Privacy Policy
Who we are
bāstān is an independent heritage and design platform based in Amsterdam, the Netherlands. We are the data controller for the information described below. To reach us, use the contact form at bastan.world/contact.
What we collect
Open call submissions: your name, email address, credit details (Instagram or website), the photographs you upload, and the information you send with them (craft name, location).
Contact form: your name, email address, and your message.
Meet a creator requests: your name, email address, country, and the details of your request, including the creator or craft you’d like to reach.
Creators listed in the Atlas: name, location, craft, practice details and images, shared with their consent.
Website visits: standard analytics data and cookies.
Why we collect it
To administer open calls and review submissions; to credit your work in the Craft & Creators Atlas; to introduce you to the creators you ask to reach; to respond to your enquiries; and to understand how our website is used.
Legal basis
We process your data on the basis of your consent (when you submit to an open call, ask us to introduce you to a creator, or agree to be listed in the Atlas), and on our legitimate interest in operating bāstān, maintaining the Atlas, and responding to enquiries. Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect processing that took place before it.
Who we share it with
We do not sell your data or share it for marketing. When you ask us to introduce you to a creator, we share your name, email address and request with that creator. Otherwise, your data is handled only by trusted service providers that host our website, forms, map and images, under data protection agreements.
How long we keep it
Submission data and photographs are kept for as long as your work remains in the Atlas, or until you ask us to delete them. Enquiries are kept for up to two years. Analytics data is kept for as long as needed to understand how the site is used.
Transfers outside the EEA
Some of our providers are based outside the European Economic Area, including in the United States. Where this is the case, we rely on the safeguards they have in place, including the EU–U.S. Data Privacy Framework and Standard Contractual Clauses.
Security
We take appropriate measures to protect personal data against loss, misuse, unauthorised access, and unwanted disclosure. However, no transmission over the internet can be guaranteed to be entirely secure, and we cannot accept responsibility for information sent to us over unsecured networks.
Your rights
Under the GDPR you have the right to access the data we hold about you, to have it corrected or deleted, to restrict or object to how we use it, and to receive a copy of it. You may withdraw consent at any time, and you may lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). To exercise any of these rights, use our contact form.
Cookies
Our website is built on Squarespace, which uses cookies to run the site and to understand how it is used. Non-essential cookies are placed only with your consent, which you can give, refuse, or change at any time through our cookie banner.
Changes
We may update this policy. The current version is always published here, with the date it was last updated.
Last updated: 11 October 2026.