InnextartLog in

Privacy notice

Last updated: 6 October 2026.

This notice explains how Innextart processes personal data on innextart.com, under Article 13 of Regulation (EU) 2016/679 (GDPR).

1. Controller

Innextart S.R.L., Via Fondazza 53, 40125 Bologna (BO), Italy, VAT number 04063221206. Contact: info@innextart.com.

2. What we process, why, on what legal basis and for how long

a. Browsing data

Data: IP address, the pages and files requested, the time of the request, the response code and size, and the browser and operating system.

Purpose: to deliver the site, keep it secure and check that it works. The data is not used to identify visitors.

Legal basis: our legitimate interest in running a working and secure site (Article 6(1)(f)).

Retention: server logs are deleted after 7 days, unless needed to investigate an attack on the site.

b. Error reports

Data: when a page or request fails, a report with the address requested, the browser, the time and, if you are logged in, your account ID.

Purpose: to find and fix errors. Legal basis: legitimate interest (Article 6(1)(f)). Retention: 90 days.

c. Company accounts and Contacts

Data: for each company: name, sector, address, country, tax ID and, for Italian companies, PEC address and SDI code. For each Contact of a company or an institution: name, email address, role and a password, stored only as a hash.

Purpose: to give Contacts access to the platform, prepare quotes and manage Contracts.

Legal basis: performing a contract, or steps taken before one at the company's request (Article 6(1)(b)).

Retention: while the account is active, and deleted within 12 months after it is closed, except for what is part of a Contract (see d).

d. Proposals and Contracts

Data: each Proposal and its PDF, who submitted it and when, and the institution's answer with its reasons; the Contract and its PDF, who accepted it and when, and who changed its status and when.

Who sees it: Innextart staff and the institution named in the Proposal. A company sees its own Proposals and Contracts.

Purpose: to put the Proposal to the institution, perform the Contract and keep the records the law requires.

Legal basis: steps taken at the company's request before a contract, and performing the contract (Article 6(1)(b)); our legal obligations on accounting and tax records (Article 6(1)(c)).

Retention: a rejected Proposal, or one the institution did not answer in time, 2 years from the answer or the deadline. A Contract, 10 years after it ends (Article 2220 of the Italian Civil Code); an accepted Proposal is kept as part of its Contract. Contracts cannot be deleted on request during that period.

e. Innextart staff

Data: name, email address, a password stored only as a hash, and the actions taken in the back office.

Purpose and legal basis: running the platform under the employment or service contract (Article 6(1)(b)). Retention: while the person works with us; actions on Contracts are kept with the Contract.

Changes to catalog records are logged with the name of the staff member who made them, and kept for 5 years.

f. Email and CVs

Data: what you write to us by email, and the CV and contact details you send when applying for a job.

Purpose: to answer you, or to assess your application. Legal basis: steps taken at your request before a contract (Article 6(1)(b)).

Retention: as long as needed to answer the request; CVs no longer than 2 years after we receive them.

g. Authors of artworks

Data: the name, a short biography and, where we have one, a picture of the people who made the artworks shown on the site. We do not collect this from the Authors themselves: it comes from the Institution that holds the artwork, or from public sources such as catalogs and museum websites.

Purpose: to say who made each artwork. Legal basis: our legitimate interest in presenting artworks with their authors (Article 6(1)(f)). Retention: while one of the Author's artworks is on the site.

An Author can ask us to correct or remove this information at info@innextart.com, and can object to it under section 6.

3. Cookies

The site sets one cookie, and only when you log in: a session cookie that keeps you logged in. It expires when you log out, or after 30 days. For Innextart staff it expires after 12 hours, or after an hour without use. It is strictly necessary, so it needs no consent. Our server keeps a record of the session holding only a one-way hash of the cookie, your account, when you logged in and the expiry, and deletes it when you log out, or soon after it expires. The site uses no analytics, advertising or third-party cookies.

4. Who receives the data

Innextart staff, authorized and instructed to process it. The following processors, under Article 28:

Accountants, lawyers and tax advisers where needed for the purposes above, and public authorities when the law requires it.

5. Transfers outside the European Union

Data is stored in the European Union. Sentry is a US company; any access from the United States is covered by the EU-US Data Privacy Framework and by standard contractual clauses.

6. Your rights

Under Articles 15 to 22 of the GDPR you can ask us to:

Write to info@innextart.com.

You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali (Article 77), or to the authority where you live or work, or go to court (Article 79).

7. Changes

If we start processing data for other purposes or on another legal basis, we will update this notice first.