Privacy policy

Data controller

This is a translation for information only. The Spanish version of this page is the binding one, and the rules cited are Spanish law.

Article 13.1(a) of Regulation (EU) 2016/679, the General Data Protection Regulation, requires the identity and contact details of the controller. The controller’s name is Diego Hermo Veiga, its tax identification number is 78806291B and its tax address is CALLE DEVESA DO MARQUES NUM 35 15200 NOIA (CORUÑA, A). The address of the studio from which the service is provided is Rúa dos Concheiros, 22 · 15703 Santiago de Compostela, and the contact email address is velvettattooacademy@gmail.com. The same details, cited against article 10 of Spanish Law 34/2002, are in the legal notice.

Data protection officer

Article 13.1(b) requires the contact details of the data protection officer where one exists; article 37 only requires appointing one in specific cases. No appointment of a data protection officer by the controller is on record.

What this site processes today, and why

Article 13.1(c) requires the purposes of the processing and its legal basis.

This site does not require an account or load analytics. Optional third-party resources connect only after you accept, as explained below. While you write your request, the tab keeps a draft until you close it. Details are in the cookie policy. If you choose to upload a photo, your browser sends it directly to the storage provider named below. The hosting provider also handles the connection data needed to serve and protect these pages, including the IP address and technical request data.

How the appointment request is protected, and with what data

Articles 13.1(c) and 13.1(d) require the purposes of the processing and its legal basis and, where that basis is legitimate interest, what those interests are. The appointment request is an open form, with no account and no password, so it is protected against automated submissions. That protection relies on the same connection data as the previous section: submissions are counted per IP address in ten-minute windows, and every submission goes through a check by the platform hosting this site to tell a person from a program.

Neither the count nor the check is used to identify you, to measure you or to build any profile: no history of your visits is kept and this site does not store your IP address.

For every submission that reaches this site and the protection rejects, or that is saved flagged, a record is kept with four items: a random reference for the attempt, such as R-7K2Q9M; a code for the check that acted; the date; and, if the request was saved flagged, which request it refers to. Neither the IP address nor anything you write is recorded. If the platform’s check takes a submission for an automated one with no other signal, or does not answer, the request is saved anyway and flagged so that a person can review it: it is not discarded on that check alone. That record is deleted after 30 days.

The legal basis is the legitimate interest of article 6.1(f) in protecting a service open to the public against automated abuse, which is also what keeps the form working for those who do need it. If one of those checks were to reject you by mistake, the notice shows you the reference of your attempt and offers you to write on WhatsApp with your request already drafted and that reference in it, so you lose nothing you wrote; with it, the studio can review what happened to your submission.

The appointment request and the reference photograph

Article 13.1(c) requires the purposes of the processing and its legal basis. When you fill in the appointment request, what is processed is your name, your WhatsApp number if you give it, what you tell us about your idea, the placement on the body if you say it, the approximate size, the approximate date that suits you and, only if you choose to upload it, one reference photograph of the design. The photograph is prepared in your own browser before it is sent and its metadata, location included, is stripped: none reaches us with it.

The purpose is to assess your idea, prepare your quote and, if an appointment is confirmed, agree the design for that appointment. It is not used for marketing. The legal basis is taking steps at your request before entering into a contract, under article 6.1(b) of the Regulation.

Submitting the form saves the request in the studio dashboard for the team to review. You do not need to send another WhatsApp message for them to receive it; submitting the request does not yet confirm the appointment. If you choose to continue on WhatsApp, you start the conversation from your own application with the summary already written. If you uploaded a photograph, that summary carries a read-only link to that photograph and only to that one, which stops working as soon as the photograph is deleted.

Recipients

Article 13.1(e) requires the recipients or categories of recipients of the personal data. For managing the request and hosting this site, we use two providers, both acting as processors for the studio: Supabase, which stores the appointment request and the reference photograph in the European Union, in its Paris region; and Vercel, which hosts this site, serves the pages, runs the form submission and processes the connection data described above. This site uses no analytics tool. The optional Instagram videos connect to that provider only if you accept loading each one; see the Instagram privacy policy for its terms. The WhatsApp message is not sent by this site: you send it from your own application, under your messaging provider’s terms.

The optional Google Maps map

On Visit, Google Maps helps you locate the studio. It connects to Google only when you press “Accept and load map”. Before accepting you can read the address and use the external studio link; the map is not needed to contact us or request an appointment.

If you accept, Google receives connection data, such as your IP address and technical browser data, and may use cookies under its privacy policy. “Remove map” removes the frame from this page; it does not delete cookies Google has already stored, which you can manage in your browser. This site does not save the choice in cookies or browser storage. Reloading requires a new choice.

International transfers

Article 13.1(f) requires information about transfers to third countries and the applicable safeguards. The appointment request and the reference photograph are stored and processed in the European Union, and Supabase’s data processing agreement incorporates the standard contractual clauses of Commission Implementing Decision (EU) 2021/914 for cases involving its subprocessors. Vercel Inc. is headquartered in the United States and its principal facilities are there; the safeguard applicable to that processing is its data processing agreement.

Retention period

Article 13.2(a) requires the retention period or the criteria used to determine it. If the request does not become an appointment, its reference photograph is deleted within 30 days of upload. If it becomes an appointment, the photograph remains linked to it while needed to prepare the design and manage the appointment. A photograph uploaded for a form you never submit is deleted in under three days. When a photograph is deleted from our storage, its reading link stops working, although a browser that opened it may keep a cached copy for up to one hour.

We keep the request while needed to reply to you, prepare a quote and arrange a possible appointment. If it is confirmed, its details remain linked to that appointment to prepare the work and handle applicable obligations or claims. Technical connection logs are kept by the hosting provider for as long as security and operation require. The record of rejected or flagged submissions described in the section on protecting the request is deleted after 30 days.

Your rights

Articles 15 to 22 of the Regulation grant the rights of access, rectification, erasure, restriction of processing, objection and portability; and, where processing is based on consent, the right to withdraw it at any time without affecting the lawfulness of processing before the withdrawal. They also cover what you send in the appointment request and the reference photograph. You may request erasure; the studio will assess and respond in accordance with applicable obligations. To exercise these rights, write to velvettattooacademy@gmail.com.

Complaint to a supervisory authority

Article 13.2(d) requires information about the right to lodge a complaint with a supervisory authority. In Spain that is the Agencia Española de Protección de Datos, at www.aepd.es.

Whether providing data is mandatory

Article 13.2(e) requires information on whether providing data is a statutory or contractual requirement and on the consequences of not providing it. Filling in the appointment request is neither a statutory nor a contractual obligation: it is voluntary, and it only serves so that we can reply to you. Within the form, your name, what you tell us about your idea, the approximate size and the approximate date are needed in order to send it; the WhatsApp number, the placement and the reference photograph are optional, and not giving them only means we will have to ask you in the conversation.

Automated decision-making

Article 13.2(f) requires information about automated decision-making, including profiling. This site takes no decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, within the meaning of article 22 of the Regulation. The checks that protect the appointment request can stop a submission from going out through the site; when that happens, you always have the WhatsApp route with your request already drafted and its reference. And no profiles are built.