Privacy

Who we are

Philoteknia is run by C-Ware BV, Hof ter Bollen 13, 2870 Puurs-Sint-Amands, Belgium. Company number (KBO/VAT): BE 0447.286.794. C-Ware BV is responsible for your personal data.

For anything about your data, write to [email protected], or use the contact form and choose "A privacy request". We have no data protection officer.

Records are permanent

A record is meant to last as long as the artwork does, through everyone who looks after it. If you close your account, your personal data is erased, but the records you saved stay, with their photographs, attributed to "a former custodian".

There is one exception, and it is narrow. While an artwork has never been in anyone else's care, the person who put it on record may take that record away completely: the record, what they wrote, its history and its photographs are deleted, here and from our storage. Once the artwork has passed to someone else, that is no longer possible, because the record is then more than one person's own. An identifier is never given to another artwork, whether or not its record was taken away.

What we keep

Your account

Your email address, display name, country and the language we write to you in, and your password as a hash. A new email address you ask for is kept until that address confirms it, and then replaces the old one. We need these to run your account (legal basis: contract).

Signing in with Google or Apple

Only if you choose to sign in with one of them. We keep which one, the account number it uses for you, the name and email address it passes on, whether it says the address is confirmed, and when you linked it. Google also sends the link to your profile photo and your language, and both send your first and last name as separate parts; the photo link and the language are read once at sign-in and discarded, and the name is kept as one line only. We use what we keep to sign you in and for nothing else, and it lets us do nothing with that account: no reading, no posting, no contacts. The first time, you answer the same questions as anybody registering, and an account made this way has no password until you set one through the reset link. You can unlink either of them under Profile and sign-in, in My account, as long as another way in remains (legal basis: contract).

Your records

Photographs, what you tell us about the artwork, the country where it is, the language you wrote in, that you confirmed the artwork is in your care, and the record's history. From a photograph's details we read only the make and model of the camera, which only people at Philoteknia see. Its other details, including where it was taken if your device recorded it, stay in the original, which is never shown or given to anybody; the copies shown on the site carry none of them. You supply this; we do not check it. We need it to provide the service (contract), and keep it permanently because that is what the platform is for (legitimate interest, see "Your rights").

Artworks you follow

Which public artworks you follow, and since when, including those you follow because they are in a collection you follow, and which collection that is; and which you have stopped following yourself, so that a collection does not follow them for you again. We use this only to write to you when one of them changes status (legal basis: contract). A record shows how many people follow it, never who.

Applications to rehome an artwork

If you apply to become the next custodian of an artwork: your answers (why you would like it, where it would be kept, privately or professionally), any photographs of where it would be kept, with their stored location removed, and that you accepted the conditions. The custodian sees them with your display name and country, never your email address; the photographs only while choosing, and never publicly. If the custodian chooses you, and you confirm and pay the transfer fee, you and the custodian receive each other's email address to arrange the handover, and we keep when each of you said the artwork changed hands, or that the handover fell through (legal basis: contract).

A professional's ask to be put in touch

If an approved professional asks about an artwork you look after (unless you have turned professional enquiries off for it): the name they work under, what kind of professional they are, why they are asking, any exhibition they named, whatever they wrote to you, which record it is about, and your answer. You see all of that; they see nothing about you unless you say yes and they then pay the introduction fee, and then you are each given the other's email address (legal basis: for the ask reaching you, contract, since the terms allow it unless you turn it off; for the email addresses, consent, which is your answer itself). If you are the professional: the same, and whether and when you paid.

Reports about a record

If you report a record: your email address, your name if you give it, and what you tell us. If the report is that an artwork is in your care and not in the care of the person who recorded it, we ask both of you for a photograph of the artwork with a hand beside it, and remove any location stored in it. Only people at Philoteknia see these, and neither side learns who the other is. We use them only to look into the report (legitimate interest: keeping records accurate and safe).

Messages to us

Your name, email address and message, and the record it is about. We use them only to answer you (legitimate interest).

