Personal information belongs in careful hands.

Who we are

Exhibity.co.uk is operated by Colin Wood, trading as Exhibity.co.uk, of Unit 161724, PO Box 7169, Poole, BH15 9EL, who is the data controller for the information described in this notice.

1. Information Exhibity may hold

• names and contact details for Art Organisation Administrators and Art Exhibition Administrators (as defined in the Service Terms), artists and volunteers;
• organisation membership, exhibition roles and stewarding availability;
• artwork entries, images, prices, acceptance decisions and location records;
• sales, price corrections, refunds, commission and payout records;
• account, invitation, security and audit information;
• names and email addresses of buyers, where a buyer chooses to share them with the organisation or artist;
• accident-book entries an organisation records, and feedback or problem reports submitted by signed-in users;
• messages sent through the protected website enquiry form.

Exhibity does not process a buyer's card payment. The organisation's separate point-of-sale provider handles that payment.

2. Why it is used

Information is used to provide and secure Exhibity, invite authorised users, run the exhibition stages selected by the organisation, keep accurate sales and payout records, respond to enquiries, support users and meet legal obligations.

The lawful bases for these uses are performance of a contract, legitimate interests in operating and protecting the service, and compliance with legal obligations. Consent is used only where it is genuinely the appropriate choice, for example when someone chooses to join a mailing list.

3. Art organisations and Exhibity

An organisation decides much of the artist and volunteer information entered for its exhibition and who may see it. Exhibity processes that information on the organisation's behalf to provide the organisation's own exhibition service, while account, billing and website-enquiry information is held by Exhibity in its own right.

Role-based access is intended to show people the information needed for their part in the exhibition, rather than exposing the entire organisation record.

4. Who information is shared with

Information may be shared with authorised people in the relevant organisation and with carefully selected suppliers that provide hosting (Cloudflare), account sign-in (Clerk), encrypted backup storage (Backblaze), and outbound email delivery (ZeptoMail for the Exhibity service, Resend for website enquiries). It may also be disclosed where the law requires it or where necessary to protect people, records or the service.

If a Coordinator uses the label style tool, a photo of a sample label is sent to Anthropic (Claude) to detect its visual style. The request asks Claude's model not to read out the specific artist, title or price shown, but the photo may still contain that text, and Exhibity does not control Anthropic's own data retention terms for API requests.

Some of these suppliers may process information outside the United Kingdom. Where that happens, appropriate safeguards required by data protection law, such as approved standard contractual clauses, apply to that transfer.

Exhibity does not sell personal information or add website enquirers to a marketing list.

5. How long information is kept

Exhibition, sales, payout and audit records are kept for 6 years from the end of the exhibition they relate to, to meet accounting, tax and dispute-handling obligations, then deleted. A website enquiry that does not lead to an account being created is deleted after 12 months.

Organisations should download records they are required to retain before their Exhibity data is scheduled for deletion.

6. Cookies and similar technology

The public website and app may use strictly necessary cookies for security, sign-in and the operation of requested features. Non-essential analytics or marketing cookies will not be introduced without an appropriate choice and an updated cookie notice.

If you vote in a public exhibition poll, we set a Visitor Vote Cookie (exhibity_voted_<exhibition>) for 90 days to prevent repeat voting from the same browser.

7. Your rights

Depending on the circumstances, a person may ask for access to their personal information, correction, deletion, restriction, objection or a portable copy. They may also complain to the UK Information Commissioner's Office.

Use the protected contact form to make a privacy request. Do not include a password, recovery code or payment-card information.