Virtual Exhibition
Artist Login
Sign Up

Privacy Policy

Last updated: 25/02/2026
Data Controller: Institute of Entrepreneurship Development (iED)
Contact: support@exhibition.achieveccs.eu
DPO: Tsakiridis Dimitrios, dpo@entre.gr

  1. What data we collect

We collect data in these categories:

1.1 Account & identity data

  • name, username/display name, email, password (hashed), role (e.g., artist/creator), profile photo
  • optional profile fields (bio, location/country/city, website/social links, professional info)

1.2 Creative work & publication data

  • creative works you submit: titles, descriptions, year, type/medium, categories/tags, custom fields relevant to the work type (e.g., music metadata such as BPM/tempo, credits; visual arts metadata such as materials, edition; and similar)
  • co-creator associations (linking a work to one or more user accounts)
  • files you upload: images, audio (e.g., mp3), video, documents
  • external platform links you provide (e.g., Spotify/SoundCloud/portfolio URLs)

1.3 Usage & device data

  • IP address, device/browser info, pages viewed, timestamps, actions (login, submissions, edits), referrer URLs

1.4 Communications

  • support messages, emails you send us, and any related logs

1.5 Cookies and similar technologies

  • described in our Cookie Policy
  1. Why we process your data (purposes) and legal bases

We process personal data for:

  1. Providing the platform and your account (authentication, profile display, publishing works)
    Legal basis: contract (Art. 6(1)(b) GDPR)
  2. Running the virtual exhibition / multi-space features (rendering content, public pages, co-creator display)
    Legal basis: contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) where appropriate
  3. Moderation, security, fraud prevention, and abuse detection
    Legal basis: legitimate interests (Art. 6(1)(f)) and legal obligation where applicable (Art. 6(1)(c))
  4. Support and communications
    Legal basis: contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f))
  5. Analytics and platform improvement (where cookies/trackers require consent)
    Legal basis: consent (Art. 6(1)(a)) and/or legitimate interests (Art. 6(1)(f)) depending on tool and local law
  6. Legal compliance (accounting, responding to authorities, handling complaints)
    Legal basis: legal obligation (Art. 6(1)(c))
  1. Who can see your data (public vs private)
  • Public by default (if you choose/public settings): your display name, profile, creative works, media previews, metadata, and co-creator attribution may be visible to visitors and searchable/indexed.
  • Private: your email, password hash, internal identifiers, and most logs are not public.

You can request changes to visibility where available. If you publish content publicly, copies may be cached by search engines or third parties—removal can take time.

  1. Recipients of your data (processors and partners)

We share data only as needed with:

  • hosting and infrastructure providers (servers/CDN/storage)
  • email delivery and support tools
  • analytics providers (only according to your cookie choices)
  • moderators/administrators with access controls
  • authorities or advisors where legally required

A list of key processors can be provided upon request: support@exhibition.achieveccs.eu

  1. International transfers

If any providers process data outside the EEA, we use appropriate safeguards (e.g., EU Standard Contractual Clauses) and additional measures where required.

  1. Data retention

We keep data only as long as needed:

  • account data: while your account is active
  • published content: until you delete it or delete your account (subject to backups/caching)
  • logs/security records: typically [30–180 days] unless needed longer for security incidents or legal claims
  • support communications: typically 12 months
    Backups may persist for a limited period 30–90 days.
  1. Your rights under GDPR

You have the right to:

  • access your data
  • rectify inaccuracies
  • delete data (“right to be forgotten”), where applicable
  • restrict processing
  • object to processing based on legitimate interests
  • data portability (for data processed by contract/consent, where technically feasible)
  • withdraw consent at any time (doesn’t affect past processing)

To exercise rights: support@exhibition.achieveccs.eu
You also have the right to lodge a complaint with your local Data Protection Authority.

  1. Security

We use appropriate technical and organizational measures (access controls, encryption in transit, backups, least-privilege access, monitoring). No system is 100% secure; you use the platform at your own risk.

  1. Children

The platform is not intended for children under 18. We will delete accounts if we learn they belong to children below the applicable age.

  1. Changes

We may update this Privacy Policy. Material changes will be notified via the platform or email.