Privacy Notice

Privacy Notice

We, Vortic Limited (referred to as we, our or us) are committed to protecting your privacy and personal information. This privacy notice provides information on how we collect and process your personal data when you use the Vortic platform, website, VR or mobile applications(together our Services) contact us or have a relationship with us.

This privacy notice was last updated on 19 March 2024 and may be updated over time. You are recommended to check it regularly for possible changes.

Our Services are intended only for individuals 18 years old or older. If you are under 18, please ask for permission from your parent or guardian before accessing our Services.

If you have any questions about this privacy notice or how we use personal data, please contact our data
privacy manager on support@vortic.art

1. Who we are and when we are responsible for your personal data

We are an application and platform company based in London, UK. We have developed the Services to bring you the highest quality extended reality digital viewing of artwork from galleries, institutions, collaborations, exhibition, and event and other client partners around the world (our Clients). We are the controller (ie we make decisions about how your personal information is used) when we make decisions on how your personal information is used in connection with our Services, for example when you register for our Services (as an end user), use our Services as a Client, sign up for newsletters, contact us via our websites and when we have a direct relationship with you. This privacy notice explains how we process and use your personal information where we are responsible for it as a controller.

2. Where Clients and other third parties are responsible for your personal data

We provide services to our Clients where they are responsible for managing exhibitions, events and collaborations and they are responsible for managing personal information through our Services, for example, to invite you to an exhibition, join an event, curate an exhibition or to interact with you through the Service, if, for example you wish to ask about an artwork. In these circumstances, our Clients control how your personal information is used and we follow their instructions (as processor) as part of the Services we provide. Please see our Client’s privacy policies and notices for more information and contact them directly if you have any
questions or concerns about the use of your personal information or to exercise your privacy rights.

This privacy notice does not apply to products or services offered by our Clients, social media platforms or other websites which we link to. We are not responsible for how your personal data is used by these organisations, websites or applications and please see their privacy policies to understand how your personal
data is used.

3. The data we collect about you

We may collect, use, store and transfer personal data about you, if you:

● use our Services (as an end user);

● if you are or represent a Client;

● access our website or communicate with us through it; or

● if you otherwise connect or have a relationship with us.

End users

We collect, use and store the following information on end users when you use our Services:

● information that can identify you, such as your name and username when you register for the
Services;

● contact details, including your email and phone number; and

● other information you might provide when signing up to newsletters and using (or sending messages through) the Services.

We may also obtain and use:

● technical data;

● analytical and usage data; and

● information on your personal preferences (including which galleries, exhibitions or artworks you might
chose as your favourites);

● information from social media platforms when you connect with us; and

● any other personal information that you may provide to us or we may require in order to deal with your
enquiry.

Where you register with us, you may be able to access exclusive content and exhibitions on our Services.

You may use our Services without registering with us and in which case, the information we hold on you may be limited to technical and analytical information about how you use the Services. We will not know your name and contact details unless you register for the Services or connect with us in another way.

Clients

When you use our Services as, or on behalf of a Client, you will normally provide us with information about your identity and contact details, which may also include your address, email address and social media accounts (if this might be personal data).

Where you provide information about third parties into the Services (including about the exhibition and/or event or collective organisers, collectors, other contacts that you invite to the Services and information on artists, which you include in the Services), please ensure that any personal information on these individuals is accurate and up to date and is provided to us with their knowledge and consent (as required under our contract with you and/or by applicable law) and with their knowledge of how we will use their information.

Artists

Our Clients may provide information on artists into our Platform and via our Services. If so, the Client is responsible for, and is able to manage your personal information, not us, so please contact them first. We will manage your information if you are a user of our Services or are a Client.

4. How we use your personal data

End users

We use your personal data for the purposes for which we collected it which include the following:

● to register you as a user of our Services (to set you up with a contract with us);

● to provide you with our Services and access to artwork in extended reality (in public and private
galleries, depending on whether you have registered with us) (in performance of our contract with you);

● to manage your relationship with us, including to provide you with service updates, support or to ask
you for feedback or a review on our Services (in performance of our contract with you and for your and our
legitimate interests in ensuring you are able to optimise use of our Services);

● to analyse and improve our Services and user relationships (either for performance of our contract or
for our legitimate interests in reviewing how people use our Services and to improve our Services);

● to enable you to communicate with us, Clients and/or event or collective organisers;

● to recommend exhibitions, events and our similar products or services which may be of interest to
you, when you opt-into receiving these notifications from us (with your consent, described below);

● to enforce or defend any legal obligation or rights or to comply with any legal obligation.
Newsletters and Updates on Exhibitions, Events and Services

We will send you newsletters when you sign up for them.

Registered users can choose to receive updates on exhibitions, events and our services when you register
or by managing your preferences. You may also receive notifications through the Services, if you agree to this when you obtain and first use the Services. You may be able to set some preferences in settings on your device.

