Privacy Policy

This Privacy Policy explains how personal data are processed in connection with Collectionframe: the website collectionframe.com, the application at app.collectionframe.com, the museums' Public Websites at collectionframe.com/m/…, the Museum Directory, the signing of documents and the e-mails we send. Capitalised terms have the meaning given to them in the Terms of Service.

1. Controller and contact

1.1. The controller of your personal data is Grzegorz Piechnik, who runs a business under the name BUGSPACE GRZEGORZ PIECHNIK, ul. Aleksandra Dworskiego 40/5A, 37-700 Przemyśl, Poland, tax ID (NIP) 5170424581, REGON 521697638 ("we", "us").

1.2. For anything concerning your personal data, write to grzegorz@collectionframe.com or to the address above. We have not appointed a data protection officer, as the law does not require us to.

2. When we are the controller, and when the organisation is

2.1. We are the controller of the personal data we process for our own purposes: user accounts and sign-in, Organizations and billing, correspondence and support, the security of the Service, our websites and the Museum Directory.

2.2. Museums and other organisations that use Collectionframe (our Customers) enter their own content into the Service: object records, documents and files, signature requests and their Audit Trails, and what they publish on their Public Websites. For personal data in that content, the organisation is the controller, and we process the data on its behalf as its processor, under section 14 of the Terms of Service. If you have signed a document, are named in a collection record or have visited a museum's Public Website, contact the organisation concerned about that content; if you write to us instead, we will pass your request on to it and help it reply.

3. What we process, why, on what basis and for how long

3.1. Your account and signing in

We process your e-mail address, your name and your profile picture (if you add one), your language and display preferences, the Organizations you belong to and your roles in them, one-time sign-in codes, and your sessions, with the IP address and browser information (user agent) from which you signed in and the dates of these events.

We do so to provide your account and the Service under the Terms of Service (Article 6(1)(b) GDPR); where you use Collectionframe as a member of an organisation, also in our legitimate interest and that of the organisation in providing the Service to it (Article 6(1)(f) GDPR); and to keep the Service secure and prevent abuse (Article 6(1)(f) GDPR).

A sign-in code is valid for a few minutes, and a session ends after 7 days without use. We keep account data while the account exists. After an account is deleted, we remove its data within 90 days, except what we must keep by law, what is needed to establish, exercise or defend legal claims (for no longer than the limitation periods), and what is recorded in Audit Trails (section 4).

3.2. Organizations, plans and payments

We process the name and details of an Organization, the contact details of its Owners, its Plan, the status and dates of its trial and subscription, and its customer identifier at Polar. Payments are processed by Polar Software, Inc., our merchant of record, which is a separate controller of the data you give it at checkout and processes them under its own privacy policy. We do not receive or store payment card details.

We do so to perform the agreement (Article 6(1)(b) GDPR), to meet our legal obligations, including tax and accounting obligations (Article 6(1)(c) GDPR), and in our legitimate interest in establishing and pursuing claims (Article 6(1)(f) GDPR). We keep this data for the duration of the agreement and then for as long as tax and accounting law requires (in Poland, generally 5 years from the end of the year concerned) and for the limitation periods of claims.

3.3. Correspondence, support and service e-mails

When you write to us, use the support form or ask about the Enterprise plan, we process your name, e-mail address, organisation, the content of your message and any attachments, to answer you and handle your request (Article 6(1)(f) GDPR, and Article 6(1)(b) GDPR where the request concerns the agreement).

We send the e-mails the Service needs in order to work: sign-in codes, invitations, signature requests and codes, and notices about trials, plans and changes (Article 6(1)(b) GDPR). A few days after you create your account, and when a trial ends, the founder of Collectionframe may write to ask how it went, in our legitimate interest in supporting customers and improving the Service (Article 6(1)(f) GDPR); you can object at any time simply by replying. We also receive a daily internal list of new accounts (name, e-mail address and date). We do not send newsletters or marketing e-mails.

We keep correspondence for as long as needed to deal with the matter and then for up to 3 years, or longer if it is needed for a legal claim.

3.4. Security and technical logs

When you use our websites, the application or its API, our hosting provider records technical data: IP address, date and time, the address requested, browser information and errors. We use them to keep the Service secure, prevent abuse and fix errors, in our legitimate interest (Article 6(1)(f) GDPR). These logs are kept for a short time, generally no longer than 30 days, unless they are needed to investigate an incident.

3.5. The website collectionframe.com

We do not use analytics, advertising or tracking tools, or social media plugins. When you visit the website, we process only technical logs (section 3.4) and the browser storage described in section 7. The blog's authors are presented with their name, role and profile links, which they publish of their own will.

3.6. The Museum Directory

The Museum Directory presents information about museums from public sources, mainly Wikidata and Wikimedia Commons, and from the museums themselves: names, addresses and contact details of institutions, and photographs with the names of their authors and their licences, as those licences require. This is mostly information about institutions, but it may include a person's name (for example, a photograph's author) or contact details that identify a person. We process it in our legitimate interest in providing a public directory of museums and in crediting authors as licences require (Article 6(1)(f) GDPR), for as long as the entry is published. You can ask us to correct it, or object, at grzegorz@collectionframe.com.

