Privacy Policy

This policy explains what personal data Khaya (khayarts.com) collects, why, and what rights you have under the EU General Data Protection Regulation (GDPR). The data controller is the person named in the Impressum; contact khayaartss@gmail.com for any privacy request.

1. What we collect

• Artist applications: full name, email address, location, and optionally Instagram handle, website, portfolio link, and a free-text message — submitted through the application form on the homepage.
• Accounts: email address and password for artists, galleries, and admins who sign in. Passwords are handled by our authentication provider (Supabase Auth) and are not stored by us in plain text.
• Published artist profiles: for accepted artists, the name, bio, images, and links that make up their public profile.
• Favorites: if you're signed in, which artist profiles you've marked as a favorite.
• Session cookies: strictly-necessary cookies that keep you signed in (see Section 5).

2. Why we process it, and the legal basis

• Reviewing artist applications — legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract, at your request).
• Operating artist/gallery/admin accounts and the platform — legal basis: Art. 6(1)(b) GDPR (performance of the contract with you as a registered user).
• Publishing an accepted artist's profile so galleries can discover it — legal basis: Art. 6(1)(b) GDPR (this is the core service you sign up for as an accepted artist).
• Keeping you signed in via session cookies — legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing a working, secure login), or Art. 6(1)(b) where you've asked to be signed in.

3. Who sees your data

Applications: raw application data (your name, email, location, links, message) is visible only to Khaya admins reviewing submissions. It is not shared with galleries.

Published profiles: once an artist's application is accepted and their profile is published, that profile (name, images, bio, links) becomes publicly visible and searchable on the platform — including to galleries, which is the intended purpose of publishing it.

Service providers: we use Supabase (database, authentication, file storage) and a transactional email provider (to send you application-confirmation emails) as data processors. See the open item above regarding formal processing agreements.

We do not sell personal data, and we do not use any analytics or advertising trackers on this site (see Section 5).

4. How long we keep it

• Rejected or unanswered artist applications: deleted no later than 6 months after a decision is made (or 6 months after submission if no decision is recorded).
• Accepted/published artist profiles and accounts: retained for as long as the profile or account remains active on the platform. If you'd like your account or profile removed, contact us and we will delete it.
• Favorites: retained for as long as your account exists.

5. Cookies

Khaya sets one type of cookie: short-lived, HttpOnly session cookies used solely to keep you signed in after login. These are strictly necessary for the site to function and do not require consent under the ePrivacy rules. Khaya does not currently use analytics, advertising, or tracking cookies of any kind — if that changes, this policy and a consent mechanism will be added before any such cookies are set.

6. Your rights

Under the GDPR, you have the right to:

• request access to the personal data we hold about you (Art. 15),
• request correction of inaccurate data (Art. 16),
• request deletion of your data (Art. 17),
• restrict or object to certain processing (Art. 18, 21),
• receive a copy of your data in a portable format (Art. 20), and
• lodge a complaint with a data protection supervisory authority.

To exercise any of these rights, email khayaartss@gmail.com.