Privacy and cookie policy

Data controller

The person responsible for what happens to your data is Óscar Amengual Ripoll, a sole trader working under the trading name Venom Tattoo.

• Tax ID (NIF): 23059768Z
• Registered address: C/ Conciliación 22 BJ, 30390 La Aljorra, Cartagena (Murcia)
• Studio: C. del Submarino, 32a, 30300 Cartagena, Murcia, Spain
• Email for anything to do with your data: info@venomtattoo.com

The owner's full identification details are in the legal notice.

What we collect and where it comes from

Almost everything we know about you is what you tell us. The contact form asks for your name, your phone number (the one you use on WhatsApp), the body area, a rough size and a description of your idea. On a computer or tablet you can also add up to three reference images, if you have any.

On a computer or tablet, the form is sent to our own API, hosted on the studio's server, which turns it into an email to the studio mailbox and stores nothing from the request. Images aren't sent as they are: before they leave, your browser shrinks them on your own device, and in doing so removes the location and other data the camera stores inside the file. The API only checks their size and format and attaches them to the email, without keeping them. On a phone, the same form opens the WhatsApp app with the message already written: you send it yourself, from your own phone, and nothing goes through the website.

You can also call us, email us or message us on Instagram. In those cases we handle whatever you choose to tell us.

Beyond that there's technical data. For security, the server logs the IP address, the browser, the date and the pages visited. And to stop the form being sent over and over, it stores a salted hash of your phone number and of your IP address, with an expiry date. A hash is a one-way fingerprint: there's no way back from it to the phone number or the IP.

One thing we do ask: don't include health data or other sensitive information in the form or in your messages. Allergies, medication, pregnancy or anything else that affects the session is discussed at the studio, in person, and recorded in the consent form you sign before we tattoo you.

What we use it for, and on what legal basis

• Answering your request and arranging the appointment. Legal basis: pre-contractual measures taken at your request (article 6.1.b GDPR). Without this data we can't reply.
• Preventing abuse of the form and keeping the site secure. Legal basis: our legitimate interest in keeping the mailbox and the server from being flooded with automated or repeated submissions (article 6.1.f GDPR).
• Meeting legal obligations where they apply, such as issuing an invoice or answering an official request (article 6.1.c GDPR).

We don't use your data for marketing. There's no newsletter, we don't build profiles, we make no automated decisions about you, and we don't sell or share your data with anyone for commercial purposes.

How long we keep it

The API keeps nothing from your request, images included: it turns it into an email and forgets it. The request itself therefore lives in the studio mailbox while it's being handled, and the images with it, as attachments to the email.

Your request stays in the studio mailbox while it's being handled and for twelve months at most. After that it's deleted.

The anti-abuse identifiers expire on their own: the phone one after ten minutes, the IP one after an hour. Once expired they're deleted and nothing is left.

The server logs rotate daily and are deleted automatically after fourteen days.

Who receives it

Your data isn't shared with third parties. The only ones who handle it are the providers the studio needs to operate, each under its own terms of service and data protection terms:

• Linode (Akamai Technologies): hosting for the server where the website and the API live.
• SMTP2GO (Sand Dune Mail Ltd): the email delivery service the API uses to hand your request, along with any images you attach, to the studio mailbox. It stores its European customers' data within the European Economic Area.
• Google (Gmail): the studio's email provider, the mailbox your request and its images land in.
• Cloudflare: forwards messages sent to info@venomtattoo.com to the studio's Gmail inbox.
• WhatsApp Ireland (WhatsApp) and Meta Platforms Ireland (Instagram): only if you pick one of those channels. Neither works for the studio: each is responsible for its own service, and the conversation is governed by the privacy policy of the app you use.
• The web developer, who administers the server and only accesses data for maintenance.

Public authorities and courts may also receive it where the law requires it.

The server sits in a Linode datacenter in London (United Kingdom), a country covered by a European Commission adequacy decision.

International transfers

Google may process data in the United States, under the EU-US Data Privacy Framework, the adequacy decision the European Commission approved for companies that sign up to it.

The same goes for WhatsApp LLC and Meta Platforms, Inc., in the United States, if you choose to write to us on WhatsApp or Instagram.

SMTP2GO is a New Zealand company, a country that also holds a European Commission adequacy decision, and it stores its European customers' data within the European Economic Area.

Cloudflare, which forwards emails sent to info@venomtattoo.com, may process them outside the European Union, under its own terms of service and data protection terms. For transfers to the United States, Cloudflare, Inc. is signed up to the EU-US Data Privacy Framework.

Apart from those cases, your data stays in the European Union or in countries covered by an adequacy decision. We make no other international transfers.

Your rights

Over your data, you have these rights:

• Access: knowing what data of yours we hold.
• Rectification: correcting anything that's wrong.
• Erasure: asking us to delete it.
• Objection: asking us to stop processing it.
• Restriction: asking us to keep it without using it while a claim is resolved.
• Portability: receiving what you gave us in a machine-readable format.
• Not being subject to automated decisions: in practice, we make none.

To exercise them, write to info@venomtattoo.com with the subject Protección de datos, tell us which right you want to exercise and identify yourself (your name and the phone number you wrote from is enough). We'll answer within one month at the latest.

If you think we've handled things badly, you can complain to the Agencia Española de Protección de Datos, the Spanish data protection authority: www.aepd.es, C/ Jorge Juan 6, 28001 Madrid. We'd rather you told us first, but it's your right and you don't have to.

Minors

The form and the messaging channels are meant for people aged 14 or over. If you're younger than that, don't write to us on your own: have a parent or guardian do it.

Tattooing a minor is only arranged at the studio, in person, with the written consent of whoever holds parental responsibility or guardianship, who has to come along with their ID.

Security

The whole site travels encrypted over HTTPS. We ask for the minimum data needed to reply, images are shrunk on your device before they're sent, the API stores neither the request nor the images, the anti-abuse identifiers are kept as salted hashes, and access to the server and the mailbox is limited to the studio and whoever maintains the site.

Cookies and local storage

This site sets no cookies at all, neither its own nor third-party ones. There's no analytics, no pixels, no advertising and no banner to accept.

The only thing we use is your browser's session storage (sessionStorage), to remember where you were in the artist selector as you browse. It's strictly technical: it stays on your device, identifies nobody and disappears when you close the tab. That's why it needs no consent.

Links to Instagram, Google Maps, WhatsApp and LinkedIn take you to third-party sites that do use their own cookies, under their own policies.

The map in the Location section is an image served from this site. Google Maps only opens when you follow one of its links.

Changes to this policy

If the way we handle data changes, with a new provider or a new channel, we'll update this page. The date at the top marks the version in force, and anything significant is explained right here.