3.7. Legal claims and obligations

We may also process the data described in this section where necessary to establish, exercise or defend legal claims (Article 6(1)(f) GDPR) or to meet legal obligations, such as answering lawful requests of authorities (Article 6(1)(c) GDPR), for as long as that requires.

4. Signing documents: information for signers

4.1. When an organisation that uses Collectionframe asks you to sign a document, it decides what the document says and who signs it, and it is the controller of your data. We process your data on its behalf.

4.2. For each signature request we record: your name and e-mail address as the organisation entered them; the document as presented for signature and its fingerprint; the steps of the request, such as the invitation being sent and opened, one-time codes being sent, verified or entered wrongly, your signature, and the completion, cancellation or voiding of the request; the date and time of each step; the IP address and browser information (user agent) from which you acted; your confirmation that you have reviewed the document and intend to sign it electronically; and a cryptographic value that binds these together. This record is the Audit Trail.

4.3. The Audit Trail lets the organisation conclude and document the agreement and show who signed what, and when. Once anyone has signed, the organisation cannot delete it. It is kept for as long as the organisation uses Collectionframe and for 6 years after that, unless the organisation instructs us otherwise.

4.4. If you have questions or want to exercise your rights, contact the organisation that sent you the document. You can also write to us, and we will pass your request on.

5. Museums' Public Websites

Organisations can publish selected content from Collectionframe at collectionframe.com/m/…. The publishing organisation decides what is shown and is responsible for it; we host it on its behalf. When you visit these pages, we process only technical logs (section 3.4). To report illegal content, see section 8 of the Terms of Service.

6. Who receives the data

6.1. We use the following providers, who act as our processors and, for Customer Content, as our sub-processors:

• Cloudflare, Inc. (USA, global network): hosting of the application, the API and the websites, content delivery, file storage (R2), image processing, database connections, sending e-mail, technical logs and protection against attacks;

• PlanetScale, Inc. (USA): the databases of the application and of the website, hosted on Amazon Web Services in the United States;

• Polar Software, Inc. (USA): our merchant of record for paid Plans, handling checkout, payments, taxes and invoices. For the data you give it at checkout, Polar is a separate controller.

6.2. Other recipients: the providers of the e-mail and office tools we use to receive and answer messages; our accountants and legal advisers, where necessary; and public authorities, where the law requires it. Content that a Customer publishes on its Public Website is available to everyone.

6.3. Third-party content in your browser: the map of the Museum Directory loads map tiles from OpenFreeMap (tiles.openfreemap.org), and museums' photographs are loaded from Wikimedia Commons (upload.wikimedia.org). Your browser connects to these services directly, and they receive your IP address. Links to Google Maps and Apple Maps open those services only when you click them.

7. Cookies and browser storage

7.1. We use only cookies and browser storage that are strictly necessary to provide the service you ask for or to remember your choices. We use no analytics or advertising cookies, so we do not ask for consent to them.

7.2. In the application: a session cookie set by api.collectionframe.com while you are signed in (up to 7 days without use); a cookie that remembers whether the sidebar is open (7 days); and, in your browser's local or session storage, your language and theme, recently opened items, your progress in "Getting started", news you have dismissed, a museum you chose in the directory before signing in, and the draft of the sign-up form.

7.3. On collectionframe.com: the cf_lang cookie with the language you chose (1 year) and, in local storage, the announcement you dismissed.

7.4. You can delete cookies and storage in your browser's settings. The Service may then sign you out or forget your choices.

8. Transfers outside the European Economic Area

The providers named in section 6.1 are located in the United States or process data there, and our databases are hosted in the United States. These transfers are based on the European Commission's adequacy decision for the EU–US Data Privacy Framework, for recipients certified under it, and otherwise on the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR), together with additional safeguards such as encryption in transit. You can ask us for a copy of these safeguards.

9. Your rights

9.1. You have the right to access your personal data, to have it rectified or erased, to restrict its processing, to data portability, and to object, on grounds relating to your particular situation, to processing based on our legitimate interests (Articles 15 to 21 GDPR). To exercise them, write to grzegorz@collectionframe.com. We reply within one month, which may be extended by two further months where necessary; we may need to confirm your identity first.

9.2. You also have the right to lodge a complaint with a supervisory authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or the authority of the EU country where you live or work.

9.3. For content that an organisation has entered into Collectionframe, exercise your rights with that organisation (section 2.2).

10. Do you have to give us your data?

An e-mail address is necessary to create an account, to sign in and to sign a document; without it we cannot provide the Service. Everything else is voluntary.

11. Automated decisions

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

12. Security

We protect personal data with measures appropriate to the risk, including encrypted connections (HTTPS), private storage of files, which are shared through time-limited signed links (except content an organisation publishes), access control and separation of each Organization's data, short-lived one-time codes, records of signature events, and backups. No system is completely secure: please keep your e-mail account safe, as it gives access to your Collectionframe account.

13. Children

The Service is intended for professional use. It is not directed to children, and we do not knowingly collect the data of children under 16.

14. Changes to this policy

We may update this Privacy Policy, for example when the Service, our providers or the law change. The current version, with its effective date, is always at collectionframe.com/legal/privacy. We will tell Users of material changes by e-mail or in the Service.