Technical data

Your IP address, browser details and the pages you request, which our server and Cloudflare process to deliver the site and protect it (legitimate interest). We also count how many different people visit each month. For that, your IP address and browser are turned into a code with a secret that changes every month; nothing is set in your browser. When the month is over we keep only the total, and delete the codes and the secret, so nothing is left that could say who visited (legitimate interest).

Somebody to contact about you

If you name one person for us to contact when we cannot reach you: their name, email address, how you know them, that you confirmed you had asked them first, and the date we wrote to tell them they had been named. This is the only thing here belonging to somebody who has no account with us and agreed to nothing, so we write to them once, ourselves, at the moment they are named, and every such letter carries a link that deletes them outright. It is never shown on a record, never given to anybody outside Philoteknia, and never used to reach you (legitimate interest: being able to find out what became of an artwork and of the person who looked after it).

What you have paid for

What you bought, how much it was, the VAT, the country you gave, whether it is paid, and Stripe's references for it. Your card and bank details are never among them: you pay on Stripe's pages and they never reach us. A gift to Philoteknia needs no account: given without one, we keep the payment itself and Stripe's references for it, with no name or email address, and Stripe asks you for the address it sends its receipt to. We need this to give you what you bought (contract) and to keep the books the law requires (legal obligation).

A professional account

If you ask for a professional account: what kind of professional you are, the name you work under, a company or VAT number if you give one, where you work and anything you tell us, and our decision. If you are approved as a dealer, the business details you choose to give (company name, business address, email and phone) are shown on your listings. For a sole trader these are personal data; you choose them, and you can empty any of them at any time. We need them to run the professional account (contract), and they are kept as long as the account.

Artworks you like

Which public artworks you liked, and since when. Only you see it: a record shows how many people like it, never who, and a like tells nobody anything (legal basis: contract).

The weekly letter

Whether you asked for the weekly letter, since when, and when the last one was sent. Only if you tick the box for it; stopping it clears it (legal basis: consent).

Your successor

If you name a successor: their name and email address, when you named them, and whether they accepted, declined or stepped down. We write to them once to ask, and tell them if you name somebody else. If they decline, or you take their name back before they accept, their name and address are deleted. If your records pass to them, your account is then closed as if you had asked us to erase it, except that what you wrote about how each artwork came to you stays with that artwork, for them (legal basis: contract; for the named person's details before they answer, our legitimate interest in asking them).

Being named as a successor

If somebody names you and you accept: that you accepted, from which account, and when. You see only that you were named, never the other person's artworks or notes, unless their records pass to you (legal basis: contract).

Wishes for your artworks

If you leave a wish on a record: what you would like to happen to the artwork and your note. It is never public. You see it, and after a handover the person your records pass to: your successor, or somebody a person at Philoteknia moves them to after checking. The note is checked for misuse like other text written for someone else to read, and if that check holds it, a person at Philoteknia reads the note (legal basis: contract).

A successor's report

If you tell us, as a successor, that somebody has died or can no longer decide: what you told us, your note, and any document you send, such as a death notice or a notary's letter. Only people at Philoteknia see these. We use them to decide whether the records pass (legitimate interest).

Your collection pages

If you open any: for each, the name you chose, its address, which of your artworks you put in it and when, when you opened or closed it, and how many people follow it, as a number. A page shows its name and the public records you put in it, and never your display name or country. The name is checked for misuse like other text written for others to read, and if that check holds it, a person at Philoteknia reads it (legal basis: contract).

Collections you follow

Which collection pages you follow, and since when. We use this only to write to you when one of them changes, and to follow the artworks in them for you (legal basis: contract). A collection page shows how many people follow it, never who.

Exhibitions you added

If you link one of your records to an exhibition: which record, which exhibition, and when. If you write an exhibition: its title, organiser, venue and the venue's address, city, country, dates or year, and website, and that you wrote it. An exhibition is shown publicly only once what was written about it has been checked and while at least one public record is linked to it, and then only with its public records, never a private one; who wrote it or linked a record to it is never shown (legal basis: contract).

