cromAwards ES EN
Enter now

← Back

Privacy policy

Data controller: Gextiona Interproducción, S.L.

Version 1.2 · Last updated: 23 October 2026

Prior information and acceptance

The site www.cromawards.com is an information-society service owned by Gextiona Interproducción, S.L., through which the cromAwards contest is managed. This Policy informs, prior to registration and in a concise, transparent and intelligible manner, about the processing of the personal data collected.

By ticking the acceptance box —which will not be pre-ticked— and completing the registration, the participant declares that they have read and understood this Policy. Where a specific processing is based on consent, it will be obtained in a specific, informed and unambiguous way and may be withdrawn at any time without affecting the lawfulness of prior processing.

1. Data controller

  • Identity: Gextiona Interproducción, S.L.
  • Tax ID (CIF): B-87967592.
  • Address: C/ Francisco Silvela 110, 2º — 28002 Madrid (Spain).
  • Data protection contact: privacy@cromawards.com.
  • Brand: the contest runs under the «cromAwards» brand.

2. Data Protection Officer (DPO)

Given the nature, scope and purposes of the processing, the controller has assessed that the cases requiring the appointment of a Data Protection Officer do not apply. You may nonetheless send any query to privacy@cromawards.com.

3. Personal data we process

Applying the principles of data minimisation and purpose limitation, the following categories of data are processed:

  • Identification and contact data: full name, email address, postal address —the latter required to ship prizes to award winners— and date of birth —used to verify the minimum age (18) demanded by the rules and to produce aggregated, anonymous statistics on participation; it is never published nor shared on an individual basis—.
  • Entry and artwork data: title and dimensions of the work, category entered, description and images of the work (JPG or PNG files). Works including photographs of people may contain third-party personal data, for whose lawfulness the entrant is responsible.
  • Team data: when entering as a team, the names of all its members.
  • Payment data: registration entails payment of a fee. Payment is made by redirection to the Stripe gateway, which directly collects and processes the card data; the Site does not store full card details, only the transaction confirmation and identifiers needed for management and invoicing.
  • Press-release contacts: where applicable, the data of media or persons (max. 25) provided by the award winner for sending press releases, under their responsibility.
  • Usage and security data: where an account exists, a log of sign-ins (date, time and IP address) and of actions performed on the Site.

Please note that the IP address is considered personal data.

4. Purposes and legal bases of processing

  • Managing registration and participation in the Contest (basis: performance of the legal relationship arising from acceptance of the rules): processing the entry, authenticating the user and storing the submitted work.
  • Jury evaluation and communication of decisions (basis: performance of the rules): selection, deliberation and notification of selected, finalist and award-winning entrants.
  • Publication of selected, finalist and award-winning persons and dissemination of award-winning works (basis: performance of the rules and the licence granted therein): publication on the Site and on social media for the promotional purposes of the Contest.
  • Sending prizes (basis: performance): delivery of physical recognitions, if any, to the address provided.
  • Technical communications (basis: performance): registration confirmation, password recovery and service notices.
  • Platform security (basis: legitimate interest): detection of anomalous access and audit logging.
  • Compliance with legal obligations (basis: legal obligation): accounting, tax and authority-response obligations.

No profiling, personalised advertising or transfer of data to third parties for commercial purposes is carried out.

Legal basis: GDPR, art. 6.1 (lawfulness: b, c, f); for image dissemination, Organic Act 1/1982 (right to one's own image).

5. Retention periods

  • Non-winning entries: during the Contest edition and, after the decision, blocked for the limitation periods of any claims; non-winning works are deleted or anonymised at the end of the edition, unless express authorisation is given for future editions.
  • Award winners' data and winning works: retained for longer under the dissemination licence and the historical record of the Contest, without prejudice to the right to object.
  • Data with accounting or tax effects: blocked for the legally applicable limitation periods (up to six years under the Commercial Code and four years for tax matters).
  • Security logs (if an account exists): audit log 180 days; password-recovery tokens 30 minutes; access-attempt log 24 hours.

