Privacy Policy

1. Data Controller

The controller of personal data processed through Artoria is:

EDUGARDEN AP S.R.L.
Tax Identification Number (CUI): 52446856
Trade Register No.: J2025066710003
Registered office: Str. Ing. Anghel Saligny no. 126, bl. H1, sc. 2, 1st floor, apt. 24, Galați 800288, Romania
Email: membership@artoriasociety.com

For questions about personal data or to exercise a right available under applicable data protection law, you may contact us using the details above.

2. Personal Data We May Process

Depending on how you interact with Artoria, we may process the following categories of personal data.

Account data

This may include:

• your name;
• email address;
• account identifier;
• profile photograph, if you choose to add one;
• authentication-related information;
• account status.

Artoria Society application data

Where you submit a standard membership application, this may include information such as:

• city;
• country;
• occupation;
• optional company or professional field;
• how you heard about Artoria;
• your free-form answer concerning your relationship with art;
• application photograph, where requested or provided;
• application status;
• dates associated with submission and review.

Invitation data

Where Artoria’s member invitation functionality is used, we may process information such as:

• the identity or account identifier of the member issuing the invitation;
• the invitation code, link or identifier;
• invitation issuance date;
• invitation status;
• information indicating whether and when the invitation was used;
• the account or email associated with the invited person, where applicable;
• information needed to prevent invitation fraud or misuse.

Membership data

We may process information such as:

• membership status;
• membership type or plan, where applicable;
• activation date;
• renewal date;
• expiry date;
• cancellation status;
• member number or other membership identifier;
• membership eligibility or verification status.

Payment and transaction information

Depending on the method used to purchase membership, we may process information such as:

• transaction identifier;
• payment status;
• amount and currency;
• subscription product or plan;
• billing period;
• purchase date;
• renewal or expiry information;
• payment platform used;
• information required to associate a confirmed transaction with the correct Artoria account.

Where payment card information is entered directly into the systems of a specialised payment provider, Apple or Google, Artoria does not seek to receive or store complete payment card numbers or card security codes.

Information generated through use of Artoria

This may include:

• progress;
• favourites;
• collections;
• quiz responses;
• activity within the application;
• preferences;
• membership feature usage;
• information relating to invitations or member benefits.

Technical and security information

This may include technical information reasonably required to:

• operate the service;
• authenticate users;
• protect accounts;
• detect abuse or fraud;
• diagnose technical problems;
• maintain application security.

Depending on the service and configuration, such information may include device, application, log, error or network-related information.

Communications

We may process information that you choose to provide when you contact us concerning:

• your account;
• an application;
• membership;
• payment;
• an invitation;
• technical support;
• data protection;
• another request or complaint.

AI-assisted features

When you use Artoria’s AI-assisted features, your questions, relevant conversation context, preferences and photographs submitted for artwork identification are processed through Artoria’s systems and specialised technology providers to generate responses, recommendations or identification results. Please avoid including personal, sensitive or confidential information that is unnecessary for the feature you requested.

Community features and reports

When you use Artoria Society community features, we process and store your messages, profile information and shared photographs, videos, audio files or documents through our hosting and storage providers to make them available to members with access to the relevant conversation or community context. If you submit a report, the reported content, relevant identifiers, your explanation and any attached screenshots may be processed by authorised support personnel and hosting or communication service providers to investigate the report, moderate content and address inappropriate behaviour.

Images and photographs

Certain Artoria features may allow you to upload or capture images.

These images are processed as described in this Policy and according to the purpose of the relevant feature.

Location information

Location information may be processed only where you choose to use a function that requires it and the required device permission or other legal basis exists.

Artoria applies the principle of data minimisation and seeks not to collect personal data that is unnecessary for the relevant purpose.

3. How We Obtain Personal Data

We may obtain personal data directly from you when you:

• create or manage an account;
• submit an Artoria Society application;
• accept or use a member invitation;
• purchase or manage a membership;
• use Artoria features;
• contact us;
• upload information or material.

