Privacy Policy

How Warrant Art Lab collects, uses, and protects your personal data.

Last updated: March 2026

1. Data Controller

1.1 Identity

Data Controller: Warrant Art Lab
Location: Hanko, Finland
Contact: privacy@warrantartlab.com

1.2 Scope

This Privacy Policy applies to all personal data processed through the Warrant Art Lab ("WaL") platform, including data collected during account creation, DAW transactions, provenance operations, and partner interactions.

1.3 Applicable Law

Data processing is governed by the EU General Data Protection Regulation (GDPR), the Finnish Data Protection Act (tietosuojalaki 1050/2018), and applicable ePrivacy rules.

2. Data We Collect

2.1 Account Data

Name, email address, password (hashed), role (creator, collector, partner, institution), country, language preference.

2.2 Transaction Data

DAW purchases, sales, transfers, royalty flows, payout history, payment method references (tokenized via PSP; WaL does not store card details).

2.3 DAW Provenance Data

Artwork metadata, provenance chain entries, hash values, C2PA manifests, WAC snapshots, event logs, creator/institution attribution.

2.4 DAW-S Telemetry Data

For Screen Rights (DAW-R(Screen)/DAW-S): device ID, session timestamps, venue category, playback duration, watermark integrity checks, error logs.

2.5 Support Data

Messages to support, feedback, dispute correspondence, consent records.

2.6 Partner Data

Contact details of partner representatives (print partners, device partners, institutional contacts), contractual identifiers, integration metadata.

2.7 Technical Data

IP address, browser type, device identifiers, log files, cookies (see Section 5).

3. Purposes & Legal Bases

3.1 Contract Performance (Art. 6(1)(b))

Account creation and authentication
DAW issuance, transfer, and provenance management
Royalty calculation and payment routing
Screen Rights enforcement and metering

3.2 Legitimate Interests (Art. 6(1)(f))

Platform security and fraud prevention
Service improvement and analytics
Protecting rightsholders and the integrity of the provenance system
Dispute resolution and evidence generation

3.3 Legal Obligations (Art. 6(1)(c))

Tax and accounting compliance
Anti-money laundering (AML) requirements where applicable
Responding to lawful court or regulatory orders

3.4 Consent (Art. 6(1)(a))

Marketing communications (opt-in; withdrawable at any time)
Non-essential cookies and analytics (see Section 5)

4. DAW-Specific Processing

4.1 Provenance Records

DAW provenance data (event chains, hash values, transfer history) is retained for the lifetime of the DAW in the WaL ledger, including after Exit Minting (read-only). This is necessary to maintain the integrity and auditability of the provenance system.

4.2 Royalty Processing

Transaction and royalty data is processed to calculate and distribute payments to creators, institutions, DAW holders, and partners. Data is retained for the duration required by tax and accounting law (typically 7 years).

4.3 Exit Minting

Upon Exit Minting, the DAW's provenance record is sealed and preserved in read-only form. Personal data linked to the DAW is retained only to the extent necessary for legal, audit, and dispute purposes.

4.4 WAC Administration

WAC-related data (rights grants, royalty splits, institutional terms) is processed and stored to administer the contractual framework governing each DAW.

4.5 Anchoring & Integrity

Cryptographic hashes and anchoring data (blockchain timestamps, C2PA manifests) are generated and stored to ensure the immutability and verifiability of DAW provenance records.

5. Cookies & Analytics

5.1 Essential Cookies

Session management, authentication tokens, CSRF protection. These are required for the platform to function and cannot be disabled.

5.2 Functional Cookies

User preferences, language settings, display options. These enhance the user experience but are not strictly necessary.

5.3 Analytics Cookies

Anonymous usage statistics to understand how the platform is used and to improve service quality. WaL uses privacy-respecting analytics tools and does not share analytics data with advertisers.

5.4 Consent Management

Where required by law, WaL will obtain consent before setting non-essential cookies. Users can manage cookie preferences at any time via the cookie settings panel.

6. Data Sharing & Subprocessors

6.1 Categories of Recipients

Payment service providers (PSPs) such as Stripe — for payment processing and royalty distribution
Cloud infrastructure providers — for hosting and data storage
Email and notification providers — for transactional communications
Print and device integration partners — to the extent necessary for DAW-R/DAW-S execution
Institutions — where WaL acts as data processor on behalf of an institutional data controller
Law enforcement and regulators — only where required by lawful orders

6.2 Safeguards

WaL selects subprocessors with appropriate technical and organizational security measures.
Data processing agreements (DPAs) are in place as required by GDPR.
Subprocessors process personal data only on WaL's documented instructions.
WaL does NOT sell personal data to advertisers or third parties.

