Privacy policy

Data controller

In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018, of 5 December, on Personal Data Protection and guarantee of digital rights (LOPDGDD), you are informed that personal data provided through this website is processed by:

Purposes and legal bases

Contact form

• Responding to the queries or requests you make through the available channels and maintaining the commercial relationship arising from them.

Legal basis: the controller's legitimate interest (art. 6.1.f GDPR). Sending communications about products or services additionally requires your express consent (art. 6.1.a GDPR), collected through a separate box that is not ticked by default; leaving it unticked does not prevent you from sending the form.

Appointment and booking form

• Scheduling appointments and meetings with the controller, and handling the quote or booking request you send us, including any reference images you attach.

Legal basis: the controller's legitimate interest (art. 6.1.f GDPR). A booking never depends on you agreeing to receive commercial communications.

While you fill in the booking form, and for the sole purpose of letting you resume it later without retyping it, the partial content of the identifying and idea-description fields is saved automatically, linked to a random identifier in your browser and never to your identity. The form itself displays a notice while it is saving. This saving relies on the same purpose and legal basis as handling the request, does not include any files you attach, and you can ask for it to be deleted by writing to us.

News subscription

• Sending you studio news, flash days and commercial communications by email.

Legal basis: your express consent (art. 6.1.a GDPR), collected through a box that is not ticked by default. You may withdraw it at any time, without affecting the lawfulness of prior processing, through the unsubscribe link in every message or by writing to the contact address.

Cookies and measurement

Legal basis: your consent (art. 6.1.a GDPR) for every cookie that is not strictly necessary. Full detail is in the Cookie policy.

Retention

Data will be kept for no longer than is necessary to maintain the purpose of the processing, or while legal provisions require its custody. Once no longer necessary for the purpose that prompted its collection, it will be deleted or anonymised using appropriate security measures.

Recipients

No disclosure of personal data to third parties is envisaged, except where required by law. Providers do take part in delivering services necessary for the site to work and for your request to be handled; they act as processors with the safeguards required by art. 28 GDPR and solely on our instructions:

• Website hosting and execution provider.
• Managed database provider, where requests and contacts are stored.
• File storage provider, where the reference images you attach are kept.
• Email delivery provider, used to send you replies, confirmations and, where you have consented, the newsletter.

Where any of these providers processes data outside the European Economic Area, the transfer relies on the safeguards set out in Chapter V of the GDPR. You may request the specific, up-to-date identity of each provider by writing to the contact address.

Google reviews

The home page may show a selection of public five-star reviews checked on our Google Maps profile and manually updated through the studio's admin panel. Review texts and public author attribution are served from our website; no external API is queried to load the cards. We display the date the selection was checked. Author photos are only requested by your browser if you allow external content. Profile and review links open Google Maps, where Google's terms and privacy policy apply.

Your rights

You may exercise the following rights at any time:

• Withdrawing consent, where processing relies on it, without affecting the lawfulness of prior processing.
• Access to your personal data.
• Rectification of inaccurate data.
• Erasure of data once it is no longer necessary.
• Objection to the processing.
• Restriction of the processing.
• Data portability.
• Lodging a complaint with the Agencia Española de Protección de Datos (AEPD), the competent supervisory authority, at https://www.aepd.es, particularly if you consider that your rights have not been properly addressed.

To exercise them, write stating the right you wish to exercise and enclosing a copy of a document proving your identity to:

CRISTINA BARROS MEJIAS CTRA. CARMONA, 49. LOCAL 6 41008 SEVILLA ligotatuajes@gmail.com

Whether data is required

Each form indicates which fields are mandatory. Mandatory fields are only those essential to handle your request: on the contact form, your name, email address and message; on the booking form, additionally the minimum data needed to assess the tattoo idea. Phone number, Instagram handle, budget, preferred dates and reference images are optional and only help us answer you better. Not providing the mandatory fields prevents the request from being processed; not providing the optional ones does not.

Please do not include special categories of data in free-text fields — for example health information — unless strictly necessary to assess whether the tattoo is feasible. Such information is handled on the day of the session through the specific informed consent signed at the studio.

Security

Appropriate technical and organisational measures are applied to ensure a level of security suited to the risk: traffic encryption over HTTPS, access control to the management panel, validation and sanitisation of all data received on the server, size and type limits on uploaded files, unpredictable storage names, and rate limiting of submissions from the same source.

Personal data is not fed into the measurement tools: names, emails, phone numbers and the text describing the tattoo are never sent to analytics, and full form bodies are not written to server logs.