Skip to content
Get started

Privacy policy

Last updated: 4 November 2026.

This policy explains what personal data we process at Exhibify VR, why, on what legal basis, how long we keep it and what your rights are. It follows the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and Spanish Organic Law 3/2018 on data protection and digital rights (LOPDGDD).

Buying the one-time license also has its own, more detailed notice: the purchase privacy notice.

1. Who the data controller is

  • Controller: ITGALLERY SOLUTIONS SLU, owner of Exhibify VR.
  • Tax ID (NIF): B76238153.
  • Address: Calle Horno de Cal 4, Portal B, 35019 Las Palmas de Gran Canaria (Spain).
  • Contact: hello@exhibify.net.

2. What data we process and why

When you visit this website

  • Data: the technical details of each visit (IP address, date and time, page requested and browser), which are logged when the website is served.
  • Why: to make the website work and to protect it against abuse and attacks.
  • Legal basis: our legitimate interest in keeping the website secure (article 6(1)(f) GDPR).
  • How long: 90 days at most; those of the contact form, 30 days.
  • This website does not use cookies or analytics tools: see the cookie policy.

When you write to us through the form or by email

  • Data: name, email address, subject, message and the language of the page, plus the IP address to limit repeated submissions.
  • Why: to answer your question and, if you ask about yearly plans, to prepare a proposal.
  • Legal basis: your request and the steps prior to a possible contract (article 6(1)(b) GDPR).
  • How long: if you don’t become a customer, up to two years from our last contact; if you do, see the next section.

When you buy the one-time license or sign up for a yearly plan

  • Data: the details from the purchase form (first name, last name, email, language, exhibition name and billing details), what the payment provider returns (payment ID, amount and billing address) and the version of the terms you accept, with the date. Card details are handled by the payment provider: we never see them.
  • Why: to manage the purchase, create the account, provide the service, take payment and issue the invoice.
  • Legal basis: the contract (article 6(1)(b) GDPR) and our tax and accounting obligations (article 6(1)(c)).
  • How long: for the duration of the contract and then for the periods required by law: six years for accounting records and invoices (Spanish Commercial Code) and the limitation periods for tax obligations.
  • The details are in the purchase privacy notice.

When you use the editor and your account

  • Data: your login email and password (stored in a way that no one can read it), the exhibitions, artworks, images and texts you upload, and the dates of your license.
  • Editor usage data: once we turn on its analytics tool (PostHog), which features are used, errors and, in some cases, recordings of the on-screen session, to improve the product and fix bugs. We will ask for your permission in the editor first.
  • Why: to provide and improve the service.
  • Legal basis: the contract, to provide the service; for usage data, your consent (article 6(1)(a) GDPR).
  • How long: while the account is active and, once the license is deactivated, until we delete the account and the exhibitions (you can ask us to at any time). Usage data, until you withdraw your permission or it is no longer needed for that purpose.

When you visit a published exhibition

  • Published exhibitions can be viewed without an account, through a link or a QR code.
  • Visitor data: the technical details of the visit and, once we turn on analytics, viewer usage data, as in the editor and also with permission.
  • Data shown in the exhibition (for example, the artist’s name or the artist’s website): chosen by the customer who publishes it, who is responsible for having permission to show them. For that data, the customer is the controller and we process it on the customer’s behalf.

Marketing emails

  • Only if you tick the box when you buy (or ask us to): Exhibify VR news and offers by email.
  • Legal basis: your consent (article 6(1)(a) GDPR and article 21 LSSI-CE).
  • You can unsubscribe at any time with the link in each email or by writing to hello@exhibify.net.
  • How long: until you unsubscribe.

3. Required data

The fields marked as required on each form are needed to reply, to complete the purchase or to provide the service. Without them, we can’t do it.

4. Who else processes the data

  • Processors, who only use the data for what we ask them to and under contract:
    • the card payment provider (Stripe);
    • hosting for the website, the editor and the platform, and sending emails (Amazon Web Services, in Ireland);
    • the invoicing software (Holded);
    • the analytics tool for the editor and the viewer (PostHog), once we turn it on.
  • The Exhibify platform (vr.exhibify.net), where accounts and exhibitions live, belongs to ITGALLERY SOLUTIONS SLU: it is not a third party.
  • Authorities (for example, the Spanish Tax Agency), when the law requires it.
  • We do not sell or share data with anyone for their own purposes.

5. Transfers outside the European Economic Area

Some of these providers may process data outside the European Economic Area, for example in the United States. When they do, they rely on the safeguards provided by the GDPR: the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses. Amazon Web Services processes them in the European Union, in Ireland.

6. Your rights

At any time, you can ask us to:

  • access your data;
  • correct it if it’s wrong, or delete it;
  • object to our processing it, or restrict the processing;
  • give it to you in a format you can take to another service (portability);
  • withdraw any consent you have given, without affecting what was done before.

We do not make automated decisions or create profiles that affect people.

To exercise these rights, write to hello@exhibify.net with the subject “Data protection”, from your account email if you have one. If needed, we will ask for something more to confirm it’s you. We reply within one month at most (extendable by two more if the request is complex, letting you know beforehand).

If you believe we have not handled your data properly, you can file a complaint with the Spanish Data Protection Agency (AEPD, www.aepd.es).

7. Children

Exhibify VR is a service for art professionals and is not intended for children under 14. We do not knowingly process data from children under that age.

8. Security

We apply appropriate technical and organizational measures to protect the data, such as encrypted connections (HTTPS) on the website and the editor and restricted access to the data.

9. Changes to this policy

If we change this policy, we will publish the new version here with its date. If the change is significant, we will let our customers know by email.