Privacy policy

This policy explains what personal data we process when you contact Hyper Tattoo Gallery, book a session, send an application as a tattoo artist, or simply visit our website. We have tried to keep it simple; if anything is unclear, just ask us.

1. Data controller

The data controller is 13 Alex Vasilevko, ul. Orzechowa 4, 55-093 Brzezia Łąka, NIP 7972058054 — the entity running the Hyper Tattoo Gallery tattoo studio, ul. Życzliwa 13A, 52-007 Wrocław.

For personal data matters, you can write to {{PRIVACY_EMAIL}} or to the studio on WhatsApp or Instagram.

2. What data we process and why

Contact and session booking

When you message us on WhatsApp or Instagram, we process the data you provide: your name or profile name, phone number or account name, the content of the message and photos (e.g., references, a photo of your current tattoo). When booking, we record in our system the date, artist, tattoo description and deposit information.

We do this to respond to your message, prepare an estimate and provide the service (Article 6(1)(b) GDPR).

Your contact details are only visible to the studio administration. The artist in their calendar sees only your name and tattoo description — without your phone number and other contact details.

Health declaration

Before the session, you fill in a health declaration at the studio. We process this information based on your explicit consent (Article 9(2)(a) GDPR) solely to perform the tattoo safely, and we protect it from unauthorized access.

Tattoo photos

We only publish photos or videos of your tattoo if you give separate consent (Article 6(1)(a) GDPR). You can withdraw your consent at any time; this does not affect the lawfulness of any earlier publications.

Tattoo artist applications

The application form for tattoo artists is the only form on the site. We process the data you provide: first name or alias, email, Instagram profile, optionally website, city, styles, experience, preferred form of cooperation, availability, languages and message. We do this to consider the application and establish cooperation (Article 6(1)(b) GDPR). The administration receives a notification of new applications via the Telegram messenger.

Team accounts in the studio panel

Tattoo artists and administration log into the internal panel via a link sent by email. We then process the email address, login session data and calendar change history — to manage the schedule and bookings (Article 6(1)(b) and (f) GDPR).

Visiting the website

The website servers automatically record technical data such as IP address, browser type and visit time. We need these to ensure the site works and is protected against abuse (Article 6(1)(f) GDPR). The application form is additionally protected by Cloudflare Turnstile, which checks whether the message is from a bot.

We only activate analytics and marketing tools after you consent via the cookie banner (Article 6(1)(a) GDPR). Details can be found on the Cookie settings page.

3. Who we share data with

Your data may be passed to companies that help us run the studio and website:

• Cloudflare — website hosting, booking system database, bot protection;
• Meta (WhatsApp, Instagram) — when you message us through these apps; Meta also processes data as a separate controller, under its own privacy policy;
• Telegram — notifications for our admin team about new enquiries and bookings;
• email provider — sending login links and notifications to the team;
• accountancy firm — where required by tax regulations.

Some of these companies may process data outside the European Economic Area. In such cases, we rely on safeguards provided under the GDPR, such as standard contractual clauses or European Commission adequacy decisions.

4. How long we keep data

• Booking data and correspondence: 24 months from your last visit, unless a longer retention period is required by law (e.g. tax regulations) or is necessary to establish, pursue or defend legal claims.
• Tattoo artist applications: 12 months from submission, unless we begin working together sooner.
• Photo publication consent: until you withdraw your consent.
• Technical data and logs: for the short period needed to keep the website secure.

5. Your rights

You have the right to:

• access your data and receive a copy of it,
• rectify your data,
• erase your data,
• restrict processing,
• data portability,
• object to processing based on our legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

If you believe we are processing your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

6. Whether you have to provide data

Providing your data is voluntary, but without it we cannot reply to your message, book a session or consider your application.

7. Profiling

We do not make decisions about you based solely on automated processing, and we do not profile you.

8. Policy changes

When our tools or practices change, we will update this page. The version published here always applies.