Privacy Notice
How Queer Art collects, uses, shares and retains personal data, and how you can exercise your rights.
Effective and last updated: 25 August 2026
At a glance
Asociación Queer Media is the data controller for Queer Art.
We do not sell personal data or use solely automated decisions with legal effects.
You can request access, correction, deletion or another GDPR right through our form.
Controller and contact
The controller is Asociación Queer Media, Calle de Granada, 10-6C, 28007 Madrid, Spain. Privacy requests can be submitted through the contact form. Please select “General enquiry” and state that your message concerns data protection.
Data we process
- Contact and identity data: name, email, message and information you choose to provide.
- Artist and artwork data: profile, biography, links, images, captions, rights confirmations, moderation history and public portfolio.
- Account and community data: login email, authentication records, portal actions, messages, greetings and notification preferences.
- Payment and service data: order, artist, amount, status, dates and transaction reference. Card details are processed by Stripe and are not stored by Queer Art.
- Newsletter data: email, subscription status and related engagement information where available.
- Technical data: IP address, device/browser information, security logs, page events and cookie choices.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Respond to enquiries and Open Call submissions | Steps requested before a relationship; legitimate interests |
| Operate Artist Portal, moderation and community | Performance of our relationship with the artist; legitimate interests in a safe gallery |
| Process and deliver paid promotion | Contract; tax and accounting obligations |
| Send login, moderation, payment and service notices | Contract and legitimate interests |
| Send newsletters or promotional news | Consent, or another lawful basis where specifically permitted; you may opt out |
| Security, fraud prevention and legal claims | Legitimate interests and legal obligations |
| Non-essential analytics and embedded services | Consent |
How we obtain data
Most data comes directly from you through forms, the Artist Portal, checkout and communications. Selected artists may also provide public professional information during an Open Call. Technical data is generated by your use of the Site and its security infrastructure.
Recipients and service providers
Access is limited to authorised people and providers that need the data to deliver their service. These may include website hosting and WordPress/WooCommerce infrastructure, Stripe for payments, MailerLite for newsletter subscriptions, FormDesigner for Open Call forms, email delivery, security and backup providers, and Google Analytics only under the applicable cookie choice.
We may disclose data to advisers, courts or public authorities where legally required. We do not sell personal data.
International transfers
Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, the European Commission’s Standard Contractual Clauses, or another lawful safeguard. Provider documentation may contain more detail about the locations and safeguards used.
Retention
- Contact and unsuccessful Open Call material: only as long as needed to respond, assess the submission and handle related claims.
- Artist accounts, approved portfolio and moderation records: while the artist relationship is active, then for a limited period needed for disputes, rights records and backups.
- Community messages: while needed for the feature, safety and moderation, subject to earlier deletion where appropriate.
- Orders and accounting records: for the period required by Spanish tax and commercial law, generally up to six years.
- Newsletter data: until consent is withdrawn or the address is suppressed to honour an opt-out.
- Security logs and rate-limit records: for short operational periods unless an incident requires longer retention.
Backups may retain deleted data temporarily until they rotate out and are not used for ordinary processing.
Your GDPR rights
Depending on the circumstances, you may request access, rectification, erasure, restriction, portability, or object to processing based on legitimate interests. You may withdraw consent at any time without affecting earlier lawful processing. We may need information to verify your identity before acting on a request.
You may also complain to the Spanish Data Protection Agency (AEPD) or the competent authority where you live or work.
Children, automated decisions and updates
The Site is not designed to collect children’s data without an appropriate legal basis and, where required, parental authorisation. We do not make decisions producing legal or similarly significant effects solely by automated means.
We update this Notice when processing or legal requirements materially change. The date at the top identifies the current version.
These pages are designed to make the rules understandable. Mandatory rights under applicable law always take priority where they provide greater protection.