Privacy Policy

1. Who manages the data

ATRIUM Digital Museum is an independent digital museum of visual art, founded in Riga, Latvia.

ATRIUM is operated by SIA “BALTIC SURVEY”, registration No. 40103349018, VAT No. LV40103349018, registered address: Baltāsbaznīcas iela 34-31, Rīga, LV-1015, Latvia. These details match the Latvian Enterprise Register.

Privacy enquiries: info@atriumart.net.

2. What data is collected

Depending on how you use ATRIUM, we may process account data (such as name, email, country, city, language and time zone), authentication data, author-profile data, uploaded artworks and related metadata, exhibition drafts, comments or other user content you submit, and limited analytics events about museum use.

A purchase request collects the buyer’s name, email address, optional message, the requested work and its ATRIUM registration number, the published price, and the time of the request. ATRIUM does not collect payment-card numbers. Sending a request is not an online payment.

3. Why data is used

We use personal data to create and operate your account, authenticate you, provide museum and author-studio features, display public author information you choose to publish, host exhibitions, improve the service through aggregated analytics, and respond to requests or legal obligations.

Purchase-request data is used to receive and review the request, reply to the buyer, tell the artist that a request has arrived, keep the administrative queue, and meet accounting, tax and consumer-law duties if a sale is later confirmed.

4. Account and profile data

Visitor accounts include the details you provide at registration. Those details are private by default.

If you create an Author Profile, professional fields such as public name, country, city and biography are intended to become public after the profile is published.

5. Public profile data

Published author pages may show the public name, biography, location, selected contact details you have chosen to display, and associated exhibitions or artworks.

You control optional public contact visibility in account settings where that feature exists.

6. Uploads

Artworks and related files you upload are stored in order to operate the museum, including drafts, previews and published exhibitions.

Technical copies such as thumbnails or optimised images may be created for display and performance.

7. Analytics

ATRIUM records limited operational analytics (for example exhibition entries, artwork views or auto-tour starts) to understand museum use.

Analytics is intended to be privacy-conscious. Raw visitor events are not exposed in the public museum interface.

8. Comments and user content

If you submit guestbook messages or similar user content, that content is processed to display and moderate it according to ATRIUM’s museum features.

9. Legal bases

Museum accounts and features are processed to provide the service a person asked for (GDPR Article 6(1)(b)).

A purchase request is processed to take steps at the buyer’s request before a possible contract, and to perform that contract if ATRIUM confirms the sale (GDPR Article 6(1)(b)).

Accounting, tax and consumer-information duties are processed because the law requires them (GDPR Article 6(1)(c)).

Security, abuse prevention and the record of a failed email are processed for legitimate interests, and only as far as those purposes need (GDPR Article 6(1)(f)).

10. Processors

Supabase stores account data, artwork files and purchase requests, and provides authentication.

Resend sends transactional email, including the notice of a purchase request and the buyer’s confirmation.

Vercel hosts the website and processes the technical data needed to deliver the pages.

These processors act on ATRIUM’s instructions. ATRIUM does not sell personal data.

11. Retention

Account data is kept while the account is active and for a reasonable period afterwards if needed for security, disputes or legal duties.

If an Author requests removal of public display, ATRIUM will stop further public showing within a reasonable technical period, while backup copies may remain temporarily until scheduled deletion.

An open purchase request is kept until it is closed. If it closes without a sale, ATRIUM keeps it for up to 12 months so a duplicate request can be recognised, and longer only while a complaint about that request is open. If a sale is confirmed, the related record is kept for five years, the period Latvian accounting rules set for source documents, and for as long as a dispute about that sale remains open.

12. Your rights

You may ask to access, correct, delete or restrict personal data, object to processing based on legitimate interests, and request portability where the GDPR gives that right.

To exercise these rights, contact info@atriumart.net. You may also complain to the Data State Inspectorate (Datu valsts inspekcija), Elijas iela 17, Rīga, LV-1050, https://www.dvi.gov.lv.

13. Contact for privacy requests

Privacy enquiries: info@atriumart.net.

Operator: SIA “BALTIC SURVEY”, registration No. 40103349018, VAT No. LV40103349018.

Registered address: Baltāsbaznīcas iela 34-31, Rīga, LV-1015, Latvia.