Certain information may be generated automatically when you use Artoria.

We may also receive limited information from service providers involved in authentication, payments, subscriptions, infrastructure or other functions requested by you.

Where a member sends an invitation, we may receive information generated by that member’s use of the invitation feature.

Some preferences or information may remain stored locally on your device and may not be associated with your Artoria account.

4. Purposes of Processing

We may process personal data for purposes including:

• creating and administering Artoria accounts;
• authenticating users;
• saving and reviewing standard Artoria Society applications;
• communicating the outcome of an application;
• creating and administering member invitations;
• validating invitation codes or links;
• allowing invited persons to bypass the ordinary manual review process where the conditions for an invitation are satisfied;
• detecting fraudulent or abusive invitation activity;
• activating and administering memberships;
• confirming payment and subscription status;
• determining whether a user is entitled to access member-only features;
• managing membership activation, expiry, renewal and cancellation status;
• providing Artoria functions and content;
• synchronising progress, preferences and account-related content;
• personalising the in-app experience;
• providing optional functions that you choose to use;
• managing digital membership credentials;
• maintaining the security of Artoria;
• preventing fraudulent, unauthorised or abusive use;
• diagnosing and resolving technical issues;
• providing customer or member support;
• protecting the rights, systems and infrastructure of Artoria;
• complying with applicable legal obligations;
• establishing, exercising or defending legal claims where necessary.

Personal data will not be used for purposes incompatible with the purposes for which it was collected unless an appropriate legal basis exists.

5. Legal Bases for Processing

Depending on the circumstances, processing may be based on one or more of the following legal bases.

Performance of a contract or steps taken at your request before entering into a contract

This may apply where processing is necessary to:

• create and administer your account;
• process your membership application;
• process or validate an invitation;
• activate membership;
• provide membership functionality;
• provide Artoria services you have requested;
• administer your paid subscription.

Legitimate interests

We may rely on legitimate interests where appropriate, including interests relating to:

• security of Artoria and user accounts;
• prevention of fraud and abuse;
• prevention of invitation misuse;
• protection of infrastructure;
• technical diagnostics;
• service administration;
• protection and defence of legal rights.

Where legitimate interests are relied upon, they are considered against the rights and freedoms of the person concerned.

Consent

We may rely on consent where this is required by law or where you choose to activate an optional feature that requires consent.

Where processing is based on consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Legal obligations

We may process or retain information where required to comply with a legal obligation.

6. Artoria Society Applications

Information supplied in a standard Artoria Society application is used to administer and manually review the application.

Standard applications are reviewed by authorised persons.

Technical tools may assist with organisation or administration, but Artoria does not use exclusively automated decision-making to independently approve or reject a standard application where that decision would produce legal or similarly significant effects.

Application materials are not made public merely because an application has been submitted.

Access to application information is limited to authorised persons and service providers who require such access for relevant purposes.

Where an application is accepted, the applicant may proceed to the membership purchase process.

Where a valid member invitation is used, the standard manual application review may be bypassed as described in the Terms of Use.

7. Member Invitations

Active Artoria Society members may, where the feature is available, be permitted to issue a limited number of invitations.

For the purpose of operating this system, we may process information linking an invitation to the issuing member and, once used, to the invited person’s account or registration process.

Invitation information may be used to:

• create and deliver invitations;
• validate invitation codes or links;
• record the use of the invitation;
• apply the applicable annual invitation limit;
• determine whether the standard application review can be bypassed;
• prevent resale, fraud, duplicate use or other abuse;
• resolve disputes or technical problems relating to invitations.

Members should only provide another person’s information through an invitation feature where they have a legitimate reason to do so and should avoid entering unnecessary personal information about the invited person.

8. Payments and Membership Subscriptions

Payments for Artoria Society membership may be processed through:

• Apple App Store;
• Google Play;
• specialised external payment providers;
• other payment methods made available in the future.

