{
  "version": "acc-privacy-v0.3",
  "locale": "en",
  "revisedAt": "2026-10-13",
  "title": "ACC privacy and data processing",
  "intro": "What data ACC processes, what becomes public and how to exercise your privacy rights.",
  "sections": [
    {
      "title": "Controller",
      "body": "The data controller is ART CLEARANCE CERTIFICATION Sp. z o.o., KRS 0001193252, NIP 9662211120, REGON 542695867, ul. Zlota 2/19, 15-016 Bialystok, Poland. Contact: info@artclearancecertification.org."
    },
    {
      "title": "Data we may process",
      "items": [
        "Declarant data: name, email, role or organization.",
        "Work metadata: title, artist, creator, phonogram producer, ISRC, optional ISWC and author/IPI details.",
        "Technical file data: name, size, MIME type and SHA-256 hash.",
        "Declaration data: category, answers, version, timestamp and declaration hash.",
        "Historical external-evidence metadata: file name, type, size and hash, without implying signature validation.",
        "Certificate data: ACC ID, status, public verification URL and timestamp-proof state.",
        "Usage and verification data: lookups, API calls, verification events, partner identifiers, timestamps and status results.",
        "Technical logs: IP address, endpoint, time, user agent and API response status."
      ]
    },
    {
      "title": "Audio files",
      "body": "ACC is designed so that a browser or partner system can calculate the audio hash without ACC needing to permanently store the audio file. If a future production workflow accepts audio files, this policy will be updated before that processing becomes standard."
    },
    {
      "title": "Purposes",
      "items": [
        "Issuing and operating ACC certificates.",
        "Binding declarations to work metadata and hashes.",
        "Providing public verification and partner API responses.",
        "Running partner pilots and business communications.",
        "Securing the system, auditing activity and preventing abuse.",
        "Handling corrections, disputes, revocations and support requests.",
        "Creating aggregate analytics, market intelligence and work/provenance data products connected with ACC certification."
      ]
    },
    {
      "title": "Legal bases",
      "body": "Depending on the context, processing may be based on performance of a service or pre-contractual steps, ACC's legitimate interests in operating a trustworthy certification system, consent where required, or legal obligations. The exact basis may depend on the specific workflow."
    },
    {
      "title": "Public certificate data",
      "body": "In the public Creator workflow, public verification, downloads and API may show declarant name, artist, credited creator, producer, author names and IPI, ISRC/ISWC, file name, size and type, category, certificate ID, issue time, declaration version and hash, recorded identity-evidence level, certificate status and timestamp evidence. The submission summary identifies the fields before acceptance. Contact emails, account credentials and raw audio are not published. An IPI may link a pseudonym to registry records. Account-connected workflows must show their own specific public-data scope."
    },
    {
      "title": "Commercial work-data use",
      "body": "ACC may use certified work metadata, category, hashes, timestamps, status, ledger/anchor state, partner API events and verification activity to create reports, analytics, API products and market intelligence. This is part of ACC's business model. ACC does not sell private account, contact or identity data as a standalone product."
    },
    {
      "title": "Consent and acceptance records",
      "body": "ACC may store the version, timestamp, source, accepted statements and document references connected with a certification request or partner contact form so that ACC can demonstrate what information was presented and accepted."
    },
    {
      "title": "Service providers",
      "body": "ACC uses infrastructure and service providers such as Vercel, Cloudflare, home.pl and SMTP/email providers where needed for the service. An identity, signature, Open Banking or additional analytics workflow requires its own confirmed processing scope before activation; mentioning it does not announce an active check."
    },
    {
      "title": "Retention",
      "body": "Certificate records, hashes and status history may be retained as long as needed to preserve verification integrity, handle disputes and protect the credibility of the standard. Contact data, correspondence and logs are retained for the period needed for the relevant relationship, security purpose or legal claim."
    },
    {
      "title": "Your rights",
      "body": "Depending on the legal basis and context, you may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You also have the right to lodge a complaint with a supervisory authority."
    },
    {
      "title": "Contact",
      "body": "Privacy requests should be sent to info@artclearancecertification.org."
    },
    {
      "title": "Historical HUMAN LEGACY records",
      "body": "HUMAN LEGACY is issued on ACC's initiative from referenced historical metadata and chronology. It is not a creator or rights-holder declaration, endorsement or a fourth declaration class. It does not inspect or bind a specific audio file. The public record identifies the source and limitations. Its timestamp dates ACC's statement, not the historical recording. Use only the distinct HUMAN LEGACY mark, not a HUMAN declaration mark."
    }
  ]
}