7. International Transfers

7.1 Transfer Mechanisms

Personal data is primarily stored within the EU/EEA.
Where data is transferred outside the EU/EEA (e.g., to subprocessors), WaL ensures appropriate safeguards are in place:
Adequacy decisions by the European Commission
Standard Contractual Clauses (SCCs)
Other lawful transfer mechanisms under GDPR

8. Data Retention

8.1 Retention Periods

Account data: retained for the duration of the account and a reasonable period thereafter for legal compliance.
Transaction and royalty data: retained for the period required by tax and accounting law (typically 7 years).
Provenance and DAW-related data: retained for the lifetime of the DAW in the WaL ledger.
Telemetry data (DAW-S): retained for the period necessary to calculate royalties and enforce rights, then deleted or anonymized.
Marketing data: retained until consent is withdrawn or the user objects.
Where possible, WaL anonymizes or aggregates data for analytics.

9. Your Rights (GDPR)

9.1 Data Subject Rights

Right of access — obtain confirmation and a copy of your personal data
Right to rectification — correct inaccurate or incomplete data
Right to erasure — request deletion where no longer necessary or consent is withdrawn
Right to restriction — request limited processing in certain circumstances
Right to data portability — receive data in machine-readable format
Right to object — object to processing based on legitimate interests or direct marketing
Right to withdraw consent — withdraw consent at any time (without affecting past lawful processing)

9.2 How to Exercise

Submit requests to: privacy@warrantartlab.com
WaL will respond within 30 days. Complex requests may require an extension of up to 60 additional days, with notice.

10. Supervisory Authority

10.1 Finnish Data Protection Ombudsman

Users have the right to lodge a complaint with their local supervisory authority.
In Finland: Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman)
Address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Website: tietosuoja.fi

11. Data Security

11.1 Technical Measures

Encryption in transit (TLS) and at rest where feasible
Access controls and role-based permissions
Regular security audits and vulnerability scanning
Logging and monitoring of system events
Restricted access to production data on a need-to-know basis
Password hashing with industry-standard algorithms
Payment card data handled exclusively by Stripe (never stored by WaL)

11.2 Breach Notification

In the event of a personal data breach likely to result in high risk to data subjects, WaL will notify affected users and the supervisory authority as required by GDPR.

12. Children

12.1 Age Restrictions

The WaL platform is not intended for users under 16 years of age.
WaL does not knowingly collect personal data from children under 16.
If we discover that data has been collected from a user who does not meet the minimum age requirement, we will delete it promptly.

13. Changes to This Policy

13.1 Updates

WaL may update this Privacy Policy to reflect changes in applicable law, platform features, or data processing practices.
Material changes will be communicated to registered users via email or platform notification at least 30 days before they take effect.
The current version is always available at warrantartlab.com/privacy-policy.

See also: Terms of Service · Consumer Rights

By using Warrant Art Labs, you acknowledge that you have read and understood this Privacy Policy.

Privacy Policy

How Warrant Art Lab collects, uses, and protects your personal data.

Last updated: March 2026

1. Data Controller

1.1 Identity

Data Controller: Warrant Art Lab
Location: Hanko, Finland
Contact: privacy@warrantartlab.com

1.2 Scope

This Privacy Policy applies to all personal data processed through the Warrant Art Lab ("WaL") platform, including data collected during account creation, DAW transactions, provenance operations, and partner interactions.

1.3 Applicable Law

Data processing is governed by the EU General Data Protection Regulation (GDPR), the Finnish Data Protection Act (tietosuojalaki 1050/2018), and applicable ePrivacy rules.

2. Data We Collect

2.1 Account Data

Name, email address, password (hashed), role (creator, collector, partner, institution), country, language preference.

2.2 Transaction Data

DAW purchases, sales, transfers, royalty flows, payout history, payment method references (tokenized via PSP; WaL does not store card details).

2.3 DAW Provenance Data

Artwork metadata, provenance chain entries, hash values, C2PA manifests, WAC snapshots, event logs, creator/institution attribution.

2.4 DAW-S Telemetry Data

For Screen Rights (DAW-R(Screen)/DAW-S): device ID, session timestamps, venue category, playback duration, watermark integrity checks, error logs.