You may opt-out of these messages at any time via an unsubscribe link or by contacting support@vortic.art. We will continue to send you service messages and support you if you ask for us to do so.

We value your views on our Services. You agree that we may freely use any feedback you provide for our internal business purposes such as improving our Services and their features and functions. We will not share your feedback and identify you in our marketing messages, unless you consent for us to do so.

How we use technical information and analytics

We sometimes use data analytics to analyse and research how our Services are used to evaluate the use of our Services and so we can improve our Services.

Some information may be shared with Clients, for example, where you visit our Client’s pages on our Services. Information may be shared with event or collective organisers, where an exhibition is part of a bigger event. Where possible, information shared with our Clients and partners about usage of the Services will be on an anonymous basis.

Please see our Cookie Policy below for more information.

Clients

Where you are our contact at or on behalf of a Client and/or an event or collective organiser or are registered as a user of our Services (as an authorised user), we will collect and use your personal information when you enquire about our Services, when you sign up as a Client and download and use our Services.

We use your personal information for the following reasons:

● to respond to your enquiries, including to demonstrate our Services;

● to register you as a user of our Services to enable you to access and use our software (to set you up with a contract with us);

● to provide you with our Services and to enable you to showcase artwork shown by galleries you represent in extended reality (in public and private exhibitions) (in performance of our contract with you);

● to manage your relationship with us, including to provide you with service updates, support or asking you for feedback or a review on our Services (in performance of our contract with you and for our legitimate interests in ensuring you are able to optimise use of our Services);

● to use data analytics to improve our Services and user relationships (either for performance of our contract or for your and our legitimate interests in reviewing how people use our Services and to improve our
Services);

● to enforce or defend any legal obligation or rights or to comply with any legal obligation, including for payment and tax reasons.

Artists
We may use your personal information as an end user where you use our Services, if you use our Services
to run your own exhibitions (as a Client or in association with one or more of our Clients) and, in which case,
we will process and use your personal information as described above.

Keeping Clients and Artists Informed
Where you contact us or we have a direct relationship with you as our contact at, or on behalf of, a Client or
an artist, we may also keep in touch with you about our developments, services and opportunities, which we
think you may be interested in, unless you tell us that you prefer not to receive these. We believe that is what
you might expect and that such use is within your and our legitimate interests. You may opt-out of receiving
these messages at any time. Please note we will continue to provide you with service updates and support.

Our legitimate interests: Where we rely on our legitimate interests in using personal data, we consider our
interests in conducting, managing and developing our business to enable us to give you the best service.
We consider and balance any potential impact on you and your rights and ensure that this use is fair,
proportionate and in line with what you might expect and is unlikely to unfairly affect your rights and interests.

5. How we share your personal data

Clients

Our Clients may access, use and control the use of your personal data where they are responsible for this. As part of our Services to our Clients, we may share information with them, so we and they can provide you with the best service when using the Services.

Our Clients are responsible for how your personal information is used and you should contact them to find
out more and/or to exercise your rights.

Payment providers

We use payment providers, for example Stripe and
Service providers. We use third parties to process some of your personal data on our behalf. When we allow them access to your data, we do not permit them to use it for their own purposes. We have in place with each processor, a contract that requires them only to process the data on our instructions and to take proper care in using it.

They are not permitted to keep the data after our relationship with them has ended, unless required by law. If you connect or communicate with us using social media, for example, Instagram, Twitter or Facebook, your personal information will be shared with us and the social media platform. We may be able to communicate with you using that platform (for the reasons explained above) but we are not otherwise responsible for the ways in which these platforms might use your personal data.

Please look at the privacy notices and preference centres available on these platforms to understand how your personal data is used and what options you might have in respect of it.

We use the following service providers:

● Amazon Web Services – to provide hosting services;

● Hubspot – to provide a contact relationship management tool for marketing purposes);

● Twilio SendGrid – to send emails;

● Google Analytics – to provide data analytics on how our web and mobile Services are used;

● HotJar – to provide insights and understanding on how users experience our web Services;

● Unity Application Portal – to get analytics on crash reports specific to VR devices

● to provide authorised contractors and third party companies involved in the development, build,
operation and optimisation of our Services;

● authorised third party companies involved in processing of information generated by use of the
Services, for example, to manage our communications;

● authorised service providers to provide maintenance and support, including customer support;

● other service providers which may be used from time to time. We will update this page with details
of any major service providers (or categories of service providers) who may have access to personal
information.

6. International transfers

We may transfer, store and process your personal data to countries outside of the UK or European Economic
Area. If we do so, we ensure there are appropriate safeguards in place to protect it.

7. Data security

We have appropriate security measures to prevent your personal data from being accidentally lost, used or
accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal
information to those employees, agents, contractors and other service providers who need to know this
information and will keep it confidential.
We also take reasonable steps to protect personal data from external threats, for example hacking or
malicious software. Please be aware that there are always risks in sending personal information over public
networks and that we cannot guarantee the security of data sent to us using these networks.
We hope that we will not suffer any data breaches or cyber attacks. We have procedures in place if any
breach is suspected and will let you know about any serious incidents so you can take appropriate action.