6. Recipients and processors (sub-processors)

To provide the service, the controller relies on providers with whom it has signed the corresponding data-processing agreement:

  • Resend (transactional email) — United States.
  • Hostinger (web and database hosting) — Netherlands (European Union).
  • Stripe (payment gateway) — Stripe Payments Europe, Ltd. (Ireland, EU), with possible processing by Stripe, Inc. (United States). Payment is made by redirection to Stripe, which directly collects the card data as controller of such payment data.

In addition, by the very nature of the Contest, award winners' data (name and work) will be disclosed publicly on the Site and social media, and press releases will be sent to the contacts the winner may indicate. These disclosures are based on the rules and do not constitute transfers for commercial purposes.

7. International data transfers

The use of Resend involves a data transfer to the United States, covered by its certification under the EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) and, as an additional safeguard, by the Standard Contractual Clauses. Hosting on Hostinger is located in the Netherlands, within the EEA, so it does not constitute an international transfer. The use of Stripe may involve a data transfer to the United States (Stripe, Inc.), covered by its certification under the EU–US Data Privacy Framework and, as an additional safeguard, by the Standard Contractual Clauses.

8. Automated decisions and profiling

No decisions based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect individuals are taken. The evaluation of works is carried out by a human jury.

9. Commercial communications

The controller does not send commercial communications by electronic means except with prior consent or a prior contractual relationship regarding similar services. In any case, you may object simply and free of charge in each communication.

10. Cookies and similar technologies

The Site uses only the strictly necessary technical cookie for its operation. Details are provided in the Cookie Policy, available separately.

11. Rights of data subjects

The data subject may exercise at any time the rights of access, rectification, erasure, restriction of processing, objection, portability, withdrawal of consent and not to be subject to automated decisions.

To exercise them, simply write to privacy@cromawards.com, indicating the right you wish to exercise. The controller will respond within a maximum of one month, extendable depending on complexity. If you consider that your rights have not been properly addressed, you may lodge a complaint with the Spanish Data Protection Agency (C/ Jorge Juan, 6, 28001 Madrid; electronic office: sedeagpd.gob.es).

Legal basis: rights: arts. 15 to 22 GDPR; withdrawal of consent: art. 7.3 GDPR; procedures and deadline: art. 12 GDPR and arts. 12 to 18 LOPDGDD; complaint: art. 77 GDPR and art. 37 LOPDGDD.

12. Security measures

The controller applies technical and organisational measures appropriate to the risk, including: encryption of communications via HTTPS/TLS; storage of passwords encrypted with bcrypt; access control to works and entries; encrypted backups; audit logging of critical actions; and automatic blocking after failed access attempts. In the event of a security breach posing a risk to people's rights, the supervisory authority and, where appropriate, the affected individuals will be notified.

13. My cromAwards: artist account, portfolio and Pro plan

Data we process. If you create an account in My cromAwards we process: your email address; the profile details you choose to add (artist name, full name, discipline, city and region, biography, links to social media and website); your profile photograph, if you upload one; the images and details of your works, including the originals we keep so that you can readjust them; your means of access (your password, stored with irreversible encryption; the public key of your passkeys; single-use sign-in links, with the IP address from which they were requested; and the devices you mark as remembered, with their browser); the messages you exchange with galleries through the platform; visits to your portfolio, recorded in pseudonymised form for your statistics; and, if you subscribe to Pro, your Stripe customer and subscription identifiers and billing details.

Purposes and legal bases. (a) Providing the account, portfolio and, where applicable, Pro plan service, including charges and invoices: performance of the contract (Art. 6.1.b GDPR) and, for invoicing, legal obligation (Art. 6.1.c). (b) Reviewing content before it is published and removing inappropriate content: legitimate interest in keeping a safe and lawful space for artists and visitors (Art. 6.1.f). (c) Protecting accounts against unauthorised access and abuse (attempt limits, IP logging of sign-in links): legitimate interest (Art. 6.1.f). (d) Sending you notices about your account (sign-in links, security changes, gallery messages, review results, end of Pro): performance of the contract. We will not send you marketing communications without your consent.

Visibility and anonymity. Your public profile and the works you publish are visible to anyone once approved. To accredited galleries and collectors you are anonymous by default: they see an internal reference, not your name, photograph or contact details, until you decide to reveal yourself in a conversation. Your email address is never shared. Your photograph is shown only where your name already appears; on upload we remove its metadata (where it was taken, device model).

