Privacy Policy
The short version
- We collect only what we need to deliver your membership, run the platform and keep our accounts.
- We never sell your personal data.
- Card payments are handled by Stripe, and we never see your full card number.
- You can ask to see, correct or delete your data at any time.
1. Who is responsible
The data controller is Webtjenester Nymann, organisation number 934 776 836, 3111 Tønsberg, Norway, which operates TokenView Gallery ("TokenView", "we", "us"). For anything about your personal data, email paal@tokenviewgallery.com.
2. What we collect
| Data | When | Why |
|---|---|---|
| Name, email address, billing address | When you buy a membership or a work | To deliver what you bought, send receipts and access instructions, and keep accounts |
| Payment details | At checkout | Stripe processes the payment. We only receive the payment status, the card brand, the last four digits and the country |
| Account details: username, profile and settings | When you create or use an account | To run your account and your galleries |
| Artworks, certificates, sales history and, if you connect them, wallet addresses | When you list, buy, display or connect works | To certify, display and sell works, and to verify ownership |
| Device and screen data: device type, which screens are active, playback status | When TokenView runs on your screens | To manage screen allowances, keep content protected and fix problems |
| Messages to us | When you email or contact us | To answer you |
| Identity verification (KYC) data | Only for sellers, and only where the law or payment rules require it | To meet anti-money-laundering and payment-provider obligations |
3. Legal basis
- Contract (GDPR art. 6(1)(b)): delivering your membership, purchases and account.
- Legal obligation (art. 6(1)(c)): accounting and tax rules, and anti-money-laundering rules where they apply.
- Legitimate interest (art. 6(1)(f)): keeping the platform secure, preventing fraud and improving the service.
- Consent (art. 6(1)(a)): newsletters and marketing emails. You can withdraw consent at any time with one click in any email.
4. Who we share data with
We share personal data only with the service providers we need to run TokenView, and only as far as they need it:
- Stripe: payment processing and fraud prevention.
- Hosting, database and email providers: to run the platform and send emails.
- Accountant and authorities: where accounting, tax or other law requires it.
- Buyers and sellers: when you buy or sell a work, the other party sees the information needed to complete the sale, such as the artist's name or the edition number.
Some providers, such as Stripe, may process data outside the EU/EEA. When they do, the transfer is protected by the EU Commission's standard contractual clauses or another valid transfer mechanism under the GDPR.
5. How long we keep data
- Accounting records, such as receipts and payments: 5 years, as required by Norwegian accounting law (bokføringsloven).
- Account and membership data: for as long as your account or membership is active, and up to 12 months afterwards.
- Certificates and sales history for works: for as long as the work exists on the platform, because these records are part of the work's authenticity history.
- Messages to us: up to 24 months.
6. Your rights
You have the right to:
- see what data we hold about you
- correct it
- have it deleted
- restrict how we use it
- object to processing based on legitimate interest
- receive your data in a portable format
Email paal@tokenviewgallery.com and we will answer within 30 days. We may need to keep some data to meet legal obligations, such as accounting records, even if you ask us to delete it.
If you think we handle your data wrongly, you can complain to the Norwegian Data Protection Authority (Datatilsynet).
7. Cookies and fonts
TokenView uses only the cookies needed to log you in and keep the service working. Our pages load fonts from Google Fonts, which means your browser sends your IP address to Google when a page loads. If we add analytics or marketing cookies, we will ask for your consent first.
8. Security
We protect data with encrypted connections (HTTPS) and access control, and artworks are protected with encryption. We never store full card details.
9. Changes
If we change this policy in a way that matters to you, we will tell you by email or on the platform before the change takes effect.