8. Data retention

We only keep your personal information for as long as you are registered with us, use our Services, have a relationship with us, or as is necessary for us to perform our obligations or if we need to enforce or defend any legal claims or as is required by applicable law.

To determine how long we might keep personal information, we consider what and how much information we hold, how sensitive it might be, our relationship with you, why we hold your information and any potential risks associated with keeping it. We take into account applicable legal regulatory, tax, accounting or other requirements.

By law we have to keep basic information about our end users and Clients (including information about your identity, contact details and any transaction and payment details) for six years after you end your contract or relationship with us, which may include for tax purposes. If we no longer need your personal information, it will be securely disposed of or anonymised.

9. Your data protection rights
You have rights to access the information that we hold on you, correct it and (in certain circumstances) to ask us to limit or stop processing or delete that information or to transfer that information to you or another provider.

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information.

Your right to rectification – You have the right to ask us to correct information you think is inaccurate. You
also have the right to ask us to complete information you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal information in certain
circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances.

Your right to object to processing – You have the right to object to the processing of your personal data in
certain circumstances.

Your right to data portability – You have the right to ask that we transfer the information you gave us to
another organisation, or to you, in certain circumstances.

Your right to opt-out – California residents have the right, at any time, to direct us not to sell the your personal information to third parties. We are not in the business of selling consumer information to third parties, we only use and share your personal information as described in this notice. You may still send a “Do Not Sell My Info” request to us at any time by clicking the email link below to make your request, or mail
your request to our address listed under “CONTACT DETAILS” below.

You are not normally required to pay a fee to exercise your rights. If you make a request, we will try to respond
to you within fifteen days from receipt of your request. It may take longer if your request is complex or if you
have made a number of requests. If this is the case, we will let you know and keep you updated.

Please contact us at support@vortic.art if you wish to make a request.

10. Further details and how to contact us

This privacy notice complies with our obligations under UK data protection laws (as updated from time to time). If you are located elsewhere in the world, local laws may apply.

If you have any further questions, comments or if you have any complaints, please contact our data privacy
manager as detailed below. If we are unable to answer your question or satisfy your request, you have the
right to make a complaint at any time to the Information Commissioner’s Office (www.ico.org.uk).

CONTACT DETAILS
Our contact details are: Vortic Limited, 14 Wharf Road, London, N1 7RW

Data privacy manager: Nick Walter

Email address: support@vortic.art

Cookie policy: Our use of cookies and other tracking technologies

We use identifiers which are small text files which may be transferred to your device when you use our
Services. On our website, these are often called cookies.

On our Services, we use cookies or other identifiers to:

● recognise you so you do not need to log in again;

● help us understand how the Services are used by end users so we can share this information with
our Clients and/or event or collective organisers and we can make the Services better;

● help us understand how the Services are used by Clients so we can manage our account with Clients,
support you and improve and develop our Services; and

● remember your favourites, preferences and settings.

The types of identifiers we may use include:

On our Services: to understand when end users have received invitations to join the Services and are able to access and register with us and so we can understand how you use the Services, which might include login and session times, which exhibitions, artists, artworks and galleries are viewed and how long for and to remember your favourites and other page views and navigation and if you might wish to inquire about artwork
to receive more information.

On the Platform: to ensure our Clients and authorised users are able to register and log in correctly and to understand the use of the Services by galleries including the creation of artist, gallery and exhibition pages and the uploading and management of art works. We believe this is necessary for use of our Services so we can provide you with our Services and support you and provide you with feedback on how the Services are used. This is also helpful for us and you to improve our Services.

On our websites, we may use the following cookies:

● Strictly necessary cookies. These are cookies that are required for the operation of our websites, for example when you navigate our websites and set up and register for our Services.

● Analytical or performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our websites when visitors are using them. This helps us to improve the way our websites work, for example, by ensuring that users are finding what they are looking for easily.

● Functionality cookies. These are used to recognise you when you return to our websites. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

● Targeting cookies. These cookies record your visit to our websites, the pages you have visited and the links you have followed. We will use this information to make our websites and the advertising displayed on them more relevant to your interests. We may also share this information with third parties for this purpose.

We use Google and other providers to help provide data analytics and you can see more information on how
data is used by Google: www.google.com/policies/privacy/partners/.

You can set your preferences for the use of these identifiers and cookies and/or via the available settings
within Google (here: https://adssettings.google.com) and/or your browser.

“Do Not Track” Browser Settings Not Supported. Efforts to enable web browsers to recognize a “Do Not Track” setting by users have not been widely adopted or made mandatory by regulation. As a result there are no clear standards or guidelines for interpreting the setting and our systems do not respond to “Do Not Track” signals from browsers.