Privacy Policy – Art2fund.com (Ireland) – Medialen BV

Art2fund.com is a programme operated in Ireland under the sole responsibility of Medialen BV. Medialen BV is registered at De Donge 21, 5684 PX Best, The Netherlands, with the Dutch Chamber of Commerce (KvK) under number 17096283. Medialen BV is the data controller within the meaning of the General Data Protection Regulation (GDPR).

Regardless of the country in which the programme is active, Dutch law and the GDPR apply exclusively to all data processing activities. In case of discrepancies between translated versions of this privacy policy, the Dutch-language version shall prevail.

Medialen BV respects your privacy and treats all personal data with care and confidentiality. We have implemented appropriate technical and organisational measures to protect your personal data against loss, misuse, or unauthorised access, including encryption, restricted access, and monitoring of our systems.

1. Scope

This privacy policy applies whenever you use Art2fund.com or when this policy is presented to you under the Art2fund brand. In all cases, Medialen BV remains the responsible legal entity and data controller.

2. Data we process

We only process personal data necessary for providing our services. Depending on your role, this may include:

Schools (participants): contact and project data required to organise the programme and keep the school informed of progress.
Pupils: Medialen BV receives only the creative drawing from the school, which forms part of the programme. The school provides no further personal data of pupils. Medialen BV may rely on the assumption that the school is authorised to share these drawings with us. Any additional personal data (such as name or class) is entered voluntarily by parents together with their child via the personal page/gallery/shop, and is only processed once explicit consent is given.
Parents/guardians and invitees: parents (together with their child) decide who is invited to view the personal page/gallery/shop. Invitees’ details are used solely to provide access to the webshop.
Buyers: name, email address, delivery and/or billing address, and payment details in order to process purchases and provide updates on order status.
Technical data: device and session information (such as IP address, browser type, time stamps) used for security, diagnostics, and statistics.

3. Purposes and legal bases

We process personal data for the following purposes and on the following legal bases:

Performance of a contract: executing projects and orders, providing customer service, delivery, and aftercare.
Legal obligation: compliance with statutory tax and administrative retention duties.
Legitimate interests: including system security, fraud prevention, service improvement, and anonymous statistics. In each case we balance our interests against your fundamental rights and freedoms, as required under Article 6(1)(f) GDPR.
Consent: sending newsletters and marketing communications; placing non-essential cookies (analytics/marketing); voluntary entry of pupil data by parents together with their child. Consent can be withdrawn at any time.

4. Source of data

We receive data directly from you (e.g. when placing an order), from the participating school (only the drawing), or automatically via use of our websites (technical/log data).

5. Sharing with third parties

We use carefully selected third-party service providers such as IT and hosting providers, production partners, delivery services, and payment processors. These parties act solely as processors under contract with Medialen BV, subject to strict confidentiality and security obligations.

Where personal data is transferred outside the European Economic Area (EEA), we ensure adequate safeguards such as European Commission-approved Standard Contractual Clauses or an adequacy decision.

6. Cookies

We use cookies and similar technologies on our website:

Essential cookies: required for the basic operation of the site (always active, no consent required).
Analytics cookies (e.g. Google Analytics): anonymised data on usage patterns, stored for a maximum of 14 months, only placed with your consent.
Marketing cookies (e.g. Facebook Pixel): measure ad effectiveness and enable targeted campaigns. These are only placed with your consent and may involve transfer of data outside the EEA.

You can manage your preferences through our cookie banner/settings or your browser.

7. Retention periods

We do not retain personal data longer than necessary for the stated purposes, unless a longer retention period is required by law. Indicative periods:

Order data: 7 years (in line with Dutch tax law).
Account data: as long as the account is active, and up to 2 years after last use unless deleted earlier upon request.
Marketing data: until consent is withdrawn, or up to 2 years after the last interaction.
Pupil data/drawings: deleted or anonymised no later than 24 months after project completion.

8. Security

We implement appropriate measures such as encryption, access management, logging, restricted staff access, and periodic security reviews. In the event of a data breach, we will act in accordance with GDPR and notify the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) and/or the Irish Data Protection Commission (DPC) where required.

9. Children and the role of schools/parents

Schools provide drawings only; no other pupil personal data. Medialen BV may rely on the assumption that schools are entitled to share these drawings. Any additional personal data is voluntarily entered by parents together with their child and processed only after explicit consent. If it becomes clear that data has been submitted without a valid legal basis, Medialen BV may delete such data immediately without liability.

10. Your rights

You have the following rights under the GDPR:

Right of access and to receive a copy of your data,
Right to rectification,
Right to erasure (“right to be forgotten”),
Right to restriction of processing,
Right to data portability,
Right to object to processing based on legitimate interest and to direct marketing,
Right to withdraw consent (without affecting the lawfulness of processing before withdrawal),
Right to lodge a complaint with the Data Protection Commission (Ireland) or the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).

To exercise your rights, please contact us using the details below. We may require proof of identity.

11. Automated decision-making

We do not engage in automated decision-making, including profiling, that produces legal effects or significantly affects you.

12. Changes

We may amend this privacy policy. The most recent version is always available on our website. Version: 26/09/2025

13. Contact details

For questions about this privacy policy or to exercise your rights, please contact:

Art2fund.com (customer service)
Email: info@art2fund.com

The data controller responsible for processing is:

Medialen BV
De Donge 21
5684 PX Best
The Netherlands
Chamber of Commerce NL (KvK): 17096283
Email: info@medialen.nl
Phone: +31 (0)499 - 39 22 93