Privacy Policy

1. Who is responsible for your data

The data controller is Matthias Geis (NIF Z0050275W), Carrer Francesc de Borja Moll 31, 07360 Lloseta, Illes Balears, Spain. For any privacy question, contact mail@centurial.art. Given the scale of this project, a formal Data Protection Officer has not been appointed — the contact above handles all privacy requests directly.

2. What data we collect, and why

We only collect what each feature genuinely needs:

• Artwork submission: artist name, age, country (optional), email, artwork title and description (optional), the uploaded image, and — only for artists under 18 — a parent/guardian's name and email. Used to review, curate and display the exhibition, and to notify you of a decision by email.
• Newsletter sign-up: your email address only. Used solely to notify you when a new age is filled or when there is project news. Based entirely on your consent — the checkbox or sign-up field is never pre-ticked.
• Partner inquiries: company name, your name, email and message. Used to respond to your inquiry.
• Technical data: your browser automatically sends standard web request information (e.g. IP address) to our hosting providers as part of normal operation — see "Who we share data with" below.

3. Legal basis for processing

• Artwork submissions: performance of the arrangement you enter into by submitting (Art. 6(1)(b) GDPR), and our legitimate interest in curating and running the exhibition (Art. 6(1)(f)).
• Newsletter: your explicit consent (Art. 6(1)(a)), which you can withdraw at any time.
• Partner inquiries: our legitimate interest in responding to inquiries, and steps taken at your request prior to a potential agreement (Art. 6(1)(b)/(f)).
• Guardian data for minors: explicit parental consent, in line with Art. 8 GDPR on information-society services offered to children.

4. What becomes public

If your submission is approved, your artist name, age, country (if provided), artwork title, description and image become publicly visible on this website and may be shared on the project's social media and press materials. Your email address, guardian information and internal review notes are never made public.

5. Children's data

Because the exhibition invites artists of every age including minors, we require the name and email of a parent or legal guardian before accepting a submission from an artist under 18, and we ask the submitter to confirm they have that consent. We only use the guardian's contact details to communicate about the submission — never for marketing.

6. How long we keep your data

• Approved artworks and the artist information shown alongside them: kept for as long as the artwork remains part of the public exhibition, since removing it would alter the historical record of the project.
• Rejected or withdrawn submissions, and the associated private data (email, guardian details): deleted or anonymized once no longer needed for the review process, and in any case no later than 24 months after submission.
• Newsletter email addresses: kept until you unsubscribe or request deletion.
• Partner inquiries: kept for up to 24 months to allow for follow-up, then deleted.

7. Who we share data with

We do not sell personal data. We use the following processors to operate the site:

• Supabase (database and file storage) — our database and uploaded images are hosted in the EU (Frankfurt, Germany region).
• Vercel (website hosting) — a US-based provider; where any data is processed outside the EEA, this happens under Vercel's Data Processing Addendum and Standard Contractual Clauses.

8. Your rights

Under the GDPR, you can ask us to access, correct, delete or restrict the use of your personal data, object to processing based on our legitimate interest, and request a copy of your data in a portable format. To exercise any of these, write to mail@centurial.art. If you believe your rights have not been respected, you can file a complaint with the Agencia Española de Protección de Datos (AEPD) (https://www.aepd.es).

9. Cookies

This site only uses strictly necessary cookies, which do not require consent under applicable law: one to remember your language preference, and one (admin area only) to keep an administrator signed in. We do not use analytics, advertising or tracking cookies.

10. Security

We use industry-standard measures — encrypted connections, access controls and a password-protected admin area — to protect your data. No system is perfectly secure, and we cannot guarantee absolute protection.

11. Changes to this policy

We may update this policy as the project evolves. The date above shows the last revision; material changes will be reflected here.