The relevant provider may independently process payment information in accordance with its own terms, privacy policy and legal obligations.

Artoria may receive limited transaction and subscription information needed to administer membership, such as:

• confirmation that payment succeeded or failed;
• transaction identifier;
• subscription or product identifier;
• membership period;
• renewal or expiry date;
• subscription status;
• refund or cancellation status, where made available.

Where complete card information is entered directly into a payment provider’s systems, Artoria does not seek to receive or store the full card number or security code.

9. Camera, Photographs and Artwork Identification

Certain Artoria features may allow you to use your device camera or select an image in order to identify or analyse an artwork.

Camera or photo access occurs only following an action initiated by you and, where required by the operating system, after you grant the relevant permission.

Images are used to provide the feature you requested and may be processed by service providers where technically necessary to provide that feature.

Use of these features is optional.

You should not submit images containing personal documents, confidential information, sensitive personal data or identifiable individuals where that information is unnecessary for the feature.

Automated identification results are informational and may contain errors.

10. Location

Certain features may use device location to provide location-related functionality, such as displaying nearby museums or cultural locations.

Location access is optional and occurs only where you choose to use the relevant feature and the necessary permission or other legal basis exists.

You can generally modify or withdraw device-level location permission through your device settings.

Disabling location access may affect location-dependent functions without preventing general use of other available Artoria functions.

11. Service Providers

Artoria may use specialist service providers for purposes such as:

• hosting and cloud infrastructure;
• authentication;
• database services;
• storage and synchronisation;
• application security;
• payment processing;
• subscription management;
• maps and location services;
• processing user-requested functions;
• technical diagnostics;
• email and communications;
• customer and membership support;
• digital wallet functionality.

These providers may process personal data only to the extent relevant to the service they provide and according to their applicable legal role and obligations.

Artoria Society applications are accessible only to authorised persons and providers who require access to conduct or administer the review, manage membership or resolve account-related requests.

Artoria does not sell users’ personal data.

Artoria does not make personal data available to third parties for their independent direct marketing purposes unless there is a separate lawful basis and, where required, appropriate user consent.

11.1. Optional website analytics

With your consent, the Artoria website uses Google Analytics 4 to understand aggregate website traffic, page use and interactions such as interest in membership, the start of a membership checkout or a click leading to an app store. Artoria uses this information to improve the website and does not enable Google advertising signals or ad personalisation.

Depending on your browser and device, Google Analytics may process information such as the pages visited, approximate location derived from the internet connection, browser and device information, referral source, interaction events and analytics identifiers. Artoria configures analytics page locations without URL query parameters to avoid sending invitation codes, checkout references or similar values through page addresses. Artoria does not intentionally send names, email addresses, application answers, payment details or other directly identifying account information to Google Analytics.

Analytics is disabled by default and the Google Analytics tag is not requested unless you select “Accept analytics”. Your choice is stored locally in your browser under artoria.analytics.consent.v1. You may change or withdraw your choice at any time using “Privacy settings” in the website footer. Withdrawal stops future analytics collection from that browser and the website attempts to remove its Google Analytics cookies.

The legal basis for this optional processing and related storage or access on your device is your consent. Google may process analytics data on Artoria’s behalf and may process data in countries outside the European Economic Area using applicable safeguards. More information is available in Google’s Privacy Policy.

12. Third-Party Services and Digital Wallets

Artoria may display or facilitate access to maps, images, webpages, ticketing resources, payments or other services provided by third parties.

When you interact directly with an external service, that provider may process information according to its own privacy practices.

If you choose to add an Artoria Society membership card to Apple Wallet or Google Wallet, information reasonably necessary to issue and display the card may be transmitted to the selected wallet provider at your request.

Such information may include:

• your name;
• member number;
• membership status displayed on the card;
• membership validity or expiry information.

