DISIVA — Privacy Policy
Last updated: 30 October 2026
This notice explains how personal data are processed in connection with disiva.com, DISIVA applications, curatorial review, exhibitions, enquiries and communications. It is an information notice under Regulation (EU) 2016/679 (GDPR), not a request for blanket consent. Browsing the website or submitting an application does not, by itself, constitute consent to marketing, optional cookies or unrelated uses of your data.
1. Who is responsible for your data
The data controller is Art Innovation Srl, operating under the DISIVA brand, Via San Vito, 18, 20123 Milan, Italy. For privacy enquiries or to exercise your rights, contact francesca@disiva.com.
2. Data we process and their sources
Depending on your interaction with us, we process contact and professional details; artist or gallery names; biographies, statements, portfolio links and submitted artworks; application status and curatorial evaluations; correspondence; billing details and payment confirmations; and relevant technical information such as IP addresses, device information and platform activity.
Data may be provided directly by you, by a gallery or authorised representative submitting on your behalf, or generated through your use of our services. Professional contact information may also come from publicly available professional websites, directories or institutional sources. Where we contact you using such information, you may request its source and object to further communications. Public availability does not itself constitute consent to marketing.
Please provide only information needed for the relevant service and avoid including sensitive personal information in applications or uploaded files unless specifically necessary and requested.
3. Purposes and legal grounds
- Enquiries, applications and participation: responding to requests, administering applications, arranging curatorial review and delivering agreed exhibition services, on the basis of steps requested before a contract or performance of a contract.
- Billing and compliance: maintaining transaction records and meeting accounting, tax and other legal requirements, on the basis of legal obligations.
- Security and administration: protecting platforms, preventing abuse, managing disputes and maintaining necessary records, on the basis of our legitimate interests in secure services and the protection of legal rights, balanced against your rights.
- Exhibition publication and documentation: presenting artist names, professional biographies, artworks and project documentation within the scope of the participation terms and permissions applicable to the project. Additional uses requiring consent are subject to a separate request.
- Newsletters and promotional communications: on the basis of your consent where required by applicable law. Any applicable exception must meet its legal conditions. You may unsubscribe or object at any time.
- Optional cookies and similar technologies: on the basis of your choices in the cookie consent interface, where consent is required.
Providing information marked as required is necessary to respond to your request or process your application. Optional information and marketing consent are voluntary. Declining marketing consent does not prevent application review or delivery of agreed services.
4. Applications and curatorial review
Application materials may be accessed by the DISIVA team and members of the Curatorial Committee for review, scoring and selection, including through the Jury Room. Relevant application information and evaluations are processed to administer this review. Curatorial selection is carried out by people; the use of a digital submission or scoring platform does not replace the committee's assessment.
Public presentation of application materials is governed by the information and participation terms shown for the relevant programme. This privacy notice does not grant an unlimited licence to artworks or authorise unrelated promotional use. Any sharing with sponsors for their own purposes requires an appropriate legal basis and the information or separate consent required for that activity.
5. Service providers and other recipients
Data may be accessed, as necessary for their roles, by authorised staff, curators, technical and administrative service providers, payment providers, professional advisers and authorities where disclosure is required by law. Services used in our activities include Artlogic for the website, Tally for application forms, Brevo for mailing-list communications and Google services for operational records and collaboration. Payment providers are identified in the relevant payment flow.
Providers acting on our behalf must process data under appropriate contractual arrangements. Payment services, social platforms and other providers may also process certain information as independent controllers under their own notices. Published exhibition content can be accessed by the public worldwide. Private contact or billing details are not part of an artist's public presentation.
6. International processing
Our international programme and the providers involved may require access to or processing of personal data outside the European Economic Area. Such transfers must comply with GDPR transfer requirements, including an applicable European Commission adequacy decision or appropriate safeguards such as Standard Contractual Clauses and supplementary measures where needed. This notice does not ask you to waive those protections. Contact us for details of the destinations and safeguards applicable to your data, or to request a copy of the relevant safeguards.
7. How long data are kept
Retention depends on the purpose and the records concerned. Enquiries and applications are kept for the time necessary to handle the request, complete the review and participation process, and address related follow-up or claims. Billing and contractual records are kept for applicable statutory retention periods. Security and activity records are retained according to the need to investigate incidents and protect the service.
Mailing-list data are used until you unsubscribe or withdraw consent, subject to periodic review of continued necessity. A limited suppression record may be retained to respect your opt-out. Exhibition documentation may remain in the programme archive where there is a continuing lawful purpose; this does not justify indefinite retention of all application, contact or payment data. Retention is assessed against operational need, legal duties and relevant limitation periods. You may request information about the retention applicable to your records.
8. Your choices and rights
Subject to the conditions in applicable law, you may request access, correction, erasure, restriction or portability of your personal data. You may object to processing based on legitimate interests and may object to direct marketing at any time. Where processing relies on consent, you can withdraw it without affecting the lawfulness of earlier processing.
Write to francesca@disiva.com. We may request proportionate information to verify your identity. Requests are normally answered within one month; if a lawful extension is needed, we will explain it within that period. You may lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, or another competent supervisory authority.
9. Cookies and external services
See our Cookie Policy and use the website's cookie preferences to manage optional categories. Necessary technologies support website operation. Optional technologies requiring consent must not be treated as accepted merely because you continue browsing. External forms, videos, payment pages and social platforms may have their own cookie and privacy notices.
10. Security, minors and updates
Technical and organisational safeguards must be appropriate to the risks of the processing. No online service can guarantee absolute security; this does not reduce our legal responsibilities or your rights.
If an applicant is under the age of legal majority, any authorisation required by the relevant programme and applicable law must be provided by a parent or legal guardian. Contact us before submitting a minor's personal information if you need guidance.
We may update this notice to reflect changes in our activities or legal requirements. The date above identifies the current version. Material changes will be communicated where required, and new consent will be requested where necessary. Updates do not retrospectively create consent or remove your statutory rights.