How LIGO GALERIA DE TATUAJES processes your personal data: controller, purposes, legal bases, retention, recipients and how to exercise your rights under the GDPR and the LOPDGDD.
In accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), and Spanish Organic Law 3/2018, of 5 December, on Personal Data Protection and guarantee of digital rights (LOPDGDD), you are informed that personal data provided through this website is processed by:
Legal basis: the controller's legitimate interest (art. 6.1.f GDPR). Sending communications about products or services additionally requires your express consent (art. 6.1.a GDPR), collected through a separate box that is not ticked by default; leaving it unticked does not prevent you from sending the form.
Legal basis: the controller's legitimate interest (art. 6.1.f GDPR). A booking never depends on you agreeing to receive commercial communications.
While you fill in the booking form, and for the sole purpose of letting you resume it later without retyping it, the partial content of the identifying and idea-description fields is saved automatically, linked to a random identifier in your browser and never to your identity. The form itself displays a notice while it is saving. This saving relies on the same purpose and legal basis as handling the request, does not include any files you attach, and you can ask for it to be deleted by writing to us.
Legal basis: your express consent (art. 6.1.a GDPR), collected through a box that is not ticked by default. You may withdraw it at any time, without affecting the lawfulness of prior processing, through the unsubscribe link in every message or by writing to the contact address.
Legal basis: your consent (art. 6.1.a GDPR) for every cookie that is not strictly necessary. Full detail is in the Cookie policy.
Data will be kept for no longer than is necessary to maintain the purpose of the processing, or while legal provisions require its custody. Once no longer necessary for the purpose that prompted its collection, it will be deleted or anonymised using appropriate security measures.
No disclosure of personal data to third parties is envisaged, except where required by law. Providers do take part in delivering services necessary for the site to work and for your request to be handled; they act as processors with the safeguards required by art. 28 GDPR and solely on our instructions:
Where any of these providers processes data outside the European Economic Area, the transfer relies on the safeguards set out in Chapter V of the GDPR. You may request the specific, up-to-date identity of each provider by writing to the contact address.
You may exercise the following rights at any time:
To exercise them, write stating the right you wish to exercise and enclosing a copy of a document proving your identity to:
CRISTINA BARROS MEJIAS CTRA. CARMONA, 49. LOCAL 6 41008 SEVILLA ligotatuajes@gmail.com
Each form indicates which fields are mandatory. Mandatory fields are only those essential to handle your request: on the contact form, your name, email address and message; on the booking form, additionally the minimum data needed to assess the tattoo idea. Phone number, Instagram handle, budget, preferred dates and reference images are optional and only help us answer you better. Not providing the mandatory fields prevents the request from being processed; not providing the optional ones does not.
Please do not include special categories of data in free-text fields — for example health information — unless strictly necessary to assess whether the tattoo is feasible. Such information is handled on the day of the session through the specific informed consent signed at the studio.
Appropriate technical and organisational measures are applied to ensure a level of security suited to the risk: traffic encryption over HTTPS, access control to the management panel, validation and sanitisation of all data received on the server, size and type limits on uploaded files, unpredictable storage names, and rate limiting of submissions from the same source.
Personal data is not fed into the measurement tools: names, emails, phone numbers and the text describing the tattoo are never sent to analytics, and full form bodies are not written to server logs.
Last updated: 2026-09-22