Last updated: December 15, 2025

1. Data Controller

In accordance with the General Data Protection Regulation (GDPR) and the Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights, the data controller responsible for your personal data is:

2. Purpose of Data Processing

The personal data we collect through this website will be processed for the following purposes:

• Managing inquiries and communications made through the contact form
• Sending information about our services and content related to contemporary art (newsletter)
• Improving user experience through navigation analysis
• Complying with applicable legal obligations
• Administrative and accounting management

3. Legal Basis for Processing

The processing of your personal data is based on:

• Consent of the data subject: For sending commercial communications and newsletters
• Performance of a contract: When you request information or services
• Legitimate interest: For statistical analysis and website improvement
• Compliance with legal obligations: For compliance with applicable tax and legal regulations

4. Personal Data Collected

We may collect the following categories of personal data:

• Identification data: First name, last name, email address
• Navigation data: IP address, browser type, pages visited, time spent
• Contact data: Phone number (when voluntarily provided)
• Technical data: Device information, operating system, language preferences

5. Cookies and Similar Technologies

This website uses cookies and similar technologies to enhance your browsing experience and analyze traffic. Cookies are small text files that are stored on your device when you visit our site.

Types of cookies we use:

• Technical cookies: Necessary for the website to function
• Analytics cookies: To understand how users interact with the site (Google Analytics or other tools)
• Preference cookies: To remember your language and region settings

You can configure your browser to reject all cookies or to indicate when a cookie is being sent. However, if you do not accept cookies, you may not be able to use all features of this website.

6. Data Recipients

Your personal data will not be transferred to third parties, except when legally required. However, we may share your data with the following service providers who act as data processors:

• Hosting and cloud storage service providers
• Web analytics tools (such as Google Analytics)
• Newsletter and email communication platforms
• Website management and technical maintenance services

All these providers are contractually obligated to ensure the protection and confidentiality of your personal data.

7. International Data Transfers

Some of our service providers may be located outside the European Economic Area (EEA). In such cases, we ensure that adequate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission or recognized certification mechanisms (such as the EU-US Data Privacy Framework).

8. Data Retention Period

Personal data will be retained for the following periods:

• Contact data: Until you request deletion or withdraw your consent
• Newsletter data: Until you unsubscribe
• Navigation data and cookies: Maximum 2 years from the last interaction
• Data for legal obligations: For the period established by applicable legislation (generally between 4 and 6 years)

After these periods, the data will be securely deleted or anonymized.

9. Data Subject Rights

In accordance with the GDPR, you have the right to exercise the following rights regarding your personal data:

• Right of access: Obtain confirmation of whether we are processing your personal data and, if so, access to it
• Right to rectification: Request correction of inaccurate or incomplete data
• Right to erasure ("right to be forgotten"): Request deletion of your data when it is no longer necessary
• Right to restriction of processing: Request that processing of your data be limited in certain circumstances
• Right to data portability: Receive your data in a structured, commonly used format
• Right to object: Object to the processing of your data, especially for direct marketing purposes
• Right not to be subject to automated decisions: Not to be subject to decisions based solely on automated processing
• Right to withdraw consent: When processing is based on consent, you may withdraw it at any time

To exercise these rights, you can send a request by email to office@artestra.eu, attaching a copy of your identity document.

10. Right to Lodge a Complaint

If you believe that the processing of your personal data does not comply with current regulations, you have the right to lodge a complaint with the competent supervisory authority:

11. Data Security

We have implemented appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or accidental alteration. These measures include:

• Data encryption using SSL/TLS protocol
• Restricted access control to personal data
• Regular backups
• Staff training on data protection
• Regular security audits

12. Links to Third-Party Websites

This website may contain links to third-party websites. We are not responsible for the privacy policies of these external sites. We recommend that you read the privacy policies of each website you visit.

13. Minors

This website is not directed at children under 14 years of age. We do not knowingly collect personal data from children under this age. If you become aware that a child has provided personal data without parental or guardian consent, please contact us so that we can delete it.

14. Changes to the Privacy Policy

We reserve the right to modify this Privacy Policy at any time to adapt it to legislative, jurisprudential changes, or changes in our business practices. Any modifications will be published on this page with the date of the last update. We recommend that you review this Privacy Policy periodically.

15. Contact and Data Protection Officer

For any inquiries related to the processing of your personal data or to exercise your rights, you can contact us:

This Privacy Policy complies with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Spanish Organic Law 3/2018, of December 5, on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).