Where a Google Wallet object has already been issued and the relevant Google functionality does not permit the issuer to delete the object outright, Artoria may, where technically available and appropriate, expire or update that object and replace displayed personal information with neutral values.

A card already saved in a digital wallet may remain on your device or wallet account until you remove it.

Following membership expiry or account deletion, Artoria’s own verification systems will no longer confirm active membership where no active membership exists.

Artoria does not control independent processing undertaken by external providers outside the services they provide to Artoria.

We recommend reviewing the privacy information of a third-party service before providing information directly to that provider.

13. International Data Transfers

Some service providers may operate in multiple jurisdictions, including jurisdictions outside the European Economic Area.

Where personal data is transferred internationally, appropriate transfer mechanisms and safeguards recognised by applicable data protection law will be used where required.

Depending on the circumstances, these may include:

• an adequacy decision;
• Standard Contractual Clauses;
• another legally recognised transfer mechanism.

You may contact us for further information concerning safeguards applicable to relevant transfers.

14. How Long We Keep Personal Data

Personal data is retained only for as long as reasonably necessary for the purpose for which it was collected, or while another valid legal basis for retention exists.

Retention periods may differ depending on the type of information and the purpose for which it is processed.

Factors considered may include:

• the existence and duration of an account;
• the existence and duration of a membership;
• the need to provide Artoria;
• the nature and sensitivity of the information;
• account and application security;
• fraud and abuse prevention;
• invitation administration;
• the need to resolve requests or disputes;
• limitation periods;
• potential legal claims;
• statutory accounting, tax or other retention obligations.

Where information is no longer needed, it will be deleted, anonymised or retained only where another lawful basis justifies further retention.

Application drafts

An unfinished application draft may be retained while the relevant account remains active or until you delete the draft, subject to technical and legal requirements.

Declined applications

For a declined standard application, information reasonably necessary to maintain the decision history and administer any permitted reapplication may be retained for up to 12 months from the decision, unless deletion is requested earlier and no lawful reason requires continued retention.

Invitations

Information concerning invitations may be retained for as long as reasonably necessary to administer invitation limits, maintain the integrity of the membership system, prevent abuse and resolve related disputes.

Membership and transactions

Certain membership and transaction information may need to be retained after membership or account termination where required for accounting, taxation, fraud prevention, dispute resolution or another legal obligation or legitimate purpose.

Local data

Information stored exclusively on your device may remain there until deleted by you, by the application or by the operating system.

15. Security

We apply reasonable technical and organisational measures designed to protect personal data against:

• unauthorised access;
• misuse;
• accidental loss;
• alteration;
• unauthorised disclosure;
• destruction.

Access to personal data is limited according to operational need, and safeguards are selected with regard to the nature and risk of the relevant processing.

No information system or transmission method can guarantee absolute security.

Accordingly, while we take reasonable measures to protect personal data, we cannot guarantee the elimination of every security risk.

If a personal data breach occurs, we will take the measures required under applicable law, including notification to the competent authority and affected individuals where legally required.

16. Your Data Protection Rights

Subject to the conditions, restrictions and exceptions provided by applicable law, you may have the right:

• to receive information about the processing of your personal data;
• to obtain access to your personal data;
• to request correction of inaccurate personal data;
• to request deletion of personal data;
• to request restriction of processing;
• to object to certain processing;
• to receive certain personal data in a structured, commonly used and machine-readable format and, where applicable, request portability;
• to withdraw consent where processing is based on consent;
• to lodge a complaint with a competent data protection supervisory authority.

Where processing is based on legitimate interests, you may have a right to object in the circumstances provided by law.

To exercise a right, you may contact us using the details in Section 1.

To protect personal data against unauthorised access, we may request reasonable additional information to verify the identity of the person making the request.

17. Account Deletion

To request deletion without signing in or reinstalling the app, visit Delete your Artoria account for instructions, the data covered and retention periods.

