Privacy policy
This notice explains what personal data we process, why and for how long — in line with the GDPR and Act No. 18/2018 Coll. of the Slovak Republic.
Who processes the data
The controller is [DOPLNIT: meno/obchodný názov], company ID [DOPLNIT], registered office [DOPLNIT], place of business M. R. Štefánika 3148/61, 962 12 Detva.
Contact for data protection matters: amaru.tattoostudio@gmail.com, 0908 836 097.
What data we process
- Contact details — first name, surname, email, phone and possibly Instagram. Without them we cannot contact you or confirm a date.
- Booking details — description of the design, placement on the body, size, style, the chosen date and any reference images you upload to us.
- Login details — if you create an account: email and password (the password is stored in encrypted form by Supabase, we never see it), or details from your Google account if you sign in with Google.
- Health data — allergies, contraindications and medication you are taking. These are filled in exclusively before the tattooing itself, because they directly affect its safety. We process them solely on the basis of your explicit consent.
For what purpose and on what legal basis
| Purpose | Legal basis |
|---|---|
| Handling the appointment request and the tattooing itself | Performance of a contract (Art. 6(1)(b) GDPR) |
| Health data for the safety of the procedure | Explicit consent (Art. 9(2)(a) GDPR) |
| Records for accounting purposes | Legal obligation (Art. 6(1)(c) GDPR) |
| Sending news and offers | Consent — revocable at any time (Art. 6(1)(a) GDPR) |
Who we share the data with
We do not sell data. We use the following processors:
- Supabase — database, authentication and storage for uploaded images. Servers in the EU (Frankfurt).
- Netlify — hosting of the website itself.
- Resend — sending confirmation and notification emails.
If a payment gateway or website analytics is added in the future, we will list them here before switching them on.
How long we keep the data
- Appointment requests that did not go ahead — 12 months from the last communication.
- Client records and completed sessions — 10 years (accounting regulations).
- Consents to the processing of health data — for as long as the consent is valid.
- Marketing consents — until withdrawn.
Your rights
You have the right to access your data, to have it corrected or erased, to restrict processing, to data portability and the right to object. You can withdraw your consent at any time — the withdrawal does not affect processing carried out before it. You can cancel a booking yourself in your account.
Just write to amaru.tattoostudio@gmail.com. If you are not satisfied with how your request is handled, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk).
Cookies
The website uses only strictly necessary cookies — they keep you signed in. We do not use advertising or tracking cookies, which is why we do not ask you to consent to them.
This wording reflects how the website actually works. Before going fully live we recommend having it checked by a lawyer and filling in the details marked as [DOPLNIT].