Privacy Policy

Last updated: [insert date]

1. Controller
The controller responsible for data processing on this website is:
Maya Goldfinch — Forever Art Tattoo, Pestalozzistraße 11, 30451 Hannover, Germany
Email: forever@mayagoldfinch.art · Phone: +49 176 66682784

2. Hosting and server log files
This website is hosted by Vercel Inc. (USA). When you visit the site, the host automatically processes technical access data (IP address, date and time, requested URL, browser and operating system information, referrer) in server log files. The legal basis is Art. 6(1)(f) GDPR (interest in a secure and stable operation of the website). A data processing agreement is in place with the host. Transfers to the USA are based on the EU-US Data Privacy Framework or EU standard contractual clauses.

3. Booking inquiry (form, incl. photos)
When you use the booking form, we process the data you provide: name, contact details (email, phone or Instagram), preferred body placement, message and optionally up to 10 uploaded photos. We also store the time, language and the page from which the inquiry was sent.
The purpose is to handle your inquiry, provide a consultation and arrange an appointment. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures). Where photos or messages contain special categories of personal data (e.g. health data such as skin conditions), we process them based on your explicit consent (Art. 9(2)(a) GDPR), which you give by submitting the form and can withdraw at any time.
Photos are re-encoded before storage; metadata such as location data (EXIF/GPS) is removed in the process. They are kept in protected, non-public storage (Vercel Blob, Frankfurt region) and can only be viewed after logging in to the website's admin area. Uploaded photos that are not linked to a submitted inquiry are deleted automatically.
The inquiries themselves are stored in a database operated by our service provider Upstash (Upstash, Inc., connected via Vercel). [Check storage region and data processing agreement.]
Retention: if no appointment is made, we delete your inquiry including photos after [6 months] at the latest. If an order results, statutory retention periods for business records apply (e.g. § 147 AO, § 257 HGB).

4. Storage on your device and consent management
We store your choice in the cookie banner in your browser's local storage (entry "mg_consent_v1"). This is technically necessary so that we can respect your choice (§ 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR). You can change or withdraw your choice at any time via "Cookie settings" in the footer.

5. Google Analytics and Google Ads (with consent only)
With your consent we use Google Analytics 4 and Google Ads (conversion measurement). The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"); the parent company is Google LLC, USA. Cookies or similar technologies are set and, among other things, the following data is processed: truncated IP address, device and browser information, pages visited, interactions (e.g. a submitted booking inquiry) and the ad through which you reached the website. The purpose is reach measurement and the evaluation and optimisation of the website and advertising. The legal basis is Art. 6(1)(a) GDPR in conjunction with § 25(1) TDDDG. Data may be transferred to the USA based on the EU-US Data Privacy Framework. Retention of analytics data: [duration configured in Google Analytics, e.g. 2 months]. Without your consent these services are not loaded. You can withdraw your consent at any time via "Cookie settings" in the footer.

6. Google Maps (only after a click)
On the "Studio" page a map from Google Maps can be displayed. It is only loaded once you click "Load map". This establishes a connection to Google servers and, among other things, your IP address is transmitted. The legal basis is Art. 6(1)(a) GDPR (your consent by clicking) in conjunction with § 25(1) TDDDG.

7. Fonts and external links
The fonts used are served from our own server; no connection to Google Fonts is made. Links to Instagram (Meta Platforms Ireland Limited) are plain links: data is only transmitted to the respective provider once you click them.

8. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and the right to object to processing based on legitimate interests (Art. 21). You can withdraw any consent at any time with effect for the future. Please contact the address above to do so.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.

9. No automated decision-making
No automated decision-making, including profiling, takes place.

Note: this is a draft with placeholders in square brackets. Please complete it fully and have it reviewed by a legal professional before publishing.