ARTIT
    Back to artit.net

    Record of Processing Activities (ROPA)

    Artit London Ltd · Company No. 10024386 · England & Wales

    Article 30 UK GDPR · ICO registration CSN1195127

    Effective date: Prepared: 7 September 2026 · Internal record

    1. About this record

    1.1 This is the Record of Processing Activities (ROPA) of Artit London Ltd ("ARTIT"), maintained under Article 30 of the UK GDPR. It records the personal data ARTIT processes as a controller, why, on what lawful basis, with whom it is shared, where it goes, how long it is kept, and how it is protected.

    1.2 Controller: Artit London Ltd, company number 10024386, Second Floor Belgrave Court, 23A, 36 Westferry Circus, London, E14 8RL. Contact: contact@artit.net. ICO registration: CSN1195127. Data protection lead: designated internally.

    1.3 Hosting: the website/front end is hosted by Vercel; the back-end application and database by DigitalOcean. Payments: Stripe. Email: Mailchimp. Analytics/site tools: Google (Analytics, reCAPTCHA, Maps).

    1.4 Transfers: transfers from the UK to the EEA rely on UK adequacy regulations (no additional safeguards). Transfers to processors in the US or other third countries (for example Stripe, Google, Mailchimp) rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, under each provider's data-processing agreement.

    1.5 This ROPA is a living document and is reviewed and updated as ARTIT's processing changes. Outstanding items to confirm are listed in section 3. Prepared / effective: 7 September 2026. For how this processing affects you, see our Privacy Policy and Terms & Conditions.

    2.1 Account registration and management

    2.2 Public profile and portfolio

    2.3 Age verification (18+)

    2.4 Creating and running Opportunities

    2.5 Opportunity applications and submissions

    2.6 Payments, fees, refunds and payouts

    2.7 Matching and recommendations (AI)

    2.8 Marketing communications (newsletter)

    2.9 Site analytics, functionality and anti-abuse

    2.10 Trust, safety, fraud prevention and enforcement

    2.11 Support and communications

    2.12 Verification — individual organisers

    3. Outstanding confirmations and review

    3.1 This ROPA should be kept current. The following items should be confirmed and reviewed:

    • confirm which provider hosts the application versus the database, and the exact region(s);
    • ensure a Data Processing Agreement (DPA) is in place and on file with each processor: Stripe, Google, Mailchimp, Vercel and DigitalOcean;
    • set and record the Google Analytics data-retention period;
    • confirm the Article 9 condition for trust-and-safety processing (2.10) with a data-protection adviser;
    • complete a Data Protection Impact Assessment (DPIA) for the AI matching (2.7) and the special-category processing (2.5, 2.12);
    • confirm the UK-versus-EU position (given ARTIT's Athens presence) and whether an EU representative is required.

    3.2 Review this record at least annually, and whenever a new processing activity, processor or data type is introduced.