We email you about your account, to confirm your address or reset your password, and, if you follow artworks, when one of them changes status. If you ask for it, and only then, we also send one letter a week with the new art in the archive. Every follow email has a link to stop following that artwork, and every weekly letter a link to stop the letter. Nothing else.

What is public

Records are public unless you make them private. A public record shows the photographs, what you told us about the artwork, the country where it is, its identifier and its status. It never shows your name, your email address, or how the artwork came to you; a dealer's listing, below, is the one exception. Before what you write for a record, a rehoming or an application is shown to others, it is checked for spam and scams, by software and, when something is held, by a person.

When an artwork is rehomed, its record shows the year and that it was rehomed without consideration. It never shows who gave it or who received it.

You can make a record private under Artworks, and public again. Only you and people at Philoteknia can see a private record; its address shows nothing to anyone else.

Photographs can show more than you meant: a person, an address, a reflection. Check them before you save. If a record shows personal data, including someone else's, tell us and we will remove the photograph or correct the text.

A dealer's listing shows the business details the dealer chose to give on their dealer page: company name, business address, email and phone. Nothing else on a record ever shows contact details. An exhibition's page shows the venue's street address, if it was given, and the exhibition's own website once a person at Philoteknia has read it.

When a record passes to a successor, its history says "Passed on to a successor" and the year. It never says who, or why.

A collection page, if you open one, shows the name you chose for it and the public records you put in it, at an address of its own. You may open several. None of them ever shows your display name or your country. Anybody with an account can follow one, which follows every record shown on it too, and hear when a record first appears on it, when one in it changes status, and if you close it.

An exhibition is shown only once what was written about it has been checked and while at least one public record is linked to it. Its own page shows its title, organiser, venue and the venue's address, city, country and dates or year, its public records and never a private one, and its website once a person at Philoteknia has read it; a public record linked to it shows its title, year, city and country. It never shows who wrote it or who linked a record to it.

Cookies

No advertising, no trackers, and no analytics beyond the monthly count of visitors described above, which sets nothing in your browser. Reading the site sets no cookies: the home page, the archive, records and pages like this one. Cloudflare, which delivers the site, sets no cookies of its own.

Session cookie

Set when you log in, register or use a form such as the contact form. It keeps you logged in and the form working. It ends after two hours without activity, or when you log out.

Security cookie (XSRF-TOKEN)

Set with the session cookie. It protects forms against misuse from other sites, and lasts as long as the session.

Remember-me cookie

Only if you tick "Keep me logged in on this device". It lasts up to about 400 days, or until you log out.

Browser storage while taking a photo

A note in your browser's session storage, so the page can tell you if your phone closed the browser while the camera was open. It holds no personal data and is gone when you close the tab.

Browser storage while signed in

When you log in, your browser remembers that you did, and whether your account is a staff one. It is kept in your browser's local storage and never sent to us, so that the pages which set no cookies can still show you the right menu. Logging out removes it. It holds nothing else about you.

These are needed for the site to work, so we do not ask for consent.

Who helps us

These companies process data for us, only under our instructions.

Hetzner Online GmbH, Germany

Hosts our server and its database in Helsinki, Finland, under Hetzner's standard data processing agreement. The data stays in the EU.Data protection at Hetzner

Cloudflare, Inc., United States

Delivers and protects the site, and stores the photographs and the nightly encrypted copies of the database (Cloudflare R2), under Cloudflare's Data Processing Addendum. Data may be processed in the United States, under the EU-U.S. Data Privacy Framework or, where that does not apply, the EU standard contractual clauses.Cloudflare Data Processing AddendumCloudflare standard contractual clauses

Backoffice Europe BV (Satmarin), Belgium

Runs our mail server (Microsoft Exchange) at its premises in Belgium, and holds the MailBaby account we send through. Email to [email protected], including contact form messages, is kept there. It is a related company under common management with C-Ware BV, and acts only as our mail provider.

