Privacy Policy – Enigma TattooIn accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), we inform you that:
1. Data ControllerThe controller of your personal data is the company KHARYTONOV IVAN ENIGMA TATTOO, NIP: 8862989622, with its registered office at ul. Witebska 4 m. 56, 03-507 Warsaw (the studio operates at the following address: ul. Naruszewicza 10 lok. 4, 02-627 Warsaw), e-mail:
enigma.studiotatuazu@gmail.com, phone: +48 789 790 390.
2. Purposes and Legal Bases of Data ProcessingWe process your personal data for the following purposes:
- Handling appointment bookings and client contact – legal basis: Article 6(1)(b) GDPR (processing necessary for the performance of a contract or to take steps at your request prior to entering into a contract).
- Maintaining procedure documentation – e.g., consent to the tattoo procedure, tattoo history, health-related contraindications – legal basis: Article 6(1)(c) GDPR (legal obligation) and Article 9(2)(a) GDPR (explicit consent to the processing of health data).
- Marketing and promotion of studio services (e.g., sending information about promotions, new offerings) – legal basis: Article 6(1)(a) GDPR (consent).
- Securing potential claims (e.g., in the event of a complaint about the tattoo) – legal basis: Article 6(1)(f) GDPR (legitimate interest of the controller).
3. Scope of Data ProcessedDepending on the purpose, we process the following data:
- Contact data: first name, last name, phone number, e-mail – for the purpose of booking an appointment.
- Health-related data: e.g., allergies, skin conditions, contraindications to tattooing – only with your consent.
- Procedure consent: signed consent to the tattoo procedure.
- Likeness/image: photos of tattoos may be published on our social media only with your consent.
4. Data RecipientsYour data may be shared with:
- Entities supporting us in IT services and appointment booking systems.
- Service providers handling electronic payments (if applicable).
- Legal entities in the event that claims need to be pursued.
5. Data Retention Period- Contact data (first name, last name, phone number, e-mail) — until the service is completed, and in the case of an ongoing relationship with the Client (e.g., subsequent visits) — until the end of the cooperation or withdrawal of consent.
- Health-related data (allergies, skin conditions, contraindications to tattooing) and consent to perform the tattoo — retained for 3 years, counted from the day the procedure is performed (or, in the case of multi-session tattoos, from the day the last session is completed), in order to secure any potential claims related to the service performed.
- Billing data (payment confirmations) — retained for the period required by tax law, i.e., 5 years, counted from the end of the calendar year in which the tax obligation arose.
- Likeness/image (photos/videos of the tattoo published on social media) — until the Client withdraws consent.
- Marketing data — until consent is withdrawn.
6. Your RightsYou have the right to:
- Access your data.
- Rectify your data.
- Erasure of your data ("the right to be forgotten").
- Restriction of processing.
- Data portability.
- Withdraw consent at any time (without affecting the lawfulness of processing carried out before its withdrawal).
- Object to processing.
To exercise your rights, please contact us at:
enigma.studiotatuazu@gmail.com.
7. Right to Lodge a ComplaintIf you believe that your data is being processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (UODO).
8. Voluntary Provision of DataProviding your data is voluntary, but necessary for booking an appointment and performing the tattoo.
9. Profiling and Automated Decision-Making- We do not use automated decision-making or profiling of your data.