You may request deletion of your Artoria account and associated personal data through functionality provided in Artoria, where available, or by contacting us.

Uninstalling Artoria does not itself delete your Artoria account.

Following a valid deletion request, personal data associated with the account will be deleted or anonymised in accordance with applicable law, except where we have a right or obligation to retain certain information for an additional period.

Such circumstances may include:

• legal obligations;
• accounting or tax obligations;
• security;
• fraud or abuse prevention;
• dispute resolution;
• establishment, exercise or defence of legal claims.

Account deletion does not necessarily cancel a recurring subscription purchased through Apple App Store, Google Play or another payment provider.

Where a separate cancellation step is required by the relevant payment provider, the user must complete that process to prevent future recurring charges.

This does not limit any mandatory rights or obligations arising under applicable law.

18. Minimum Age

Artoria is intended exclusively for persons aged 18 or over.

We do not permit persons under 18 to hold an Artoria account or Artoria Society membership and do not intentionally seek to collect personal data from minors.

If we learn that a person under 18 has provided personal data to Artoria or is using an Artoria account, we may take reasonable steps to investigate the situation, suspend or close the account and delete relevant information to the extent permitted or required by law.

If you reasonably believe that a person under 18 is using Artoria or has provided personal data to us, you may contact us.

19. Automated Decision-Making

Artoria does not use personal data to make exclusively automated decisions that produce legal effects concerning a user or similarly significantly affect that user, unless a lawful basis and the requirements applicable to such processing exist.

Standard Artoria Society applications are reviewed by an authorised person.

Technical systems may assist with organising or processing applications but do not independently approve or reject a standard application.

Where a valid invitation from an active member is used, the ordinary manual application review may be bypassed according to the membership rules.

This is based on the invitation pathway selected by the user and does not constitute an automated assessment of the invited person’s personality, cultural value or suitability.

Automated Artoria features that provide artwork identifications, classifications, responses or recommendations are informational and are not professional evaluations or decisions having legal effect.

20. Information Provided by Users

Users are responsible for personal data and materials they choose to provide through Artoria.

You should not submit information concerning another person unless you are entitled to do so.

You should not provide sensitive or confidential information where it is unnecessary for the relevant feature.

Where a member uses the invitation functionality, the member should avoid submitting unnecessary information concerning the person being invited.

To the extent permitted by law, the operator cannot be responsible for a user’s voluntary disclosure of information that Artoria did not request or that is submitted contrary to the instructions and purpose of the relevant feature.

Nothing in this section limits obligations of the controller that cannot be excluded under applicable law.

21. Changes to This Privacy Policy

We may update this Privacy Policy where:

• Artoria changes;
• Artoria Society membership functionality changes;
• our processing activities change;
• service providers or technical infrastructure change;
• applicable legal requirements change.

The latest version will state the date on which it was last updated.

Where a change materially affects how personal data is processed, additional notice will be provided where required by law.

Continued use of Artoria will not be treated as a substitute for consent where applicable law requires separate consent.

22. Supervisory Authority

If you believe that the processing of your personal data infringes applicable data protection law, you have the right to lodge a complaint with a competent supervisory authority.

In Romania, the competent supervisory authority is:

Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP)
National Supervisory Authority for Personal Data Processing.

Subject to the GDPR, you may also be entitled to lodge a complaint with the competent supervisory authority in the EU or EEA Member State of your habitual residence, place of work or place of the alleged infringement.

23. Contact

For questions concerning this Privacy Policy, your personal data, an Artoria Society application, membership or the exercise of your data protection rights, you may contact:

EDUGARDEN AP S.R.L.
Tax Identification Number (CUI): 52446856
Trade Register No.: J2025066710003
Registered office: Str. Ing. Anghel Saligny no. 126, bl. H1, sc. 2, 1st floor, apt. 24, Galați 800288, Romania
Email: membership@artoriasociety.com