Privacy Policy

Effective Date: May 2, 2025

Last Updated: May 2, 2025

1. Introduction

Pickart AG ("Pickart," "we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data when you use our website, www.pickart.com, and the services offered through it (collectively, the "Service").

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

This policy applies to all users of the Service, including artists, hosts, property owners, guests, and website visitors.

2. Data Controller

The entity responsible for the processing of your personal data (the "Data Controller") is:

Pickart AG
Silvaplana
Switzerland
Email: info@pickart.com
Website: www.pickart.com

3. What Personal Data We Collect and How

We collect personal data in the following ways:

• Directly from You: When you register for an account, upload information about artworks (AW) or properties/spots, make a purchase, sign contracts, fill out forms, or contact us.
• Automatically: When you interact with our Service, we may automatically collect certain technical and usage data.

The types of personal data we may collect include:

• Identity Data: First name, last name, username or similar identifier, artist display name.
• Contact Data: Email address, physical address (billing, delivery, property location), phone number.
• Profile Data: Profile photo or avatar (optional).
• Financial Data: Bank account details (name, address, account number - for artists/hosts for payouts), payment card details (processed by our payment provider, we do not store full card numbers).
• Transaction Data: Details about payments to and from you, details of products and services you have purchased or listed (including AW sales, ArtBonus fees).
• Technical Data: IP address (may be collected by third-party services like analytics or hosting, even if not directly used by Pickart for location), browser type and version, time zone setting, browser plug-in types and versions, operating system and platform.
• Usage Data: Information about how you use our website and Service, including browsing patterns, page views, interaction times (collected via analytics).
• Content Data: Information, descriptions, and photographs you upload related to Artworks (AW), Properties, and Spots.
• Contract Data: Information related to signed artist or host contracts.
• Communications Data: Records of your communications with us (e.g., support emails).

4. Legal Basis and Purposes for Processing Your Personal Data

We only process your personal data when we have a valid legal basis to do so. The table below outlines the main purposes for which we process your data and the corresponding legal bases under GDPR Article 6(1):

Where we rely on Legitimate Interests, we have balanced our interests against your rights and freedoms and determined that our interests are not overridden. You have the right to object to processing based on legitimate interests (see Section 8).

Where we rely on Consent, you have the right to withdraw your consent at any time by contacting us or using unsubscribe links in emails.

5. How We Share Your Personal Data

We do not sell your personal data. We may share it with the following categories of third parties:

• Other Users: Necessary information may be shared between registered Artists and Hosts (e.g., name, contact details for AW delivery/installation coordination) or with Buyers (e.g., artist name, details for delivery/pickup).
• Third-Party Service Providers (Processors): We engage third-party companies to perform functions on our behalf. They only have access to personal data needed to perform their functions and are contractually obligated to process it securely and only for the specified purposes:
  • Hosting and Platform Infrastructure: Vercel (likely based in the US). For hosting our website, application deployment, and potentially running backend functions.
  • Database Management: Supabase (likely based in the US). For storing account data, AW/Spot information, etc.
  • Analytics: Google Analytics (likely based in the US). To analyze website traffic and usage patterns.
  • Payment Processing: Stripe (or similar providers, likely based in the US). To securely process payments and payouts. We do not store your full payment card details.
• Legal and Regulatory Authorities: If required by law, court order, or other legal process, or to protect the rights, property, or safety of Pickart, our users, or others.
• Business Transfers: In connection with any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.

6. International Data Transfers

Some of our third-party service providers (listed in Section 5, including Vercel, Supabase, Google Analytics, and Stripe) are based outside Switzerland and the European Economic Area (EEA), primarily in the United States (US). This means your personal data may be transferred to and processed in these countries.

When we transfer your personal data outside Switzerland/EEA, we ensure a similar degree of protection is afforded to it by implementing appropriate safeguards as required by law. This typically includes:

• Transferring data to countries deemed to provide an adequate level of protection by relevant authorities (e.g., Swiss Federal Council, European Commission).
• Using specific contracts approved by relevant authorities which give personal data the same protection it has in Switzerland/Europe (e.g., Standard Contractual Clauses - SCCs).
• Relying on certifications like the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, where applicable and certified by the provider.

You can request further information about the specific safeguards used for transferring your personal data by contacting us at info@pickart.com.

7. Data Retention

We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or reporting requirements.

Key retention criteria include:

• Account Data: Retained for as long as your account is active and for a reasonable period thereafter to allow for reactivation or to resolve disputes.
• Transaction Data: Retained for the period required by Swiss law (typically 10 years for accounting records).
• Usage/Analytics Data: Generally retained in an aggregated or anonymized form, or for a shorter period necessary for analysis.
• Communications Data: Retained for as long as necessary to address your inquiry or resolve an issue.

Upon expiry of the applicable retention period, we will securely delete or anonymize your personal data.

8. Your Data Protection Rights

Under the FADP and GDPR, you have various rights regarding your personal data:

• Right of Access: Request access to the personal data we hold about you.
• Right to Rectification: Request correction of inaccurate or incomplete personal data.
• Right to Erasure ('Right to be Forgotten'): Request deletion of your personal data where there is no compelling reason for us to keep processing it.
• Right to Restrict Processing: Request the suspension of processing your personal data in certain circumstances.
• Right to Data Portability: Request the transfer of your personal data to you or a third party in a structured, commonly used, machine-readable format (applies to data processed by automated means based on consent or contract).
• Right to Object: Object to processing based on our legitimate interests (or those of a third party). You also have an absolute right to object to processing for direct marketing purposes.
• Right to Withdraw Consent: Where we rely on consent for processing, you can withdraw it at any time. This will not affect the lawfulness of processing before consent withdrawal.
• Rights related to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (we currently do not anticipate such processing for core functions, but will update if this changes).

To exercise any of these rights, please contact us at info@pickart.com. We may need to request specific information from you to help us confirm your identity.

9. Cookies and Tracking Technologies

We use cookies and similar technologies (like those used by Google Analytics) to help operate our website, analyze usage, and improve your experience. Some cookies are essential for the website to function. For non-essential cookies (e.g., analytics, marketing), we may require your consent depending on local regulations. Please refer to our Cookie Policy or contact us for more details.

10. Data Security

We have implemented appropriate technical and organizational security measures designed to protect your personal data from accidental loss, unauthorized use, access, alteration, or disclosure. Access to your data is limited to those employees, agents, contractors, and other third parties who have a business need to know. However, no internet transmission is completely secure, and we cannot guarantee absolute security.

11. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any significant changes by posting the new policy on our website and updating the "Effective Date" at the top. We encourage you to review this policy periodically.

12. Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data infringes data protection laws.

• In Switzerland: The Federal Data Protection and Information Commissioner (FDPIC) (www.edoeb.admin.ch).
• In the EU: The data protection authority in your country of residence, place of work, or place of the alleged infringement.

We would, however, appreciate the chance to deal with your concerns before you approach the supervisory authority, so please contact us first at info@pickart.com.

13. Contact Us

If you have any questions about this Privacy Policy or our data protection practices, or if you wish to exercise any of your rights, please contact us:

Pickart AG
Email: info@pickart.com
Pickart AG (CHE-473.191.197), Via Maistra 55, Silvaplana, Switzerland