.
  • Database Management: Supabase (likely based in the US). For storing account data, AW/Spot information, etc.
  • Analytics: Google Analytics (likely based in the US). To analyze website traffic and usage patterns.
  • Payment processing: Stripe or similar providers. Payments are processed via separate Stripe accounts held by PickArt AG or PickArt Platform Ltd, depending on the applicable contractual entity. We do not store full payment card details.
• Legal and Regulatory Authorities: If required by law, court order, or other legal process, or to protect the rights, property, or safety of PickArt, our users, or others.
• Business Transfers: In connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.

6. International Data Transfers

As PickArt operates through entities in Switzerland and the United Kingdom, your personal data may be transferred between these jurisdictions as part of the joint operation of the Service.

Some of our third-party service providers (listed in Section 5, including Vercel, Supabase, Google Analytics, and Stripe) are based outside Switzerland and the European Economic Area (EEA), primarily in the United States (US). This means your personal data may be transferred to and processed in these countries.

• Transferring data to countries deemed to provide an adequate level of protection by relevant authorities (e.g., Swiss Federal Council, European Commission).
• Using specific contracts approved by relevant authorities which give personal data the same protection it has in Switzerland/Europe (e.g., Standard Contractual Clauses - SCCs).
• Relying on certifications like the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, where applicable and certified by the provider.

You can request further information about the specific safeguards used for transferring your personal data by contacting us at info@pickart.com.

7. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.

Key retention criteria include:

• Account Data: Retained for as long as your account is active and for a reasonable period thereafter to allow for reactivation or to resolve disputes.
• Transaction Data: Retained for the period required by Swiss law (typically 10 years for accounting records).
• Usage/Analytics Data: Generally retained in an aggregated or anonymized form, or for a shorter period necessary for analysis.
• Communications Data: Retained for as long as necessary to address your inquiry or resolve an issue.

Upon expiry of the applicable retention period, we will securely delete or anonymize your personal data.

8. Your data protection rights

Under the DSG and GDPR, you have various rights regarding your personal data:

• Right of Access: Request access to the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ('Right to be Forgotten'): Request deletion of your personal data where there is no compelling reason for us to keep processing it.
• Right to Restrict Processing: Request the suspension of processing your personal data in certain circumstances.
• Right to Data Portability: Request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format (applies to data processed by automated means based on consent or contract).
• Right to Object: Object to processing based on our legitimate interests (or those of a third party). You also have an absolute right to object to processing for direct marketing purposes.
• Right to Withdraw Consent: Where we rely on consent for processing, you can withdraw it at any time. This will not affect the lawfulness of processing before consent withdrawal.
• Rights related to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (we currently do not anticipate such processing for core functions, but will update if this changes).

You may exercise your data protection rights against either PickArt AG or PickArt Platform Ltd, regardless of which entity is primarily responsible for processing your personal data.

To exercise any of these rights, please contact us at info@pickart.com. We may need to request specific information from you to confirm your identity.

9. Cookies and tracking technologies

We use cookies and similar technologies (like those used by Google Analytics) to help operate our website, analyze usage, and improve your experience. Some cookies are essential for the website to function. For non-essential cookies (e.g., analytics, marketing), we may require your consent depending on local regulations. Please refer to our Cookie Policy or contact us for more details.

10. Data security

We have implemented appropriate technical and organizational security measures designed to protect your personal data from accidental loss, unauthorized use, access, alteration, or disclosure. Access to your data is limited to those employees, agents, contractors, and other third parties who have a business need to know. However, no internet transmission is completely secure, and we cannot guarantee absolute security.

11. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on our website and updating the 'Effective Date' at the top. We encourage you to review this policy periodically.

12. Right to appeal

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data infringes data protection laws.

• In Switzerland: The Federal Data Protection and Information Commissioner (FDPIC) (www.edoeb.admin.ch).
• In the EU: The data protection authority in your country of residence, place of work, or place of the alleged infringement.
• In the United Kingdom: The Information Commissioner’s Office (ICO) (www.ico.org.uk).

We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority, so please contact us first at info@pickart.com.

13. Contact Us

For any questions about this Privacy Policy, the joint controller arrangement, or your data protection rights, you may contact either PickArt entity: