Privacy Policy
Last updated: 6 October 2026
This notice explains how we process the personal data of those who visit www.getinart.com, buy from it, join the Pro Programme or the Artists Programme, subscribe to the newsletter or contact us. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and, as the controller is established in Italy, Legislative Decree 196/2003 (Italian Personal Data Protection Code) as amended by Legislative Decree 101/2018. Cookies and similar technologies are described in the Cookie Policy.
1. Data controller
PRiNKO S.r.l., owner of the GetinArt brand
Via Enrico Forlanini 84 - 00012 Guidonia Montecelio (RM), Italy
VAT / Tax code IT10827671008
Email: support@getinart.com - PEC (certified email): prinko@pec.prinko.it
We have not appointed a Data Protection Officer. For any privacy matter you can write to the addresses above.
2. Data we process and where it comes from
Depending on how you use the site, we may process:
- Browsing and technical data: IP address, date and time of requests, browser and device data, pages requested. For anti-abuse limits we often keep only a fingerprint (hash) of the IP, not the address itself.
- Account data: first and last name, email, password (stored only as a one-way hash, never in clear text), phone, date of birth (optional), language and notification preferences. For business accounts: company name and VAT number.
- Data from Google: if you sign in with Google, we receive your Google identifier, name, email address and profile picture.
- Order data: recipient, delivery address and phone, products and configurations, amounts, payment method and status, order history and tracking. Card and PayPal details are entered directly with the payment providers and never reach us.
- Billing data: for private customers, the holder's name and tax code; for professionals, company name, VAT number, registered office, SDI code or PEC.
- Account activity: saved addresses, favourites, followed and rated artists, projects, Pro Programme applications (sector, expected volume, notes) and sample requests.
- Communications: content of emails, chat messages with the virtual assistant, "Notify me" requests (email and notes).
- Newsletter: email address and proof of consent.
- Content notices: name, email, whether you are the rights holder, link and description of the content, good-faith statement.
- Artists: the data described in section 9.
Data is provided by you, collected automatically while you browse, or received from Google (sign-in), from payment providers (payment outcome) and from the VIES and Italian tax register checks (validity of VAT number and tax code). If you ship an order to another person, you give us their name, address and phone: please make sure you are entitled to do so and let them know about this notice.
3. Purposes, legal bases and retention
| Purpose | Legal basis | Retention |
|---|---|---|
| Operation and security of the site: serving pages, protection against unauthorised access, spam and bots (rate limits, anti-bot checks), handling technical errors. | Legitimate interest in the security of the site (Art. 6(1)(f) GDPR). | For the technical time needed; longer only if required to establish an offence. Newsletter sign-up attempts are deleted after 30 days. |
| Registration and account management: sign-in, including with Google, email verification, address book, favourites, followed and rated artists, projects (business accounts), language and notification preferences. | Performance of a contract and pre-contractual measures (Art. 6(1)(b)). | Until you delete the account. On deletion the data is anonymised; an encrypted copy, not accessible in day-to-day operations, is kept for 10 years only to defend our rights or respond to authorities (Art. 6(1)(f)). |
| Orders: confirmation, production, shipping, tracking, status updates, returns, warranties and after-sales support. | Performance of the contract (Art. 6(1)(b)). | 10 years from the order (Art. 2220 of the Italian Civil Code and ordinary limitation period). |
| Invoicing and tax obligations: issuing the electronic invoice through the Italian Exchange System (SdI), applying VAT according to the destination country, checking the VAT number on the EU VIES system and the Italian tax code with the Italian tax register. | Legal obligation (Art. 6(1)(c)) and legitimate interest in issuing correct invoices (Art. 6(1)(f)). | 10 years (Art. 2220 of the Italian Civil Code and tax law). |
| Payments: collection by card (Stripe), PayPal or bank transfer, reconciliation, refunds and fraud prevention. | Performance of the contract (Art. 6(1)(b)) and legitimate interest in fraud prevention (Art. 6(1)(f)). | 10 years, together with the order. |
| Pro Programme for professionals and companies: assessing the application, reserved price list, sample requests. | Performance of a contract and pre-contractual measures (Art. 6(1)(b)). | For the duration of the relationship; sample requests that were shipped, like orders. |
| Customer service: replies to emails and messages, chat with the virtual assistant, back-in-stock alerts for a sold-out material ("Notify me"). | Steps taken at your request (Art. 6(1)(b)) and legitimate interest in answering requests (Art. 6(1)(f)). | For the time needed to handle the request; if it concerns an order, as long as the order. |
| Newsletter and promotional communications by email, with sign-up confirmed through a link (double opt-in). | Consent (Art. 6(1)(a) GDPR), which can be withdrawn at any time. | Until you unsubscribe. Unconfirmed sign-ups are deleted after 30 days. Proof of consent (accepted text, date, IP fingerprint, browser, page) is kept to demonstrate its validity. |
| Invitations to review your purchase: through Feedaty, which emails you after delivery, and through Google Customer Reviews, only if you accept it in the box shown after payment. | Feedaty: legitimate interest in collecting verified opinions on our products (Art. 6(1)(f)), with the right to object. Google: consent (Art. 6(1)(a)). | Data passed to the providers is kept by them under their own policies; on our side, as long as the order. |
| Analytics and advertising through cookies and similar tools (Google Analytics, Google Ads, Meta, Pinterest), including sending email and phone in hashed form to measure conversions. | Consent given in the cookie banner (Art. 6(1)(a) GDPR and Art. 5(3) ePrivacy Directive). | See the Cookie Policy. |
| Notices about content that infringes rights or is unlawful, sent through the dedicated form: review, reasoned decision, communication to the artist concerned. | Legal obligation (Regulation (EU) 2022/2065, Digital Services Act, Art. 16; Art. 6(1)(c)) and legitimate interest in protecting third-party rights (Art. 6(1)(f)). | For the time needed to handle the notice and until the limitation period of the rights involved expires. |
| Technical support on your account: if there is a problem, authorised staff may open your account area to see what you see. Every access is logged; during the session orders cannot be placed and the account cannot be deleted. | Legitimate interest in fixing malfunctions (Art. 6(1)(f)). | Access log: for the duration of the relationship. |
| Defence of rights in and out of court, debt collection, responding to requests from authorities. | Legitimate interest (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)). | Until the rights are time-barred (usually 10 years) or the proceedings end. |
Where processing is based on legitimate interest, we have assessed that it does not override your rights and freedoms, and you can object at any time (see section 11). When retention periods end, data is deleted or irreversibly anonymised.
4. Mandatory and optional data
Fields marked as required in the forms are necessary to create the account, process the order or issue the invoice: without them we cannot provide the service. All other data (for example phone in the profile, date of birth, notes) is optional. Consent to the newsletter, to Google Customer Reviews and to analytics and marketing cookies is always optional and refusing it has no effect on purchases.
5. How we process data
Data is processed with electronic tools, by staff authorised and instructed for that purpose, with technical and organisational measures appropriate to the risk, including: encrypted connections (HTTPS); passwords stored only as hashes; session cookies protected against reading by scripts; artists' identity documents stored outside the publicly accessible area of the server and visible only to administrators; encryption of the copy kept after account deletion; access to the back office restricted and protected by credentials.
6. Recipients
Data may be disclosed to the following categories of recipients, appointed as processors (Art. 28 GDPR) where they act on our behalf, or acting as independent controllers:
- hosting, IT infrastructure, email delivery and maintenance providers;
- couriers and shipping services, for delivery of orders;
- payment providers: Stripe, PayPal and the bank, for transfers;
- Google, for sign-in with Google, address autocomplete (Google Maps) and Google Customer Reviews;
- Feedaty, which receives name, email and order details to send you the review invitation;
- Botpress, provider of the virtual assistant chat;
- Openapi S.p.A., for the check of the Italian tax code against the tax register;
- the European Commission (VIES system), for checking EU VAT numbers;
- the Italian Revenue Agency, through the Exchange System (SdI), for electronic invoices;
- for artists only: PayPal for royalty payouts, Brevo for Programme communications, Google Cloud Vision for checking works online (see section 9);
- Google, Meta and Pinterest for analytics and advertising, only with consent (see the Cookie Policy);
- accountants, lawyers and other advisers, bound by confidentiality;
- public authorities and judicial bodies, where required by law.
Data is not disseminated except for the public artist profile (section 9) and is never sold.