Anthropic, PBC, United States

Three things, and only these three. It checks what people write for others to read (what you tell us about an artwork, rehoming conditions and applications, and the note left with a wish for a successor) for spam, scams and misuse before it is shown; it receives that text alone, never your name or your email address. It looks at each photograph on a record once it has been prepared, as the reduced copy that is shown on the site, for sexually explicit or abusive content and for whether it is a photograph of a physical object at all; it receives the photograph alone, with nothing about you or the record attached. A photograph it doubts waits for a person at Philoteknia before it is shown, and is never refused by it alone. And, when you ask it to on the form and not otherwise, it looks at a photograph of your artwork and suggests what the artwork is of, the manner it is in and what it is made of, from our own lists. We keep nothing from this beyond the answer: the photograph goes, the answer comes back, and no copy is kept beyond the one already on your record. What Anthropic does with it is set by its commercial terms, under which neither the text nor the photograph is used to train its models; it may hold what is sent to it for a limited period to prevent misuse of the service. The legal basis for the checks is our legitimate interest in keeping the public record free of abuse and of images that are not of the artworks; for the suggestion, it is your consent, which is you asking for it; you never have to ask, and the rest of the form works without it. Data may be processed in the United States, under the EU standard contractual clauses.Anthropic commercial terms

MailBaby, operated by Interserver, Inc., United States

Relays the emails we send. It removes a message's content once delivered, and keeps headers and delivery responses for 60 days.MailBaby privacy statement

Stripe Payments Europe, Ltd., Ireland

Takes the payments. You pay on Stripe's own pages, so your card or bank details never reach Philoteknia. Stripe receives your email address, what you bought and the amount, and sends you the receipt. It keeps the payment records the law requires it to keep. Stripe may process data outside the EU, under the EU standard contractual clauses.Stripe privacy policyStripe data processing agreement

Google LLC, United States

Only if you sign in with Google. Google tells us who signed in, and nothing about you is sent to Google beyond that request. What Google keeps about your signing in is set by its own privacy policy. Unlinking it here stops further sign-ins through Google; what Google already holds is managed in your Google account, not here. Data may be processed in the United States, under the EU-U.S. Data Privacy Framework.Google privacy policy

Apple Inc., United States

Only if you sign in with Apple. Apple tells us who signed in, and nothing about you is sent to Apple beyond that request, with one exception: if you chose to hide your email address, our letters go to an address Apple made for you and Apple forwards them, so every letter we send you passes through Apple on the way, until you add an address of your own. What Apple keeps about your signing in is set by its own privacy policy. Unlinking it here stops further sign-ins through Apple, and our letters keep going to the hidden address until you change it; what Apple already holds is managed in your Apple account, not here. Data may be processed in the United States, under the EU-U.S. Data Privacy Framework.Apple privacy policy

We do not sell personal data, and share it with no one else unless the law requires it.

There is one thing we share with professionals, and only when you say so. Unless you turn professional enquiries off for an artwork, an approved professional (a dealer, an exhibitor or curator, a researcher or another) can ask to be put in touch with you. You are told the name they work under, what kind of professional they are, why they are asking and whatever they wrote to you; they are told nothing about you at all. If you answer yes, they are asked to pay the introduction fee, and once they have, you and they are each given the other's email address, at the same moment. If you answer no, or do not answer at all, or they do not pay, they are given nothing.

How long we keep it

Your account

Until you ask us to erase it.

Signing in with Google or Apple

Until you unlink it, or your account is erased. The request behind a letter offering to link one to an existing account is deleted when the letter's link is answered, and otherwise within a day of the link running out, which it does after 24 hours.

Records and their photographs

Permanently. Your link to them is removed when your account is erased.

Unsaved records

Their photographs are removed after 48 hours without activity.

Artworks you follow

Until you stop following them, or your account is erased. One you follow with a collection also ends when you stop following the collection, when it closes, or when its owner takes it out, unless another collection you follow holds it. That you stopped following one yourself is kept until you follow it again or your account is erased.

