Privacy notice

How the talent pool uses your information

This notice is written for people who create a profile in the HdM Gallery Talent Pool. It sits alongside any wider gallery privacy policy and is meant to be specific about this system.

Who we are

HdM Gallery is a contemporary art gallery with spaces in London, Paris and Shanghai. This pool is operated for HdM’s own hiring of freelancers and short-term collaborators. It is not shared with other galleries or sold.

What we store

• Your name, email address, password (stored as a salted PBKDF2 hash, never in plain text), and session tokens (also hashed).
• Profile details you provide: phone, city and country, photo, short biography, languages, skills, kinds of work, availability, day rate and currency, freelance status, right to work in France and/or the UK, driving licence, education, CV, and links to a portfolio, LinkedIn or Instagram.
• GDPR consent time, email confirmation time, and when the profile was last updated.
• Files you upload (photo and CV), stored privately. They are never published on a public URL.
• If you were invited, the invite record (name, email, optional CV, and whether the invite was opened or accepted).
• Internal notes, tags, a 1–5 rating, and past HdM project records written by HdM staff. These are never shown on your profile.
• A short mail outbox (confirmation, reset, invite and reminder messages) so we can see what was sent.

Why we hold it

So HdM can find people for events, installs, art fairs and short projects, and so you can keep your own details current. Legal bases: your consent (the checkbox when you create an account) and HdM’s legitimate interest in contacting people who have asked to be considered for work.

How long we keep it

Profiles stay while the account is active. If a profile is not updated for thirteen months it is marked archived and is no longer used for matching. We send a reminder around the twelve-month mark. You can delete the account yourself at any time. After deletion, the profile, files and admin notes for that person are removed permanently.

Who can see it

You can see and edit your own profile (not HdM’s private notes, tags or rating). HdM administrators can see full profiles, including day rate and files, in order to staff projects. Other people in the pool cannot see you.

Your rights

You can download a JSON copy of the data we hold on the Account page, correct it by editing your profile, or delete the account after confirmation. You may also write to HdM to withdraw consent or raise a complaint with a supervisory authority (in France, the CNIL; in the UK, the ICO).

Cookies

We use one essential session cookie (HttpOnly, SameSite=Lax, Secure on HTTPS) so you stay signed in, and a short-lived flash cookie for form messages. There are no analytics or advertising cookies.