H

Privacy

Last updated 2 November 2026. Deutsche Fassung.

This page says what harm.work records about you, why, who else receives it, and what you can ask for.

1. Who is responsible

Harm van den Dorpel
Finnländische Strasse 14
10439 Berlin, Germany
Email: send [at] harm [dot] email

2. In short

  • Every page view is recorded with your IP address, approximate location, device and browser, and how long the page was open. The site uses no advertising and no outside analytics service.
  • Your approximate location, the country and state or province, is looked up from your IP address in a database on the site's own server; the address is not sent anywhere for this. The country also sets whether sizes are shown in centimetres or inches and the currency of prices.
  • If you write to the studio, subscribe to the newsletter, or have a private page as a collector or gallery, more is recorded, as described below.
  • Collectors and galleries who are logged in are recorded by name. The studio receives an email about each of their visits, and a summary of a collector's visit may also go to the gallery they work with.

3. Hosting

The site runs on a server rented from a hosting provider. Its web server may keep standard access logs (IP address, time, requested address, referring page, browser) for running the site and keeping it secure.

4. The visit log

For every page you view, the site stores the time, the page address, the page you came from, your IP address, the language your browser asks for, your device type, browser and operating system, whether your device is set to light or dark mode, how long the page was visible, and your approximate location (country and state or province) derived from your IP address. Entries from before 2 November 2026 may also name a city. Visits by the artist are not recorded. If you are logged in as a collector or gallery, the visit is recorded under that name (section 9).

Purpose: to see how the site is used and to find broken links. Legal basis: Art. 6(1)(f) GDPR (legitimate interest). There is no automatic deletion yet: entries are kept until the studio deletes them.

5. Location lookup

The site looks up the country and state or province of your IP address in a database on its own server, DB-IP's IP to City Lite (IP geolocation by DB-IP, CC BY 4.0). Your IP address is not sent to anyone for this, and the city is not kept. This happens for the visit log, to choose centimetres or inches and a currency for prices, and when you send an inquiry, a message or a search, ask for access to a private page, download a file, or use a private link. Legal basis: Art. 6(1)(f) GDPR.

6. Cookies and storage in your browser

  • measurement-system remembers centimetres or inches until you close the browser.
  • connect.sid is set only when you log in (the studio, collectors and galleries). It keeps you logged in until you log out, for at most ten years.
  • exhibition_links remembers links to private exhibitions opened in this browser, for up to one year.
  • In local storage: the currency you chose for prices, and, once you use an inquiry form, your name and email address (to fill in the form next time) and a random identifier sent along with inquiries.

The site sets no advertising or tracking cookies of its own. Embedded videos may set cookies of their own (section 10).

7. Inquiries, messages, searches and downloads

When you send an inquiry about a work or token, or a message through the contact form, the studio receives your email address, your name and message if you give them, the work you asked about, and the details listed in section 4 (IP address, approximate location, device, browser, language). You receive a confirmation by email. Inquiries about works and tokens are stored with these details; the message itself is only emailed. Purpose: to answer you and to prepare a sale. Legal basis: Art. 6(1)(b) GDPR. Inquiries are kept until the studio deletes them.

Words you type into the site's search are stored with the time, your IP address and approximate location, to improve the site. When you download a file from a work page, the studio receives an email with the file name, your IP address, approximate location, language and browser, and your name if you are logged in as a collector or gallery. Legal basis: Art. 6(1)(f) GDPR.

8. Newsletter

To subscribe you give your email address; a name is optional. You first receive an email asking you to confirm, and only then are you subscribed. Ticking “add me to the mailing list” on an inquiry form works the same way. The site records when you confirmed, whether you unsubscribed, and which mailing you last received. Every newsletter has an unsubscribe link. When you unsubscribe, your address stays on record, marked as unsubscribed, so it is not mailed again. Legal basis: your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time.

Newsletters and all other emails from this site are sent through Resend (Resend, Inc., USA).

9. Collectors and galleries

The studio keeps records of the collectors and galleries it works with: name, contact details (email address, city, country, website, X account), wallet addresses, the works and tokens they own or are offered, and which gallery is a collector's contact. A gallery can add the collectors it introduces (name and email address). Collectors and galleries can receive a personal link to a private page.

While you are logged in with such a link, every page you open is recorded under your name, as described in section 4. A visit begins with your first page and ends after 30 minutes without activity. When a visit begins, the studio receives an email with the time, your approximate location, device and browser. When it ends, an email summary lists the pages you opened, how long each was visible, your approximate location, device and browser, and the site you came from. For a collector, this summary goes to the gallery that introduced them or, for the studio's own collectors, to a gallery that has shared an exhibition with them, and the studio receives a copy. For a gallery, it goes to the studio. The studio is also told when a private link logs a browser out of another account.

Galleries the studio marks as trusted can open every collector's private page and see which collector owns a work. Other galleries see only the collectors they introduced.

The studio's list of collectors is kept in a private Google Sheets spreadsheet in the artist's Google account. A gallery's list of works can be exported to a Google spreadsheet shared with that gallery. The provider is Google (Google Ireland Limited and Google LLC, USA).

Purpose: to look after the relationships with collectors and galleries and to sell works. Legal basis: Art. 6(1)(b) and (f) GDPR. You can object to the recording of your visits at any time (section 14).

10. Embedded and outside content

Some work pages show videos from Vimeo (Vimeo.com, Inc., USA) or YouTube (Google Ireland Limited). When such a page loads, your browser connects to that service, which receives your IP address and may set cookies, even if you don't play the video. Some artworks are loaded directly from other servers, such as IPFS and Arweave gateways or the artist's other websites, which then receive your IP address. Some images are delivered by Cloudinary. Links to other sites, such as Etherscan or marketplaces, send nothing until you follow them. Legal basis: Art. 6(1)(f) GDPR.

11. Wallets and the blockchain

Only on a token's purchase page can the site connect to your crypto wallet. Connecting uses WalletConnect (Reown) and reads the Ethereum blockchain through Infura (Consensys). Who owns a token is public on the blockchain: the site shows each token's owner by wallet address or ENS name, and lists a wallet's tokens on a page of its own.

12. Who else receives data

Besides the studio: the hosting provider, Resend (email), Google (spreadsheets and YouTube), Vimeo, Cloudinary, WalletConnect and Infura, IPFS and Arweave gateways, and galleries as described in section 9. Some of them are based outside the EU, in particular in the USA.

13. How long data is kept

  • The visit log, searches and inquiries: until the studio deletes them; there is no automatic deletion yet.
  • Newsletter: while you are subscribed; after that your address stays marked as unsubscribed.
  • Login sessions: until you log out, at most ten years.
  • Records of collectors and galleries: while the relationship lasts, and sales records for as long as tax law requires.

14. Your rights

You can ask what data the studio holds about you (Art. 15 GDPR), and have it corrected (Art. 16), deleted (Art. 17) or restricted (Art. 18). You can receive it in a portable form (Art. 20), and object to processing based on legitimate interest, such as the visit log and the visit summaries (Art. 21). You can withdraw consent at any time. Write to the address in section 1.

You can also complain to a data protection authority. For the studio this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.

No decisions about you are made automatically.