Privacy Policy – Enigma PiercingIn accordance with Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR), we inform you that:
1. Data ControllerThe controller of your personal data is the company KHARYTONOV IVAN ENIGMA TATTOO, NIP: 8862989622, with its registered office at ul. Witebska 4 m. 56, 03-507 Warsaw (the studio operates at the following address: ul. Naruszewicza 10 lok. 4, 02-627 Warsaw), e-mail:
enigma.studiotatuazu@gmail.com, phone: +48 789 790 390.
2. Purposes and Legal Bases of Data ProcessingWe process your personal data for the following purposes:
- Handling appointment bookings and client contact – legal basis: Article 6(1)(b) GDPR (processing necessary for the performance of a contract or to take steps at your request prior to entering into a contract).
- Maintaining procedure documentation – e.g., consent to the piercing procedure, procedure history, health-related contraindications – legal basis: Article 6(1)(c) GDPR (legal obligation) and Article 9(2)(a) GDPR (explicit consent to the processing of health data).
- Marketing and promotion of studio services (e.g., sending information about promotions, new offerings) – legal basis: Article 6(1)(a) GDPR (consent).
- Securing potential claims (e.g., in the event of a complaint about the procedure) – legal basis: Article 6(1)(f) GDPR (legitimate interest of the controller).
3. Scope of Data ProcessedDepending on the purpose, we process the following data:
- Contact data: first name, last name, phone number, e-mail – for the purpose of booking an appointment.
- Health-related data: e.g., allergies, skin conditions, contraindications to the procedure – only with your consent.
- Procedure consent: signed consent to the piercing procedure.
- Likeness/image: photos of piercings may be published on our social media only with your consent.
4. Data RecipientsYour data may be shared with:
- Entities supporting us in IT services and appointment booking systems.
- Service providers handling electronic payments (if applicable).
- Legal entities in the event that claims need to be pursued.
5. Data Retention Period- Contact data — until the service is completed or until consent is withdrawn.
- Data relating to consent to the piercing procedure — retained for 3 years in case of complaints or legal claims.
- Billing data (payment confirmations) — retained for the period required by tax law, i.e., 5 years, counted from the end of the calendar year in which the tax obligation arose.
- Likeness/image — until consent is withdrawn.
- Marketing data — until consent is withdrawn.
6. Your RightsYou have the right to:
- Access your data.
- Rectify your data.
- Erasure of your data ("the right to be forgotten").
- Restriction of processing.
- Data portability.
- Withdraw consent at any time (without affecting the lawfulness of processing carried out before its withdrawal).
- Object to processing.
To exercise your rights, please contact us at:
enigma.studiotatuazu@gmail.com.
7. Right to Lodge a ComplaintIf you believe that your data is being processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (UODO).
8. Voluntary Provision of DataProviding your data is voluntary, but necessary for booking an appointment and performing the piercing procedure.
9. Profiling and Automated Decision-Making- We do not use automated decision-making or profiling of your data.