This policy explains what personal data Vestige Awards collects, why, who we share it with, how long we keep it and how you can exercise your rights. It applies to the website vestigeawards.com, to the platform app.vestigeawards.com and to the emails we send.
1. Who is responsible
Vestige Awards is organised and run by WAW ART, a company being incorporated in Brazil, represented by Juan Carlo Jacques de Araujo. WAW ART is responsible for processing your data: it is the controller under Brazil’s General Data Protection Law (LGPD) and under the GDPR. Once the company’s registration is complete, this policy will state its registered name and Brazilian company number (CNPJ).
Privacy contact, which is also the contact for our data protection officer (encarregado): contato@vestigeawards.com, with the subject “Privacy”.
2. What data we collect and why
We collect only what each step needs. The table shows the data, the purpose and the legal basis for each situation; the bases are the same under the LGPD and the GDPR.
| Situation | Data | Purpose | Legal basis |
|---|---|---|---|
| Waitlist | Name, email, country, division, language and sign-up source; date, time and IP address of your consent | Tell you when entries open, apply the waitlist credit and, if you agree, send news | Consent |
| Account | Email, password (stored in irreversible form that not even we can read), artist name, language, country and division | Give you access to the artist area and apply your country’s price table | Performance of a contract |
| Sign in with Google | Name, email and photo from your Google account | Create or open your account without a password | Performance of a contract |
| Profile, optional | Biography, website and Instagram | Present the author on the public pages of nominated and awarded works | Performance of a contract |
| Entries | Images, titles, descriptions and categories; proof of enrolment, when requested | Judge, show and award the works, under the rules | Performance of a contract |
| Payments | Amounts, currency, coupons, credits and transaction identifiers | Charge the entry fee, issue the receipt and meet tax obligations | Performance of a contract and legal obligation |
| Cash prize | The winner’s bank and tax details | Pay the prize and withhold taxes when the law requires | Performance of a contract and legal obligation |
| Public vote | Email, language, the date of each vote and irreversible versions (hashes) of the IP address and browser | Ensure one vote per person and stop fraud | Performance of a contract and legitimate interest |
| Account access | IP address, date and time of each sign-in | Comply with Brazil’s Internet Civil Framework (Marco Civil da Internet) and protect accounts | Legal obligation |
| Contact | Your email and whatever you write | Reply to you | Legitimate interest |
Card and Pix details are entered on Stripe’s own pages: Vestige Awards never receives or stores them.
The original file of each image is kept exactly as you sent it, with whatever metadata it carries, such as date, camera and, if your device records it, location. That metadata is never shown to the jury or the public: the versions on display are generated without it.
On the waitlist form, Cloudflare checks browser signals and your IP address to stop bots.
3. What becomes public
Until nominees are announced, nothing about your entry is public, and the jury judges the works without knowing who made them. From the announcement on, your artist name, country, images, title, description, category and result become public on the work pages, in the gallery and in the author directory. Your biography, website and Instagram also appear, if you have filled them in.
Never public: email, documents, payment data and access data. For jurors, we publish name, institution, country and biography when the jury is announced.
4. Who we share data with
We do not sell personal data, and sponsors and partners do not receive your data. We share it only with the providers that run the platform, each limited to its own service:
| Provider | Service | Where the data is held |
|---|---|---|
| Supabase | Database, accounts and image files | São Paulo, Brazil |
| Vercel | Hosting of the website and the platform | Brazil, United States and global network |
| Cloudflare | Domain, bot protection and forwarding of the contact email | United States and global network |
| Resend | Account, entry and results emails | United States |
| Brevo | Waitlist, email confirmation and newsletter | France, European Union |
| Stripe | Card and Pix payments | Brazil and United States |
| Sign in with Google and the inbox of the contact email | United States and global network |
We may also disclose data to authorities when the law or a court order requires it, and use it to defend the rights of Vestige Awards in legal proceedings.
5. International transfers
Some providers are outside Brazil. For these transfers we follow the LGPD, with contractual clauses that ensure protection equivalent to Brazil’s. For people in the European Union or the United Kingdom, the GDPR safeguards apply, such as the standard contractual clauses approved by the European Commission.
6. How long we keep data
| Data | Period |
|---|---|
| Account and profile | While the account exists. Once you ask for deletion, we delete or anonymise it within 30 days, except what the law requires us to keep |
| Waitlist | Until you leave the list or withdraw consent |
| Works not nominated | Original deleted 12 months after the winners are announced. The screen version stays while the licence in the rules is in force, five years from the close of entries, unless you ask for removal |
| Nominated and awarded works | Indefinitely, in the award’s historical archive, under the rules |
| Payments and receipts | Five years, as tax law requires |
| Votes | Emails and individual records deleted 12 months after the announcement; only each work’s vote total remains |
| Access records | Six months, as the Marco Civil da Internet requires (art. 15) |
| Record of consents | For as long as it may be needed to prove consent |
| Record of emails sent | Two years |
When an account is deleted, the artist name and the works of nominees and winners remain in the award’s historical archive, as the licence in the rules provides.
7. Your rights
You may, at any time:
- confirm whether we process your data and access it;
- correct incomplete or outdated data, including directly in your profile;
- ask for anonymisation, blocking or deletion of data that is unnecessary or processed unlawfully;
- ask for the portability of your data;
- ask for deletion of data processed on the basis of your consent, and withdraw that consent;
- know who we share your data with;
- object to processing based on legitimate interest;
- complain to Brazil’s National Data Protection Authority (ANPD) or, if you are in the European Union or the United Kingdom, to the data protection authority of your country.
To exercise any right, write to contato@vestigeawards.com with the subject “Privacy”. We may ask you to confirm your identity first. We reply within 15 days.
8. Cookies
We use only the cookies the platform needs to work. We do not use audience measurement or advertising cookies, so there is no consent banner.
| Cookie | Purpose | Duration |
|---|---|---|
| Account session (sb-…) | Keep you signed in | Until you sign out |
| vestige-lang | Remember your language | One year |
| vestige-voter | Remember that your voting email was confirmed | 45 days |
Two third-party services may use their own cookies and browser signals: Cloudflare’s bot protection, on the waitlist form, and the “Continue with Google” button, on the sign-in pages. If we ever adopt measurement tools, we will ask for your consent first.
9. Security
All traffic is encrypted (HTTPS). Passwords are stored in irreversible form, and original files are kept in private storage. Staff access is limited by each person’s role, and every change to an entry’s status is recorded, with author and date. For votes, the IP address and browser are stored only in irreversible form (hashes).
If a security incident puts you at risk, we notify the ANPD and the people affected within the deadlines set by law.
10. Automated decisions
No decision that affects you is made by a machine alone. The platform flags repeated images and suspicious votes, but the team or the jury always decides. The bot check may block a submission; if that happens, try again or write to us.
11. Minors
Vestige Awards is for people aged 18 or over: only they may create an account, enter works and vote. If we learn that we have received data from someone under 18, we delete it.
12. Emails
Emails about your account, entries, payments and results are part of the service. News and the newsletter are sent only with your consent, which you can withdraw through the link in every newsletter or in your profile.
13. Changes to this policy
When the policy changes, we publish the new version on this page, with its date. If the change is significant, we tell you by email before it takes effect.
14. Languages
This policy is published in Portuguese, English and Spanish. In case of any discrepancy, the Portuguese version prevails.