7. Transfers outside the European Economic Area
Some providers (Google, Meta, Pinterest, Stripe, PayPal, Brevo's and Botpress's sub-processors) belong to groups based outside the EEA, in particular in the United States, while Botpress is based in Canada. Transfers take place in accordance with Articles 44 et seq. GDPR: on the basis of a European Commission adequacy decision (for the United States, the EU-U.S. Data Privacy Framework for certified companies; for Canada, the adequacy decision for commercial organisations) or, failing that, of standard contractual clauses (Art. 46 GDPR). You can ask us for information on the safeguards adopted.
8. Automated checks
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). At checkout, the tax code and the VAT number are checked automatically against the official registers: if a tax code turns out not to exist, we ask you to correct it before completing the order. If you believe the result is wrong, write to us and a member of staff will review it.
9. Artists of the Artists Programme
If you apply to or take part in the GetinArt Artists Programme, we also process the following data, as described in the Artists Programme Agreement:
- Short form and application: first and last name, email, phone, website and social profiles, biography, styles, sample works, whether you take part as a private individual or with a VAT number, preferred language, optional consent to promotional communications.
- Identity document: front and back of an identity document, requested when completing registration after approval, to identify the person receiving royalties and to prevent abuse. It is stored outside the public area of the server and is visible only to administrators.
- Tax and payment data: country, tax code or VAT number, address, PayPal email for royalty payouts (bank details only for artists who had already chosen bank transfer).
- Works and sales data: uploaded files and previews, Unique Work designations, sales, royalties, payouts, reversals, results of online checks on works.
- Evidence of acceptance: for each acceptance of the agreement or designation of a Unique Work, agreement version, date and time (UTC), IP address, browser data, interface language, tick-box status, verification of the code sent by email and a copy of the accepted text.
- Notices and withdrawal: content of any third-party notices concerning your works and related decisions; date and reason of any withdrawal from the Programme.
Legal bases: performance of the agreement and pre-contractual measures (Art. 6(1)(b)), including publication of your public artist profile, which shows name, images, biography, styles, links, works, user ratings and number of followers and is used to promote the works, the Programme and GetinArt; legal obligations for tax and accounting (Art. 6(1)(c)); legitimate interest (Art. 6(1)(f)) in identifying the artist, keeping evidence of acceptance, checking before publication that works are not copied (we send the image of the work to Google Cloud Vision, which searches for it online), handling notices, preventing abuse and defending our rights. Consent is required only for promotional communications, which are optional and can be withdrawn at any time.
Communications: application status and Programme communications are managed through Brevo, in lists dedicated to GetinArt; only those who gave consent are included in the promotional list.
Retention: for the duration of the relationship and afterwards for the time needed for tax obligations (10 years) and the limitation period of possible disputes (10 years from termination for evidence of acceptance and contractual data). In case of withdrawal, files of works are deleted 90 days after termination, except those needed for orders still open (Art. 14.4 of the agreement). The identity document is deleted when replaced by a new approved one and in any case when it is no longer needed for the purposes above. The name and email of reporting parties are not shared with the artist unless needed to handle the notice.
10. Minors
Registration and purchases are intended for adults. We do not knowingly collect data from persons under 18: if you believe a minor has provided us with data, write to us and we will delete it.
11. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- access your data and obtain a copy;
- obtain rectification of inaccurate or incomplete data;
- obtain erasure, unless we must keep it by law or to defend a right;
- obtain restriction of processing;
- receive your data in a structured, machine-readable format (portability);
- object at any time to processing based on legitimate interest and, without giving reasons, to processing for direct marketing;
- withdraw consent at any time, without affecting the lawfulness of prior processing.
Many actions you can take yourself: edit your profile or delete your account from the account area, unsubscribe through the link at the bottom of every newsletter, change cookie choices with the Cookie Settings link. For everything else write to support@getinart.com or to our PEC. We reply within one month, extendable by two further months for complex requests; we may ask for information to verify your identity.
You also have the right to lodge a complaint with the supervisory authority of the EU Member State where you live, work or where the alleged infringement took place. In Italy this is the Garante per la protezione dei dati personali.
12. Changes to this notice
We update this notice when the processing changes. The current version is always on this page, with the date of the last update. If changes are significant, we will inform registered users by email or with a notice on the site.