Privacy and data handling for ACC certification workflows.

Controller

The data controller is ART CLEARANCE CERTIFICATION Sp. z o.o., KRS 0001193252, NIP 9662211120, REGON 542695867, ul. Zlota 2/19, 15-016 Bialystok, Poland. Contact: info@artclearancecertification.org.

Data we may process

• Declarant data: name, email, role or organization.
• Work metadata: title, artist, creator, ISRC and music recording details.
• Technical file data: file name, size, MIME type and SHA-256 hash.
• Declaration data: category, answers, declaration version, timestamp and declaration hash.
• Level 2 evidence metadata: signed evidence file name, type, size and hash.
• Certificate data: ACC ID, status, public verification URL and anchor status.
• Technical logs: IP address, endpoint, time, user agent and API response status.

Audio files

ACC is designed so that a browser or partner system can calculate the audio hash without ACC needing to permanently store the audio file. If a future production workflow accepts audio files, this policy will be updated before that processing becomes standard.

Purposes

• Issuing and operating ACC certificates.
• Binding declarations to work metadata and hashes.
• Providing public verification and partner API responses.
• Running partner pilots and business communications.
• Securing the system, auditing activity and preventing abuse.
• Handling corrections, disputes, revocations and support requests.

Legal bases

Depending on the context, processing may be based on performance of a service or pre-contractual steps, ACC's legitimate interests in operating a trustworthy certification system, consent where required, or legal obligations. The exact basis may depend on the specific workflow.

Public certificate data

ACC certificates are designed to be verifiable. Public records may show the data needed to verify status and integrity, including certificate ID, category, work metadata, hashes, status and verification boundary. Declarant visibility may depend on the certification workflow and accepted declaration.

Service providers

ACC may use infrastructure and service providers such as Vercel, Cloudflare, home.pl, SMTP/email providers and identity, signature, Open Banking or analytics providers where needed for the service.

Retention

Certificate records, hashes and status history may be retained as long as needed to preserve verification integrity, handle disputes and protect the credibility of the standard. Contact data, correspondence and logs are retained for the period needed for the relevant relationship, security purpose or legal claim.

Your rights

Depending on the legal basis and context, you may have rights of access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You also have the right to lodge a complaint with a supervisory authority.

Contact

Privacy requests should be sent to info@artclearancecertification.org.