Applications to rehome an artwork

Deleted 12 months after the rehoming closes, with any photographs. An application that led to the artwork passing to you stays with the record of that transfer.

A professional's ask to be put in touch

Deleted 12 months after it is answered, or after it runs out unanswered, which is also how long a no keeps that professional from asking about that artwork again.

Reports about a record

Deleted 12 months after the report is settled. A photograph sent for a report is deleted 30 days after it is settled, and a report whose email address was never confirmed after two days.

Messages to us

12 months in the website's database. In our mailbox, as long as we need them to handle and document the correspondence; they are not deleted automatically there.

Somebody to contact about you

Until they remove themselves, until you delete them yourself, until you name somebody else, or until your account is erased, whichever comes first. Removing it deletes the row rather than blanking it.

What you have paid for

As long as Belgian bookkeeping law requires us to keep our books, which is seven years. We do not delete them automatically after that. This is the one thing an erasure request cannot take away. What it does instead is empty the account they point at, so what remains is the bookkeeping and not the person.

Server and application logs

14 days.

Backups

Every night a copy of the database is made, encrypted, and kept in Cloudflare R2. Before each update another copy is made on our own server, which is not encrypted and which only we can read. Both are deleted after 30 days. An erased account can remain in one until then.

A professional account

As long as the account. A business detail you empty is gone at once, and once the approval as a dealer ends none of them is shown any more.

Artworks you like

Until you take the like back, or your account is erased.

The weekly letter

Until you stop the letter, or your account is erased.

Your successor

While the nomination stands. A person who declined or was taken back before accepting: deleted at once. A successor who accepted: kept with the record of the nomination, with their account.

Wishes for your artworks

Until you remove them, the artwork passes to somebody other than your successor, the record is deleted, or your account is erased. After a handover they stay with the record for the person it passed to.

A successor's report and its documents

The report is kept with the case. Documents are deleted 12 months after the case is closed.

Your collection pages

Until your account is erased. Closing a page keeps its name, its address and what you put in it for you, so that opening it again puts it back where it was; erasure deletes them.

Collections you follow

Until you stop following them, the page closes, or your account is erased.

Exhibitions you added

An exhibition you wrote is kept, also after your account is erased (by then the account it was written from holds nothing about you), unless a person at Philoteknia deletes it. A link between a record and an exhibition is kept until whoever looks after the record removes it, or a person at Philoteknia does, or the record is deleted.

Your rights

You can ask for a copy of your data, to correct it, to erase your account, to limit or object to how we use it, and to receive it in a usable format. You do not have to ask us for the copy: "A copy of your data" in My account downloads it at once, as a file. It holds everything in the list above except the technical data, which sits in server logs that are never indexed by account. For anything else, write to [email protected] or use the contact form, and we answer within one month.

To erase your account, ask under "Closing your account" in My account. You are asked to confirm you understand what stays, we write to you to say we have the request, and a person at Philoteknia carries it out by hand rather than a button doing it at once. You can call the request off at any time until then, and we write to you again when it is done. Your name, country and language can be corrected yourself, under Profile and sign-in.

When we erase your account, we remove your email address, display name, country and password, your unsaved records, the artworks you follow and the record of those you stopped following, your applications to rehome artworks, your app logins and messages; an artwork you offered for rehoming is withdrawn. We also blank what you wrote about how an artwork came to you, because it may name other people. Your saved records stay, attributed to "a former custodian". We do not remove whole records: a permanent record is what the platform is for.

We keep those records because of our legitimate interest in a permanent record of the artworks. We have weighed that interest against yours in a written assessment, which we will send you on request. If your situation means a record should not stay as it is, tell us why and we will look at it again.

If you think we handle your data wrongly, you can complain to the Belgian Data Protection Authority (dataprotectionauthority.be) or to the authority where you live.

Age

Philoteknia accounts are for people aged 18 or older. If we learn that an account belongs to someone younger, we erase it.

Changes

If this notice changes in a way that matters, we say so here, and email account holders when it affects them.