Legal
Data Processing Agreement (DPA)
§ 01
Purpose of this DPA
This Data Processing Agreement ("DPA") forms part of our Terms of Service and Privacy Policy. It applies whenever Women In Art Ltd ("WIA", "we") processes personal data on your behalf — for example, when you sell on the marketplace as an Artist (we process your collectors' details on your behalf), when you are a press, gallery or partner contact integrating with us, or when you are a Data Subject exercising rights under the UK GDPR or EU GDPR. WIA is also a Data Controller in its own right for site-operations data — see the Privacy Policy for the controller-level disclosures. If you are an EU or UK enterprise buyer requiring a signed counterpart of this DPA, email hello@womeninart.com (subject: DPA) and we will return a signed PDF within five (5) working days.
§ 02
Definitions
"Data Controller", "Data Processor", "Personal Data", "Process / Processing", "Sub-Processor", "Data Subject", "Supervisory Authority" have the meanings given in UK GDPR / EU GDPR / Data Protection Act 2018. "Standard Contractual Clauses" or "SCCs" means the EU Commission Implementing Decision (EU) 2021/914 of 4 June 2021, plus the UK Addendum (ICO Version B1.0 issued under section 119A of the DPA 2018). "Applicable Data Protection Law" means the UK GDPR, EU GDPR (Regulation 2016/679), Data Protection Act 2018, PECR 2003 (as amended), and any other applicable data protection or privacy laws of England & Wales.
§ 03
Roles and scope
(a) WIA is the Data Controller for site-operations data (account credentials, billing, support correspondence, server logs, anti-fraud and identity-verification status, anonymous analytics). (b) WIA acts as Data Processor on behalf of the Artist (the Data Controller) for buyer-side personal data captured during the Artist's sales — buyer name, shipping address, order content, message threads. The Artist remains the Controller and instructs WIA's processing through the use of the Services. (c) Where you are a Press, Gallery, or Partner using WIA APIs or media kits in a way that exposes WIA-held personal data, WIA remains the Controller and you act as Processor or Joint Controller as set out separately in your Partner Agreement.
§ 04
Nature, purpose and duration of processing
Nature: storage, transmission, display, fulfilment-support, fraud-prevention, anti-abuse, subscription management, payout reconciliation, identity-verification check, AI tooling (where the Data Subject opts in). Purpose: operating the marketplace, completing the Artist's sales, providing the Artist's tooling (CRM, CoA, Studio, AI Mentor) where applicable, and complying with our legal obligations. Duration: for the lifetime of the Artist's account, plus the retention windows set out in the Privacy Policy (in particular: 6 years for order metadata in pseudonymised form for HMRC; 5 years for identity verification status post-closure; 30 days for server logs; 35 days for backups). Buyer data tied to a specific Artist's sales is held only as long as that Artist remains a Controller — if the Artist closes their account, buyer-side records associated with their sales are retained in pseudonymised form for the HMRC window then deleted.
§ 05
Categories of Data Subjects and Personal Data
Data Subjects: Artists (sellers), Buyers (collectors), Community members, Press and gallery contacts. Categories of Personal Data: identification data (name, email, account ID); contact data (shipping and billing address, phone where supplied for shipping); commercial data (order history, payout history, tax form status); content data (artwork images, biography, journal posts, AI chat prompts); technical data (IP address, browser fingerprint subset, timestamps); identity verification status (pass/fail flag plus country and date — never the underlying ID document itself); financial metadata (Stripe customer ID, subscription state — no card numbers ever). Special categories: WIA does not solicit or process Article 9 / Article 10 special category data. The platform is restricted to users 18 or over.
§ 06
Processor obligations
Where WIA acts as Processor, WIA agrees to: • Process Personal Data only on the documented instructions of the Controller (the Artist), including for transfers, except where required by UK / EU law. • Ensure persons authorised to process the Personal Data are bound by confidentiality. • Implement the technical and organisational measures set out in §08 below. • Engage sub-processors only on terms equivalent to this DPA — current sub-processor list at §07. • Assist the Controller in responding to Data Subject requests (access, rectification, erasure, portability, objection). • Assist the Controller in complying with their obligations under Articles 32-36 GDPR (security, breach notification, DPIA, prior consultation). • Delete or return all Personal Data on termination, subject to retention windows required by law. • Make available all information necessary to demonstrate compliance, and allow for audits — see §09.