2.5 Support Data

Messages to support, feedback, dispute correspondence, consent records.

2.6 Partner Data

Contact details of partner representatives (print partners, device partners, institutional contacts), contractual identifiers, integration metadata.

2.7 Technical Data

IP address, browser type, device identifiers, log files, cookies (see Section 5).

3. Purposes & Legal Bases

3.1 Contract Performance (Art. 6(1)(b))

Account creation and authentication
DAW issuance, transfer, and provenance management
Royalty calculation and payment routing
Screen Rights enforcement and metering

3.2 Legitimate Interests (Art. 6(1)(f))

Platform security and fraud prevention
Service improvement and analytics
Protecting rightsholders and the integrity of the provenance system
Dispute resolution and evidence generation

3.3 Legal Obligations (Art. 6(1)(c))

Tax and accounting compliance
Anti-money laundering (AML) requirements where applicable
Responding to lawful court or regulatory orders

3.4 Consent (Art. 6(1)(a))

Marketing communications (opt-in; withdrawable at any time)
Non-essential cookies and analytics (see Section 5)

4. DAW-Specific Processing

4.1 Provenance Records

DAW provenance data (event chains, hash values, transfer history) is retained for the lifetime of the DAW in the WaL ledger, including after Exit Minting (read-only). This is necessary to maintain the integrity and auditability of the provenance system.

4.2 Royalty Processing

Transaction and royalty data is processed to calculate and distribute payments to creators, institutions, DAW holders, and partners. Data is retained for the duration required by tax and accounting law (typically 7 years).

4.3 Exit Minting

Upon Exit Minting, the DAW's provenance record is sealed and preserved in read-only form. Personal data linked to the DAW is retained only to the extent necessary for legal, audit, and dispute purposes.

4.4 WAC Administration

WAC-related data (rights grants, royalty splits, institutional terms) is processed and stored to administer the contractual framework governing each DAW.

4.5 Anchoring & Integrity

Cryptographic hashes and anchoring data (blockchain timestamps, C2PA manifests) are generated and stored to ensure the immutability and verifiability of DAW provenance records.

5. Cookies & Analytics

5.1 Essential Cookies

Session management, authentication tokens, CSRF protection. These are required for the platform to function and cannot be disabled.

5.2 Functional Cookies

User preferences, language settings, display options. These enhance the user experience but are not strictly necessary.

5.3 Analytics Cookies

Anonymous usage statistics to understand how the platform is used and to improve service quality. WaL uses privacy-respecting analytics tools and does not share analytics data with advertisers.

5.4 Consent Management

Where required by law, WaL will obtain consent before setting non-essential cookies. Users can manage cookie preferences at any time via the cookie settings panel.

6. Data Sharing & Subprocessors

6.1 Categories of Recipients

Payment service providers (PSPs) such as Stripe — for payment processing and royalty distribution
Cloud infrastructure providers — for hosting and data storage
Email and notification providers — for transactional communications
Print and device integration partners — to the extent necessary for DAW-R/DAW-S execution
Institutions — where WaL acts as data processor on behalf of an institutional data controller
Law enforcement and regulators — only where required by lawful orders

6.2 Safeguards

WaL selects subprocessors with appropriate technical and organizational security measures.
Data processing agreements (DPAs) are in place as required by GDPR.
Subprocessors process personal data only on WaL's documented instructions.
WaL does NOT sell personal data to advertisers or third parties.

7. International Transfers

7.1 Transfer Mechanisms

Personal data is primarily stored within the EU/EEA.
Where data is transferred outside the EU/EEA (e.g., to subprocessors), WaL ensures appropriate safeguards are in place:
Adequacy decisions by the European Commission
Standard Contractual Clauses (SCCs)
Other lawful transfer mechanisms under GDPR

8. Data Retention

8.1 Retention Periods

Account data: retained for the duration of the account and a reasonable period thereafter for legal compliance.
Transaction and royalty data: retained for the period required by tax and accounting law (typically 7 years).
Provenance and DAW-related data: retained for the lifetime of the DAW in the WaL ledger.
Telemetry data (DAW-S): retained for the period necessary to calculate royalties and enforce rights, then deleted or anonymized.
Marketing data: retained until consent is withdrawn or the user objects.
Where possible, WaL anonymizes or aggregates data for analytics.

