Privacy and cookie policy

Data controller

The person responsible for what happens to your data is Óscar Amengual Ripoll, a sole trader working under the trading name Venom Tattoo.

• Tax ID (NIF): 23059768Z
• Registered address: C/ Conciliación 22 BJ, 30390 La Aljorra, Cartagena (Murcia)
• Studio: C. del Submarino, 32a, 30300 Cartagena, Spain
• Email for anything to do with your data: venomtattooficial@gmail.com

The owner's full identification details are in the legal notice.

What we collect and where it comes from

Almost everything we know about you is what you tell us. The contact form asks for your name, your phone number (the one you use on WhatsApp), the body area, a rough size, a link to references if you have one, and a description of your idea.

On a computer, the form is sent to our own API, hosted on the studio's server, which turns it into an email to the studio mailbox and stores nothing from the request. On a phone, the same form opens the WhatsApp app with the message already written: you send it yourself, from your own phone, and nothing goes through the website.

You can also call us, email us or message us on Instagram. In those cases we handle whatever you choose to tell us.

Beyond that there's technical data. For security, the server logs the IP address, the browser, the date and the pages visited. And to stop the form being sent over and over, it stores a salted hash of your phone number and of your IP address, with an expiry date. A hash is a one-way fingerprint: there's no way back from it to the phone number or the IP.

One thing we do ask: don't include health data or other sensitive information in the form or in your messages. Allergies, medication, pregnancy or anything else that affects the session is discussed at the studio, in person, and recorded in the consent form you sign before we tattoo you.

What we use it for, and on what legal basis

• Answering your request and arranging the appointment. Legal basis: pre-contractual measures taken at your request (article 6.1.b GDPR). Without this data we can't reply.
• Preventing abuse of the form and keeping the site secure. Legal basis: our legitimate interest in keeping the mailbox and the server from being flooded with automated or repeated submissions (article 6.1.f GDPR).
• Meeting legal obligations where they apply, such as issuing an invoice or answering an official request (article 6.1.c GDPR).

We don't use your data for marketing. There's no newsletter, we don't build profiles, we make no automated decisions about you, and we don't sell or share your data with anyone for commercial purposes.

How long we keep it

The API keeps nothing from your request: it turns it into an email and forgets it. The request itself therefore lives in the studio mailbox while it's being handled.

The anti-abuse identifiers expire on their own: the phone one after 24 hours, the IP one after an hour. Once expired they're deleted and nothing is left.

The server logs rotate automatically and are deleted when the rotation period is up.

Who receives it

Your data isn't shared with third parties. The only ones who handle it are the providers the studio needs to operate, each under its own terms of service and data protection terms:

• Linode (Akamai Technologies): hosting for the server where the website and the API live.
• Google (Gmail): the studio's email provider, the mailbox your request lands in.
• Meta Platforms Ireland (WhatsApp): only if you pick that channel. Meta doesn't work for the studio: it's responsible for its own service, and the conversation is governed by WhatsApp's own privacy policy.
• The web developer, who administers the server under a confidentiality agreement and only for maintenance.

Public authorities and courts may also receive it where the law requires it.

The server sits in a Linode datacenter in London (United Kingdom), a country covered by a European Commission adequacy decision.

International transfers

Google may process data in the United States, under the EU-US Data Privacy Framework, the adequacy decision the European Commission approved for companies that sign up to it.

The same goes for Meta if you choose to write to us on WhatsApp.

Apart from those cases, your data stays in the European Union or in countries covered by an adequacy decision. We make no other international transfers.

Your rights

Over your data, you have these rights:

• Access: knowing what data of yours we hold.
• Rectification: correcting anything that's wrong.
• Erasure: asking us to delete it.
• Objection: asking us to stop processing it.
• Restriction: asking us to keep it without using it while a claim is resolved.
• Portability: receiving what you gave us in a machine-readable format.
• Not being subject to automated decisions: in practice, we make none.

To exercise them, write to venomtattooficial@gmail.com with the subject Protección de datos, tell us which right you want to exercise and identify yourself (your name and the phone number you wrote from is enough). We'll answer within one month at the latest.

If you think we've handled things badly, you can complain to the Agencia Española de Protección de Datos, the Spanish data protection authority: www.aepd.es, C/ Jorge Juan 6, 28001 Madrid. We'd rather you told us first, but it's your right and you don't have to.

Minors

The form and the messaging channels are meant for people aged 14 or over. If you're younger than that, don't write to us on your own: have a parent or guardian do it.

Tattooing a minor is only arranged at the studio, in person, with the written consent of whoever holds parental responsibility or guardianship, who has to come along with their ID.

Security

The whole site travels encrypted over HTTPS. We ask for the minimum data needed to reply, the API stores nothing from the request, the anti-abuse identifiers are kept as salted hashes, and access to the server and the mailbox is limited to the studio and whoever maintains the site.

Cookies and local storage

This site sets no cookies at all, neither its own nor third-party ones. There's no analytics, no pixels, no advertising and no banner to accept.

The only thing we use is your browser's session storage (sessionStorage), to remember where you were in the artist selector as you browse. It's strictly technical: it stays on your device, identifies nobody and disappears when you close the tab. That's why it needs no consent.

Links to Instagram, Google Maps, WhatsApp and LinkedIn take you to third-party sites that do use their own cookies, under their own policies.

Changes to this policy

If the way we handle data changes — a new provider, a new channel — we'll update this page. The date at the top marks the version in force, and anything significant is explained right here.