Privacy policy

1. Who is responsible

ROKH is operated by Seyed Hamidreza Edalatnia, a sole proprietor in Hamburg, Germany. He is the controller responsible for personal data on this website. Write to together@rokh.world with any privacy question or request.

2. In short

We collect only what we need to run this website, review artist applications and answer enquiries. rokh.world uses no cookies, no analytics, no advertising and no tracking. Fonts, images and videos are served from this website, not from other services. We never sell personal data or use it for marketing.

3. Hosting and server logs

The website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. Pages are delivered through Vercel’s network and the form services run in Frankfurt am Main, but processing in the USA cannot be ruled out.

When you open a page, Vercel automatically processes technical data: your IP address, the date and time, the page requested, your browser and operating system, and the page you came from. This is needed to deliver the website and keep it secure (Art. 6(1)(f) GDPR). These logs are deleted or anonymised after no more than 30 days, unless they are needed to investigate a specific security incident.

A data processing agreement under Art. 28 GDPR is in place with Vercel. Transfers to the USA rely on the EU-U.S. Data Privacy Framework and the European Commission’s Standard Contractual Clauses.

4. Artist applications

• What we collect: your public artist name or your choice to appear anonymously; your email address; an optional portfolio link; your stories (titles, descriptions and optional project links); your original image and video files with their file names, sizes, checksums and technical metadata; your answers about your work; and a record of the permissions you accepted, with their exact wording and the time of submission. To prevent abuse we also process your IP address as a keyed hash; it is not stored in readable form.
• Why: to review your application, to contact you privately by email about it and, if your work is selected, to publish it under the permission you gave and to keep proof of that permission.
• Legal basis: steps you ask for before an agreement, and the publication permission itself (Art. 6(1)(b) GDPR); preventing abuse and keeping proof of the permission (Art. 6(1)(f)); and, for anything in your work or answers that may reveal your political opinions, religious or philosophical beliefs or ethnic origin, your explicit consent (Art. 9(2)(a)). You can withdraw that consent by email at any time. Withdrawal does not affect processing already carried out. If your work has not been published, we stop the review and delete the application; if it has, the withdrawal terms of the publication permission apply.
• Where it is stored: in ROKH’s private Google Workspace account (Google Drive), which only ROKH can access. A notification with private links, not the files themselves, is sent to together@rokh.world. Google Workspace is provided by Google Cloud EMEA Limited, Dublin, Ireland, as our processor under a data processing agreement. Google may process data in the USA, under the EU-U.S. Data Privacy Framework and Standard Contractual Clauses.
• Who sees it: only the people reviewing applications for ROKH. Your email address and private answers are never published. Your work and your chosen public credit are published only if your work is selected, and only as the permission describes.
• How long: uploads that are never submitted are moved to the trash after 24 hours and permanently deleted within 30 days. Applications that are not selected are deleted 12 months after submission. For selected work we keep the application for as long as the work is used under your permission, and the record of the permission and its wording for three years after that use ends, to answer possible legal claims. Your public credit stays in ROKH’s record of contributions; you can ask at any time for it to be changed to “Anonymous artist”.
• Age: you must be 18 or older to apply.

5. Applying through Google Forms

If you apply through our Google Form, Google processes your answers and files in ROKH’s Google account. Uploading files there requires signing in with a Google account, and Google then records your account name, email address and profile photo with your answers. Google’s own privacy policy applies to your Google account. Everything else in section 4 applies in the same way.

6. Partner enquiries and email

When you send the collaboration form or write to us, we receive your name, email address, organisation and website (if given) and your message. The form delivers it as an email to together@rokh.world through Google Workspace. We use it only to reply to you (Art. 6(1)(b) GDPR for a possible collaboration, otherwise Art. 6(1)(f)). To prevent abuse, the form briefly keeps keyed hashes of your IP address and email address. We delete enquiries once the conversation is finished, unless the law requires us to keep them, for example business correspondence under German tax law.

7. Links to other services

Links to the App Store, Google Play, Instagram, YouTube, X and henia.studio are plain links. No data is sent to those services until you open them; their own privacy policies then apply.

8. Security

Every connection to this website is encrypted (HTTPS). Files are stored privately, and our server signs every request to the storage service. No transmission over the internet is completely secure, however. Encryption protects what you send, but your internet provider, or authorities in your country, may still be able to see that you visited rokh.world. If that is a risk for you, take care how you connect.

9. No automated decisions

Applications are reviewed by people. We do not use automated decision-making or profiling. We do not use submitted artworks to train AI models.

10. Your rights

You have the right to know what data we hold about you (Art. 15 GDPR), to have it corrected (Art. 16), to have it erased (Art. 17), to restrict its processing (Art. 18), to receive it in a portable format (Art. 20), to object to processing based on legitimate interests (Art. 21), and to withdraw consent with effect for the future (Art. 7(3)). Write to together@rokh.world for any of these.

You can also complain to any data protection authority. The authority responsible for us is:

11. Do you have to provide data?

There is no legal or contractual obligation to provide personal data. Without an email address, your files and your acceptance of the permissions, we cannot review an application.

12. Changes

We update this policy whenever our processing changes. The version on this page, with the date above, applies.