9. Your Rights (GDPR)

9.1 Data Subject Rights

Right of access — obtain confirmation and a copy of your personal data
Right to rectification — correct inaccurate or incomplete data
Right to erasure — request deletion where no longer necessary or consent is withdrawn
Right to restriction — request limited processing in certain circumstances
Right to data portability — receive data in machine-readable format
Right to object — object to processing based on legitimate interests or direct marketing
Right to withdraw consent — withdraw consent at any time (without affecting past lawful processing)

9.2 How to Exercise

Submit requests to: privacy@warrantartlab.com
WaL will respond within 30 days. Complex requests may require an extension of up to 60 additional days, with notice.

10. Supervisory Authority

10.1 Finnish Data Protection Ombudsman

Users have the right to lodge a complaint with their local supervisory authority.
In Finland: Tietosuojavaltuutetun toimisto (Office of the Data Protection Ombudsman)
Address: Lintulahdenkuja 4, 00530 Helsinki, Finland
Website: tietosuoja.fi

11. Data Security

11.1 Technical Measures

Encryption in transit (TLS) and at rest where feasible
Access controls and role-based permissions
Regular security audits and vulnerability scanning
Logging and monitoring of system events
Restricted access to production data on a need-to-know basis
Password hashing with industry-standard algorithms
Payment card data handled exclusively by Stripe (never stored by WaL)

11.2 Breach Notification

In the event of a personal data breach likely to result in high risk to data subjects, WaL will notify affected users and the supervisory authority as required by GDPR.

12. Children

12.1 Age Restrictions

The WaL platform is not intended for users under 16 years of age.
WaL does not knowingly collect personal data from children under 16.
If we discover that data has been collected from a user who does not meet the minimum age requirement, we will delete it promptly.

13. Changes to This Policy

13.1 Updates

WaL may update this Privacy Policy to reflect changes in applicable law, platform features, or data processing practices.
Material changes will be communicated to registered users via email or platform notification at least 30 days before they take effect.
The current version is always available at warrantartlab.com/privacy-policy.

See also: Terms of Service · Consumer Rights

By using Warrant Art Labs, you acknowledge that you have read and understood this Privacy Policy.

Shopping Cart

Your cart is empty

Privacy Policy

1. Data Controller

1.1 Identity

1.2 Scope

1.3 Applicable Law

2. Data We Collect

2.1 Account Data

2.2 Transaction Data

2.3 DAW Provenance Data

2.4 DAW-S Telemetry Data

2.5 Support Data

2.6 Partner Data

2.7 Technical Data

3. Purposes & Legal Bases

3.1 Contract Performance (Art. 6(1)(b))

3.2 Legitimate Interests (Art. 6(1)(f))

3.3 Legal Obligations (Art. 6(1)(c))

3.4 Consent (Art. 6(1)(a))

4. DAW-Specific Processing

4.1 Provenance Records

4.2 Royalty Processing

4.3 Exit Minting

4.4 WAC Administration

4.5 Anchoring & Integrity

5. Cookies & Analytics

5.1 Essential Cookies

5.2 Functional Cookies

5.3 Analytics Cookies

5.4 Consent Management

6. Data Sharing & Subprocessors

6.1 Categories of Recipients

6.2 Safeguards

7. International Transfers

7.1 Transfer Mechanisms

8. Data Retention

8.1 Retention Periods

9. Your Rights (GDPR)

9.1 Data Subject Rights

9.2 How to Exercise

10. Supervisory Authority

10.1 Finnish Data Protection Ombudsman

11. Data Security

11.1 Technical Measures

11.2 Breach Notification

12. Children

12.1 Age Restrictions

13. Changes to This Policy

13.1 Updates

Privacy Policy

1. Data Controller

1.1 Identity

1.2 Scope

1.3 Applicable Law

2. Data We Collect

2.1 Account Data

2.2 Transaction Data

2.3 DAW Provenance Data

2.4 DAW-S Telemetry Data

2.5 Support Data

2.6 Partner Data

2.7 Technical Data

3. Purposes & Legal Bases

3.1 Contract Performance (Art. 6(1)(b))

3.2 Legitimate Interests (Art. 6(1)(f))

3.3 Legal Obligations (Art. 6(1)(c))

3.4 Consent (Art. 6(1)(a))

4. DAW-Specific Processing

4.1 Provenance Records

4.2 Royalty Processing

4.3 Exit Minting

4.4 WAC Administration

4.5 Anchoring & Integrity

5. Cookies & Analytics

5.1 Essential Cookies

5.2 Functional Cookies

5.3 Analytics Cookies

5.4 Consent Management

6. Data Sharing & Subprocessors