Arta diligently ensures we are GDPR-compliant.

• Data Processing Agreement (DPA) is accessible here.
• Arta implemented internal processes and products to comply with EU data subject rights.
• Appointed a Data Protection Officer to help our Users with any requests or questions about their data. Our DPO can be reached at hello@arta.io.

What is GDPR?

Arta has supplied this information as a resource, but we don’t offer legal advice. We recommend you contact your legal counsel to find out how the GDPR affects you.

The General Data Protection Regulation (GDPR) took effect on May 25, 2018. GDPR affects both organizations based in the EU and organizations involved in processing EU citizens’ personal data.

The GDPR classifies entities as either a Data Controller, a Data Processor, or a Data Subject. Data controllers determine how personal data is processed, while data processors process personal data on behalf of a data controller. It is possible to be both a Data Controller as well as a Data Processor. A Data Subject as anyone that has their data shared.

• Arta is a Data Controller for any personal data collected and shared by Arta Users (Arta account holders), who are Data Subjects.
• Arta is a Data Processor for any personal data collected on Third Parties that has been supplied by an Arta User. In this instance, Arta Users are the Data Controllers for that Third Party information, and the Third Party is the Data Subject

This regulation standardizes data privacy laws across the European Union (EU), and EU citizens are entitled to exercise their GDPR rights. These rights include:

• Right of Access: Find out what kind of personal information is held about you and get a copy of this information.
• Right of Rectification: Ask for your information to be updated or corrected.
• Right to Data Portability: Receive a copy of the information which you have provided under contract so that you can provide that information to another organization.
• Right to Restrict Use: Ask for your personal information to stop being used in certain cases, including if you believe that the personal information about you is incorrect or the use is unlawful.
• Right to Object: Objecting to use of your information (where a party is processing it on legitimate interest basis) and to have your personal information deleted.
• Right to Erasure: In certain circumstances, you may also have your personal information deleted.