Operated by NOMI VENTURES LIMITED
Privacy Policy
Approved for publication · Effective 24 July 2026
Arrival Shows Privacy Policy
Status: Approved for publication by NOMI VENTURES LIMITED Version: 1.1 Effective date: 24 July 2026 Last updated: 25 July 2026
1. Who is responsible for your information
NOMI VENTURES LIMITED is the controller of personal information handled through Arrival Shows.
Company number: 16440844 Registered office: 3rd Floor, 86–90 Paul Street, London, England, United Kingdom, EC2A 4NE Privacy contact: curator@arrivalshows.uk\ Website: https://arrivalshows.uk
Arrival Shows is presented by Arrival Gallery. In this policy, “we”, “us”, and “our” mean NOMI VENTURES LIMITED.
2. What this policy covers
This policy explains how we handle information about:
- artists, photographers, collective contacts, and people acting for them;
- exhibition and website visitors;
- people who send artwork, support, privacy, press, or partnership enquiries; and
- people who receive service emails through our account-free secure-link system.
3. Information we collect
Submission and contact information
This may include your name, display name, email address, country, biography, statement, social or website links you choose to provide, submission reference, support messages, and communication history.
Artwork and exhibition information
This may include images, titles, dates, media, dimensions, prices or availability, alt text, series or location details, artist notes, permissions confirmations, moderation status, preview corrections, and public exhibition content.
Artwork or photographs may contain information about identifiable people. Do not submit another person’s personal information unless you have a lawful basis and any permission required for the exhibition uses.
Order and payment information
This may include package, artwork allowance, price, VAT, currency, payment status, transaction reference, billing country or postcode where supplied by the payment provider, refund or transfer status, and receipt records.
Payment-card details are entered into Stripe’s secure checkout. We do not intend to receive or store your full card number or security code. Stripe processes payment information for payment, fraud prevention, refunds, and related transaction services under its applicable terms and privacy information.
Secure-link and technical information
Because Arrival Shows has no artist account or dashboard, we use personal links sent by email. We may process the link identifier or a protected representation of it, submission reference, expiry, issue and redemption times, IP address, device/browser information, security events, and audit logs needed to provide and protect the service.
Enquiry information
If you enquire about an artwork, we collect the details you enter, such as name, email, optional phone number, artwork, artist, and message. We forward the enquiry privately to the artist and copy Arrival Gallery.
Email delivery information
We process email address, template/event type, send time, delivery, bounce, complaint, attachment delivery, and limited diagnostic information. Secure-link emails should not use advertising pixels or third-party click tracking that would expose their tokens.
Website and analytics information
We process limited device, browser, request, security, and diagnostic information needed to deliver and protect the service. We also keep aggregate hourly counts of successful public page requests by path. Those aggregate counts do not contain an IP address, cookie identifier, device identifier, or user-agent string. Arrival Shows does not use optional client-side analytics or a separate client-side error-monitoring service. If either is introduced later, this policy and the Cookie Policy will be updated before use and any legally required permission will be obtained.
4. Why we use information and our lawful bases
| Purpose | Information | Lawful basis |
|---|---|---|
| Provide checkout, secure links, submissions, previews, exhibitions, certificates, and PDFs | Contact, order, submission, artwork, technical, and delivery information | Contract; steps at your request before contract |
| Validate files and moderate possible rights, safety, fraud, or content issues | Submission, artwork, technical, and moderation information | Contract; legitimate interests in operating a lawful and safe exhibition service |
| Take payment, issue receipts/refunds, and keep tax/accounting records | Order, transaction, billing, and contact information | Contract; legal obligation |
| Publish artist, biography, artwork, price/availability, and exhibition content | Approved submission and artwork information | Contract and the Artist Rights Agreement |
| Forward visitor artwork enquiries and prevent abuse | Visitor contact/message, artwork, artist contact, and security information | Steps requested by the visitor; legitimate interests of visitors, artists, Arrival Gallery, and us in facilitating and securing enquiries |
| Send non-promotional service messages | Contact, submission, order, deadlines, delivery, and support information | Contract; legitimate interests in administering the service |
| Respond to support, privacy, accessibility, press, or partnership messages | Contact and message information | Steps at your request; contract where relevant; legitimate interests in responding and keeping a record |
| Protect the site, investigate misuse, establish legal claims, and maintain audit evidence | Technical, security, consent, moderation, order, and communication records | Legitimate interests; legal obligation where applicable |
| Measure use of public pages through aggregate server-side page counts | Request path and aggregate hourly count | Legitimate interests in understanding and improving the service |
| Measure and improve the site through non-essential analytics | Consent, device, usage, and approximate-location information | Consent where required by data-protection or electronic-communications law |
Where we rely on legitimate interests, we consider the purpose, necessity, and effect on people. You can ask for more information about that assessment.
We do not use transactional submission information for unrelated direct marketing without a separate valid permission or another lawful route. A service email may contain Arrival Shows branding but should not contain promotional offers.
