Data processing agreement

This agreement forms part of the terms of service. It applies whenever Galerie Log processes personal data on behalf of a customer: contacts, collectors, artists, team members and any other personal data the customer stores in the service.

The customer is the controller. Galerie Log [to be completed] is the processor and acts only on the customer's documented instructions, which are the terms of service, this agreement and the customer's use of the service's features.

Hosting, storing, organising, displaying, searching, exporting and deleting the customer's records so that the customer can run its business, publish its website and use the AI features it chooses to use.

Process personal data only to provide the service and never for our own purposes.

Ensure that everyone with access is bound by confidentiality.

Apply the security measures described on the security page.

Use only the sub-processors listed on the sub-processors page, give at least 30 days' notice before adding or replacing one, and let the customer object.

Help the customer respond to requests from data subjects and to carry out impact assessments where needed.

Notify the customer without undue delay, and within 48 hours where possible, after becoming aware of a personal data breach affecting its data.

At the end of the contract, return the data through export and then delete it within 90 days, unless the law requires otherwise.

Make available the information needed to demonstrate compliance and allow reasonable audits, at most once a year and with 30 days' notice.

Where a sub-processor is located outside the European Economic Area, transfers are covered by the European Commission's standard contractual clauses or by the EU-US Data Privacy Framework where the provider is certified.

When a user starts an AI feature, the relevant records are sent to Anthropic to produce the answer. Under Anthropic's commercial terms, this content is not used to train its models. AI features are never started automatically.