Privacy policy

Who is responsible

The operator of upwardgallery.com is an individual entrepreneur registered in Georgia (ID number 304649860), trading as UPWARD gallery. For the privacy laws of Georgia, the European Union, and the United Kingdom, that entrepreneur is the controller of personal data collected through the site. Write to [email protected] for a privacy request.

This policy replaces the Privacy Policy published on the previous site on 27 May 2022. It describes the data this site actually collects.

What we collect

• Account: the name you enter, an optional location, your email address, and either a password hash or a Google account identifier.
• Profile and works: biography, photographs, titles, medium, year, dimensions, and any price or availability you choose to enter.
• Entries: the exhibition, the status of the entry, jury scores, and any award.
• Payments: the PayPal order and capture identifiers, the amount, the currency, and the time of payment. PayPal holds the card data. We do not.
• Technical data: an IP address and browser data in the server log and in the session cookie that keeps you signed in.
• Spam check: if you accept optional cookies, a public form may use Cloudflare Turnstile. Cloudflare then receives a token and connection data to tell a person from an automated submission.
• Analytics: if you accept optional cookies, Google Analytics receives page URLs, approximate location, and device/browser data so we can see how the site is used. It loads only after that choice.
• Mail you send to [email protected].

We do not ask for a government identification number, a school, or a precise GPS location. We do not run advertising networks, and we do not sell personal information.

Why we use it

• To open the account, take an entry, run the jury, publish a result, and issue a diploma: this is necessary for the contract with you.
• To take an entry fee and keep the accounting record: the contract, and a legal obligation under Georgian tax rules.
• To send mail about that entry, including approval, payment, a reminder, a rejection, or published results: the contract. We do not run a marketing list.
• To keep the site secure and to block spam: our legitimate interest in operating the site. You can object, as described below.
• To measure visits with Google Analytics after you accept optional cookies: consent. You can reject or clear the cookie choice at any time.

Opening an account and entering a call do not depend on a separate consent to “processing.” They depend on the contract. Where a consent is the basis, you can withdraw it without affecting processing that already happened, and without cancelling a fee already paid.

Who receives it

• Amazon Web Services, in the United States, hosts the site and stores files.
• PayPal, when you pay a fee, under PayPal’s own privacy policy.
• Google, when you choose Google sign-in.
• Cloudflare, when the spam check on a public form is enabled.
• Google Analytics, when you accept optional cookies, under Google’s analytics terms.
• The email service that delivers mail from [email protected].
• Jurors assigned to an exhibition see the work and the artist name for the entries they score. The jury desk does not give them your email address.

We do not sell personal information. We do not share it for cross-context behavioral advertising.

Transfers out of your country

The operator is in Georgia. Hosting and several providers are in the United States and in other countries. Those countries may not have the same data-protection rules as yours. We transfer the data in order to perform the contract with you — hosting the account, taking the fee, sending entry mail — and to keep the site secure. The providers process it for those tasks.

How long we keep it

The account lasts until you delete it. A published exhibition record, diploma, or magazine piece that already includes your name and work stays as the public record of that exhibition. Payment records stay for the period Georgian accounting rules require. Server logs stay for a short operational period.

Your rights

Depending on where you live, you can ask us to:

• confirm whether we hold data about you, and for a copy of it;
• correct it;
• delete it — the studio also has “delete account”;
• restrict processing, or object to processing that is based on legitimate interest;
• receive a portable copy of the data you gave us;
• complain to a supervisory authority.

Email [email protected]. We may ask you to confirm that the request comes from you. We aim to answer within one month under Georgian, EU, and UK law, and within 45 days under the California Consumer Privacy Act.

Where to complain

• Georgia: the Personal Data Protection Service.
• European Union: the data protection authority in your country. You may also complain to us first.
• United Kingdom: the Information Commissioner’s Office.
• Canada: the Office of the Privacy Commissioner of Canada. We collect, use, and disclose personal information only for the purposes in this policy. Write to us first if you want to challenge our compliance.
• Australia: the Office of the Australian Information Commissioner. The providers listed above are outside Australia.
• United States: if you live in California or another state with a consumer privacy statute, use the same email to request access, correction, or deletion. We will not charge a different price or refuse the service because you made a request. We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is no separate “Do Not Sell or Share” switch. We do not track you across other sites for advertising, and we do not change the site in response to a browser “Do Not Track” signal.

Children

Accounts and entries are for people who are at least 18. We do not knowingly collect personal information from a child. If you believe we have, write to [email protected] and we will delete it.

Security

Passwords are stored as a hash. The session cookie is set so that page scripts cannot read it. No transmission over the internet is perfectly secure.

Changes

We post changes on this page and change the date at the top. If a change materially affects how we use account data, we also email the address on the account.

Contact

[email protected]