5. What is public
During the exhibition month, approved information may be public, including:
- artist or collective display name;
- biography, statement, and optional artist links;
- artwork images, titles, dates, media, dimensions, notes, alt text, and display order;
- public price, Price on request, Not for sale, or Sold status; and
- exhibition titles and introductions.
We do not publish the artist’s email address through the exhibition. Public exhibitions close at the end of the relevant month and are not kept as a permanent public archive. Search engines, visitors, screenshots, and recipients of delivered PDFs may retain copies outside our control.
6. Who we share information with
We may share the minimum necessary information with:
- Stripe for payment processing, fraud prevention, refunds, and transaction records;
- Cloudflare services used through OpenAI Sites for application hosting, D1 database records, R2 artwork storage, image delivery, security, and restricted operational logs;
- the transactional-email provider configured for Arrival Shows for secure links, receipts, deadlines, support acknowledgements, certificates, and PDFs;
- technical certificate and PDF-generation services used within the application or through a reviewed provider;
- the monitored support mailbox used for
curator@arrivalshows.uk; - the relevant artist and Arrival Gallery when a visitor sends an artwork enquiry;
- professional advisers, insurers, auditors, regulators, law enforcement, courts, or rights claimants where lawfully necessary; and
- a buyer or successor in a business reorganisation, subject to appropriate safeguards.
We do not sell personal information.
7. International transfers
Artists and visitors may be anywhere in the world, and approved exhibition information is available internationally while public.
Some service providers may process personal information outside the UK. Before using such a provider, we will identify an appropriate transfer mechanism and safeguards where required, such as UK adequacy regulations, the UK International Data Transfer Agreement, or the UK Addendum, together with an appropriate risk assessment.
8. How long we keep information
We keep information only for as long as reasonably needed for the stated purpose, legal duties, security, and disputes. The approved launch schedule is:
| Record | Standard retention |
|---|---|
| Public exhibition pages | Removed at 11:59 pm on the final day of the exhibition month |
| Source artwork files and submission content | Deleted from active production storage within 90 days after the exhibition closes |
| Generated PDFs and certificates | Deleted from delivery storage within 30 days after confirmed delivery |
| Payment, VAT, refund, accounting, contract, rights, and accepted-policy records | 6 years, or longer only where law requires |
| Moderation records | 12 months; up to 6 years where connected to a complaint, claim, fraud, repeat abuse, or legal obligation |
| Support and complaint records | 2 years after the matter closes; longer only if linked to a legal claim or retained transaction record |
| Visitor artwork enquiries | 12 months after forwarding, unless needed for a complaint, safety issue, or claim |
| Secure-link and security logs | 90 days after expiry or use; longer only for an active investigation |
| Routine email delivery logs | 90 days, with necessary transaction evidence retained alongside the relevant order |
| Consent-preference records | 5 years after the preference is replaced or withdrawn |
| Analytics event data | No longer than 13 months |
| Rolling backups | No longer than 35 days before overwrite; access restricted to restoration and security needs |
Deletion from live systems may not immediately remove data from protected backups. When restored, deletion rules should be reapplied. We may retain a minimal record to demonstrate that a deletion request was completed.
9. Security
We use organisational and technical measures appropriate to the risk, including access controls, personal time-limited links, encrypted connections, provider due diligence, restricted staff permissions, logging, backups, and incident procedures. No internet service is completely risk-free.
Do not share secure links. Tell curator@arrivalshows.uk promptly if a link, submission, or message appears to have been accessed without permission.
10. Automated checks and decisions
We use automated checks for payment status, required fields, image validity, capacity, and possible content-policy signals. A flagged submission goes to staff review; it is not rejected solely because of a subjective artistic judgement.
We assess whether an automated decision could have a legal or similarly significant effect. Where it could, we apply the safeguards and explanations required by UK data-protection law, including human review where required.
11. Your rights
Depending on the circumstances, you may have rights to:
- be informed about use of your information;
- access your personal information;
- correct inaccurate information;
- have information erased;
- restrict processing;
- receive certain information in a portable format;
- object to processing based on legitimate interests or direct marketing;
- withdraw consent at any time, without affecting earlier lawful use; and
- challenge certain solely automated decisions.
These rights are not absolute. To make a request, contact curator@arrivalshows.uk. We may need proportionate information to verify identity and protect the submission. We normally respond within the period required by law.
You may complain to the UK Information Commissioner’s Office at ico.org.uk. We would appreciate the opportunity to address the concern first.
12. Children
Arrival Shows applications are for people aged 18 or over. The service is not directed to children as applicants. Work must never contain sexual content involving minors. If you believe a child’s personal information has been submitted unlawfully, contact curator@arrivalshows.uk immediately.
13. Changes to this policy
We may update this policy when the service, providers, or law changes. We will post the new version and date. Where a material change affects an active submission, we will provide an appropriate notice. Accepted contract and rights-agreement versions remain recorded with the relevant submission.