§ 07
Approved sub-processors (current list)
We use the following sub-processors. By accepting this DPA you authorise their use. We will give thirty (30) days' advance notice (by email and by updating this page) of any addition or replacement, and you may object on reasonable grounds. • Stripe Payments Europe Ltd (Ireland) — payments, subscriptions, Connect Express payouts. SCCs in place via Stripe's DPA. • Stripe Inc. (USA) — sub-processor of Stripe Payments Europe. Adequacy via EU-US / UK-US Data Privacy Framework. • Didit Inc. (Estonia / EU) — KYC identity verification. SCCs in place. • Cloudinary Ltd (Israel) — image hosting. Adequacy decision (Israel) plus SCCs. • Resend Inc. (USA, EU data-residency option enabled) — transactional email. SCCs in place. • Google LLC (USA) — Gemini large language model powering AI chats and marketing tools. Personal data: only what the user types into the chat. SCCs in place. Prompts are not used to train external models. • MongoDB, Inc. — Atlas managed database in the EU region. SCCs in place. Other third-party services (not sub-processors — no personal data transmitted): Shippo Inc. (USA) is used for read-only shipping rate estimates. Only postal code and country are transmitted; no identifier, no name, no address.
§ 08
Technical and organisational measures (Article 32)
Confidentiality: bcrypt password hashing; JWT signed sessions with rotation; role-based access control (RBAC) for admin/artist/buyer; TOTP-based MFA available for admin accounts; no shared logins. Integrity: HTTPS / TLS 1.2+ in transit; HSTS preload; strict CSP, X-Content-Type-Options, frame-ancestors headers; webhook idempotency; signed webhook payloads. Availability: managed cloud hosting with daily backups (35-day rolling retention); Stripe and Didit reconciliation loops; Resend domain-verified transactional mail; cloud DDoS protection via Cloudflare; automated health checks. Resilience: SSRF outbound allowlist on third-party HTTP calls; rate-limited authentication endpoints; brute-force lockout; SIEM-style auth-anomaly alerting (real-time admin notification on 401 / 422 / 429 spikes); honeypot endpoints and clone-detection canaries. Testing & assurance: independent code-quality scanning; regular dependency vulnerability scanning; security event log retained for audit (visible at /admin/security); incident response runbook (escalation, containment, notification under Article 33). Detail at /security.
§ 09
Audit rights
On reasonable notice (and not more than once in any 12-month period unless there has been a security incident), the Controller may audit WIA's compliance with this DPA. Audits are conducted under reasonable confidentiality and at the Controller's cost unless a material breach is found, in which case WIA bears the cost. WIA may satisfy audit obligations by providing recent SOC 2 / ISO 27001 reports of sub-processors (e.g., Stripe, MongoDB) where the relevant control sits at the sub-processor layer.
§ 10
Personal Data breach notification
WIA will notify the Controller of any confirmed Personal Data breach affecting Controller data without undue delay and in any event within seventy-two (72) hours of becoming aware, containing the information required by Article 33(3) GDPR: nature of the breach, categories and approximate number of Data Subjects and records affected, likely consequences, measures taken or proposed to address the breach and mitigate harm, and the WIA contact point. WIA additionally maintains a public security-incident page at /security/incidents (if any) and notifies affected Data Subjects directly where Article 34 high-risk thresholds are met.
§ 11
International transfers
Where WIA or a sub-processor processes Personal Data outside the UK or EEA, the transfer relies on: (a) an adequacy decision (e.g., EU-US / UK-US Data Privacy Framework where the recipient is certified), or (b) Module 2 (Controller → Processor) or Module 3 (Processor → Sub-Processor) of the EU SCCs (2021/914) plus the UK Addendum (B1.0). The Controller, by signing or accepting this DPA, mandates WIA to enter into SCCs with sub-processors on the Controller's behalf.
§ 12
Data Subject rights — assistance
WIA will, taking into account the nature of processing, assist the Controller by appropriate technical and organisational measures, insofar as possible, to fulfil the Controller's obligation to respond to requests for exercising the Data Subject's rights under Chapter III GDPR. For WIA-Controller-only data, Data Subjects may self-serve at /api/me/data-export (machine-readable export) and /api/me/delete (right to erasure). Manual DSAR requests: hello@womeninart.com.
§ 13
Liability and indemnity
Each party is liable for breaches of this DPA only to the extent provided in the Terms of Service. Nothing in this DPA limits any non-excludable liability under Applicable Data Protection Law (notably Article 82 GDPR rights of Data Subjects to compensation, which run directly against each Controller / Processor).
§ 14
Term and termination
This DPA takes effect on the later of (a) acceptance of the Terms of Service, (b) first use of the Services, or (c) execution of any signed counterpart. It remains in force for as long as WIA processes Personal Data on behalf of the Controller. On termination, WIA will at the Controller's election delete or return all Personal Data and existing copies, subject to retention required by Applicable Data Protection Law (notably HMRC tax records, fraud-prevention, and the verification record window).
§ 15
Governing law and contact
This DPA is governed by the laws of England and Wales and forms part of the Terms of Service. Disputes follow §25 of the Terms. Contact: hello@womeninart.com (subject: DPA). WIA's data-protection contact: Director, Women In Art Ltd, 73a Hampstead High Street, London NW3 1QX. Supervisory Authority: UK Information Commissioner's Office, ico.org.uk.