Data Protection

GDPR Compliance Overview

Inkwell Studios, operated by Yeema Holdings LTD, is committed to ensuring that your personal data is protected in accordance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

This Data Protection notice provides detailed information about how we implement GDPR principles throughout our commission platform at cportal.inkwell.dev.

Data Controller Information

For the purposes of GDPR, Inkwell Studios (Yeema Holdings LTD) acts as the data controller for personal information collected through our platform. As a data controller, we determine the purposes and means of processing your personal data.

If you have any questions about our data protection practices, please contact our Data Protection Officer at: dpo@inkwell.dev

Lawful Basis for Processing

We process your personal data on the following lawful bases as defined by GDPR:

• Contractual Necessity: Processing necessary for the performance of a contract to which you are a party (commissioning artwork)
• Legitimate Interests: Processing necessary for our legitimate interests, such as preventing fraud and ensuring network security
• Legal Obligation: Processing necessary for compliance with legal obligations, such as tax and financial record-keeping
• Consent: Processing based on your specific, informed, and unambiguous consent

Data Subject Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right to Information: You have the right to know how we process your data
• Right of Access: You can request copies of your personal data that we process
• Right to Rectification: You can request that we correct inaccurate or incomplete data
• Right to Erasure: You can request deletion of your personal data in specific circumstances
• Right to Restrict Processing: You can request that we limit how we use your data
• Right to Data Portability: You can request transfer of your data to you or another controller
• Right to Object: You can object to certain types of processing, including direct marketing
• Rights Related to Automated Decision Making: You have rights regarding automated decision-making and profiling

How to Exercise Your Rights

To exercise any of your data subject rights:

• Email us at privacy@inkwell.dev
• Use the "Request My Data" or "Delete My Account" functions in your account settings
• Contact our Data Protection Officer directly at dpo@inkwell.dev

We will respond to all legitimate requests within one calendar month. Occasionally, it may take us longer if your request is particularly complex or you have made multiple requests. In this case, we will notify you and keep you updated.

Data Protection Measures

We have implemented appropriate technical and organizational measures to ensure a level of security appropriate to the risk, including:

• Encryption of personal data during transmission and at rest
• Regular testing and evaluation of security measures
• Ability to restore availability and access to personal data in the event of a technical incident
• Restricted access to personal data on a need-to-know basis
• Regular staff training on data protection and security

International Data Transfers

We may transfer your personal data to countries outside the European Economic Area (EEA) for processing. When we do, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission, to protect your personal data in accordance with GDPR requirements.

Data Protection Impact Assessments

For processing operations that may result in a high risk to the rights and freedoms of natural persons, we conduct Data Protection Impact Assessments (DPIAs) in accordance with GDPR Article 35. These assessments help us identify and minimize data protection risks in our operations.

Data Breach Procedures

In the unlikely event of a personal data breach, we have procedures in place to detect, report, and investigate the breach. Where legally required, we will notify the relevant supervisory authority and affected data subjects without undue delay, as specified in our internal breach notification procedures.

Data Protection Officer

Our Data Protection Officer can be contacted at: dpo@inkwell.dev