Sharing on cromAwards social media. Under the terms of use, we may share works from your portfolio on cromAwards’ social media for promotional purposes. To credit you we use the signature you have chosen for the “Works” page (your code, your artist name or your full name) and, if you sign with your name, your Instagram username if it is linked on your profile. Legal basis: performance of the contract and the licence granted in it (Art. 6(1)(b) GDPR). You may object at any time by unticking the option on your profile, and ask us to remove what has already been posted. Posts are also subject to the terms of the social network where they are published (Meta Platforms Ireland Ltd. for Instagram and Facebook).

Card in Apple Wallet and Google Wallet. If you add the card to your wallet, the pass contains your artist name, your CA code, your distinction and the link to your profile. In Apple Wallet the pass is downloaded to your device. In Google Wallet, Google LLC (United States) stores the pass to display it in your Google account; this transfer is covered by its certification under the EU–US Data Privacy Framework and by the Standard Contractual Clauses.

Retention periods. Account data is kept while the account is active. Unconfirmed accounts are deleted after 7 days. Profile photographs rejected in review are deleted immediately. When you delete a work, its image, original and thumbnails are erased. You can delete your account yourself at any time from My cromAwards › Security: your profile, your works with their originals, your photograph, your means of access and your conversations are deleted immediately, and paid Pro is cancelled if you have it. If you prefer to ask by email, we will do it within one month. We keep only what we must by law, such as entries and invoices, for the periods set by commercial and tax regulations. Backups are erased within the usual technical periods.

Your rights. You can access and modify your data at any time from My cromAwards. You can delete your account from My cromAwards › Security. To exercise any other right, write to privacy@cromawards.com from your account email, as set out in section 11.

14. Pigment, the website assistant

What it is. Pigment is an assistant that answers questions about cromAwards based on the information published on the website: it first looks for the answer in our help page and only uses artificial intelligence when it cannot find it there or when you ask for it with "Explain it better". Its answers are for guidance only: in case of doubt, the rules, the terms and this policy prevail. Using it is optional; you can always write to us at info@cromawards.com.

What data we process. The questions you type and the previous answers in the same conversation. If you are signed in to My cromAwards, also your artist code, your plan, your identity mode and the number of works in your portfolio, to tailor the answer and link you to your pages. We do not need your personal data: do not type it in the chat. To limit the number of questions we use an encrypted fingerprint of your IP address for one hour.

Who processes it. Questions answered from our help page do not leave cromAwards. When Pigment uses artificial intelligence, the text of the conversation is sent to Anthropic, PBC (United States), which provides the service as a data processor. This international transfer relies on the safeguards provided for in the GDPR, such as the Standard Contractual Clauses.

Retention. cromAwards does not store the content of conversations: it only records how many questions are asked to the artificial intelligence and their technical volume, to control costs. The conversation is kept in your own browser during your visit and is deleted when you close the tab or press "Close" in Pigment. Anthropic may keep the data for the limited time set out in its terms, for example to prevent abuse.

Legal basis. Our legitimate interest in answering your questions quickly and clearly (Art. 6(1)(f) GDPR).

15. Changes to this policy

The controller may update this Policy to adapt it to regulatory or service changes. Relevant changes will be communicated by appropriate means and, where applicable, fresh consent will be requested. The date of the latest version appears in the header.

16. Applicable law

Processing is governed by Regulation (EU) 2016/679 (GDPR), Organic Act 3/2018 (LOPDGDD) and Act 34/2002 (LSSI-CE), as well as other applicable Spanish and European Union legislation.

Legal sources and references

  • Regulation (EU) 2016/679 (GDPR). General Data Protection Regulation.
  • Organic Act 3/2018 (LOPDGDD). Data protection and guarantee of digital rights.
  • Act 34/2002 (LSSI-CE). Information-society services.
  • Organic Act 1/1982. Right to honour, personal and family privacy and one's own image.
  • Implementing Decision (EU) 2023/1795 and 2021/914. EU–US Data Privacy Framework adequacy and Standard Contractual Clauses.
  • Commercial Code (art. 30) and Act 58/2003, General Tax Act (arts. 66 to 70). Accounting and tax retention periods.
  • AEPD. Supervisory authority and guidelines.