Personal information protection

This English version is for reference; the Chinese version prevails.

Effective date: [TO CONFIRM: effective date]

This notice is provided under Article 17 and other provisions of the Personal Information Protection Law of the People’s Republic of China (the “PIPL”). It sets out how the e.art website (the “Site”) processes personal information and forms part of our Privacy policy.

Personal information handler

Name: Beijing Guiyudi Technology Co., Ltd. (北京瑰域迪科技有限公司)
Address: Room 705, Yingu Building, 9 Beisihuan West Road, Haidian District, Beijing (北京市海淀区北四环西路9号银谷大厦705室)
Phone: +86 10 6253 0092
Personal information protection e-mail: enquiry@e.art
ICP licence: 京ICP备20017661号-2

Beijing Guiyudi Technology Co., Ltd. is the China representative of UK Creative Ideas Ltd, the registry of the .ART top-level domain. The Site provides information about .ART and does not register domains; information you submit when registering a domain with a registrar is processed by that registrar, as personal information handler, under its own rules.

Processing activities

All personal information processed by the Site is stored on servers in mainland China.

Purpose: to send you the .ART newsletter.
Types of personal information: e-mail address; time of consent; version of the consent text; time of unsubscription.
Method: collected when you enter your e-mail address in the subscription form in the Site footer and tick the consent box; stored in the Site database; used to send the newsletter.
Legal basis: your separate consent (PIPL, Article 13(1)(1)).
Retention: until 30 days after you unsubscribe.
Entrusted processing and provision to others: an e-mail delivery provider [TO CONFIRM: e-mail delivery provider] may be engaged to send the newsletter on our behalf; not provided to any other third party and not sold.

2. Visit statistics

Purpose: to measure use of the Site and improve its content and structure.
Types of information: page views, pages viewed per visit, referring page, device type, coarse location.
Method: recorded automatically by an analytics system (Umami) that we run on our own server; no cookies, no full IP addresses stored, no cross-site tracking, not combined with other information to identify individuals. [TO CONFIRM: handling of the anonymous session identifier generated by the analytics system]
Legal basis: [TO CONFIRM: legal basis, e.g. de-identified statistics]
Retention: raw data 13 months, then aggregate data only.
Entrusted processing and provision to others: none.

3. Server logs

Purpose: network security and stable operation of the Site, troubleshooting, compliance with the obligation to retain network logs.
Types of personal information: IP address, time of access, URL requested, browser identifier (user agent).
Method: recorded automatically by the server when you visit.
Legal basis: necessary to fulfil statutory obligations (PIPL, Article 13(1)(3); Cybersecurity Law, Article 21).
Retention: at least six months; deleted after [TO CONFIRM: e.g. 180 days].
Entrusted processing and provision to others: none, except where required by law.

4. Correspondence, complaints and reports

Purpose: to answer your enquiries and handle complaints and reports of illegal content.
Types of personal information: your e-mail address and any name, contact details or other information you choose to include in your message.
Method: received when you write to enquiry@e.art or tousu@e.art.
Legal basis: [TO CONFIRM: legal basis, e.g. consent expressed by contacting us]
Retention: [TO CONFIRM: retention period]
Entrusted processing and provision to others: none, except where required by law.

5. Editor accounts

Purpose: to manage editing rights for the Site’s content.
Types of personal information: login name, password hash.
Method: used only for logging in to the Site’s back office; internal use only.
Legal basis: necessary for human resources management or performance of a contract (PIPL, Article 13(1)(2)).
Retention: until the editor stops using the account.
Entrusted processing and provision to others: none.

Before subscribing you must actively tick the following consent statement (not ticked by default):

我已阅读并同意《隐私政策》，同意 .ART 按照《个人信息保护法》处理我的电子邮箱，用于发送简讯。可随时退订。
(“I have read and agree to the Privacy Policy, and I allow Beijing Guiyudi Technology Co., Ltd. to process my email address under China's Personal Information Protection Law solely to send the .ART newsletter. I can unsubscribe at any time.”)

We record the time of your consent and the version of the consent text as evidence that consent was obtained. Not consenting does not restrict your access to any content on the Site.

You may withdraw your consent at any time by clicking the unsubscribe link in any newsletter or by e-mailing enquiry@e.art. After withdrawal we stop sending you the newsletter and delete your subscription data within 30 days. Withdrawal does not affect processing carried out on the basis of your consent before it was withdrawn.

Sensitive personal information and minors

We do not intentionally collect sensitive personal information. The Site is not directed at minors under the age of 14. If we find that we have received personal information of a minor under 14 without the consent of a parent or other guardian, we will delete it as soon as possible.

Automated decision-making

The Site does not use personal information for automated decision-making, profiling or personalised content.

Provision of personal information outside China

We do not currently provide personal information outside the People’s Republic of China. If this ever becomes necessary (for example, provision to UK Creative Ideas Ltd), we will:

first inform you of the overseas recipient’s name, contact details, purpose and method of processing, the types of personal information, and how you can exercise your rights against the overseas recipient;
obtain your separate consent;
carry out a personal information protection impact assessment in advance;
meet one of the conditions of Article 38 of the PIPL — a security assessment organised by the national cyberspace administration, personal information protection certification, or a standard contract — and comply with national rules on promoting and regulating cross-border data flows.

Your rights and how to exercise them

Under Articles 44 to 50 of the PIPL you have the following rights:

To know and decide: to know and decide how your personal information is processed, and to restrict or refuse processing;
Access and copy: to access and copy the personal information we process about you;
Portability: where the conditions set by the national cyberspace administration are met, to request transfer of your personal information to a handler you designate;
Correction and completion: to correct or complete inaccurate or incomplete personal information;
Deletion: to request deletion where the purpose has been achieved, you withdraw consent, the retention period has expired, or in other cases provided by law;
Withdrawal of consent: to withdraw at any time consent on which processing is based;
Explanation: to ask us to explain our personal information processing rules.

If a natural person dies, their close relatives may, for their own lawful and legitimate interests, exercise the rights of access, copying, correction and deletion in respect of the deceased’s personal information, unless the deceased arranged otherwise during their lifetime.

How to exercise your rights:

E-mail enquiry@e.art, stating your request and the e-mail address concerned.
To prevent impersonation, we may ask you to confirm by replying from that e-mail address.
We will respond and act on your request within [TO CONFIRM: 15 working days] of receiving it; if we refuse, we will give our reasons.

If you believe our processing infringes your lawful rights and interests, you may complain to or report to the cyberspace administration or other authorities responsible for personal information protection; if we refuse a request to exercise your rights, you may bring a lawsuit before a people’s court in accordance with the law.