SSTATTS

Privacy policy

This policy explains what personal data I process when you contact me about a tattoo or use the SSTATTS site. I try to keep it plain. If anything is unclear, please get in touch.

1. Data controller

The data controller is Stanislau Stankevich. For matters concerning personal data, you can write to sstattsbooking@hotmail.com.

2. What data I process and why

Contact and booking. When you write to me on WhatsApp, Instagram or by e-mail, I process the data you send: your name or profile name, phone number or e-mail address, the content of your messages and photos (references, a photo of the body area, a photo of an existing tattoo). I do this to answer your message, prepare a sketch and an estimate, and carry out the service. The legal basis is Article 6(1)(b) GDPR, and for inquiries that do not lead to a contract, legitimate interest (Article 6(1)(f) GDPR).

Health information. If you tell me about your health, for example allergies or medication, I process it only to tattoo you safely, on the basis of your consent (Article 9(2)(a) GDPR).

Photos of work. I may publish photos of finished tattoos without any of the client’s personal data. If you do not want yours published, just tell me.

Visiting the site. The server records technical data such as the IP address and browser type so the site works and stays protected (Article 6(1)(f) GDPR; my legitimate interest is a working, secure site).

Visit statistics. I use two tools. Cloudflare Web Analytics measures visits without cookies and without storing anything in your browser. Cloudflare receives the IP address and technical data of the request (page, referrer, browser, loading time), and I see only aggregated statistics. The basis is legitimate interest (Article 6(1)(f) GDPR): knowing which pages are read. Google Analytics runs only after you consent in the cookie banner (Article 6(1)(a) GDPR). After consent it receives your IP address, device and browser data, the pages you view, the referrer and an identifier stored in the _ga cookie. Without consent the Google Analytics script is not loaded and the site sends nothing to Google through it.

Marketing tools. None is active now. If I run ads on Instagram or Facebook, I may use Meta Pixel, but only after you consent to marketing (Article 6(1)(a) GDPR).

Map. The map on the home page and on the Contact page loads from Google only after you click the “Show map” button. The basis is your consent given by that click (Article 6(1)(a) GDPR). Google then receives your IP address and the address of this site (the domain only) and, as an independent controller, decides on its own cookies.

3. Who receives the data

  • Meta (WhatsApp, Instagram), when you contact me through these apps. Meta also processes data as a separate controller under its own privacy policy.
  • The e-mail provider through which I receive and send messages.
  • Cloudflare, Inc.: hosting of the site, protection from abuse and Cloudflare Web Analytics. Cloudflare acts as a processor.
  • Google Ireland Limited: Google Analytics (as a processor, only after consent) and the Google map (as an independent controller, only after you click the map).
  • Meta Platforms Ireland Limited (Meta Pixel): only if I run ads on Instagram or Facebook, and only after you consent to marketing. Meta then receives data about your visit and also processes it under its own privacy policy.

Cloudflare, Google and, if I use it, Meta may process data in the United States. The transfer relies on the European Commission’s adequacy decision for the EU–US Data Privacy Framework where the recipient is certified under it, and otherwise on standard contractual clauses.

4. How long I keep data

  • Correspondence and booking data: 24 months after the last contact, unless the law (for example tax rules) requires longer or the data is needed to defend legal claims.
  • Health information: until your tattoo has healed or until you withdraw consent.
  • Technical server data: for the short period needed to keep the site secure.
  • Google Analytics: event data for up to 14 months.
  • Your banner choice (sf_consent): stays in your browser until you change or delete it.

5. Your rights

You have the right to access your data, correct it, have it erased, restrict processing, receive your data in a portable format, and object to processing based on legitimate interest. You can withdraw consent at any time, without affecting the lawfulness of processing before withdrawal. You may also lodge a complaint with your data protection authority; in Poland this is the President of the Personal Data Protection Office (UODO).

6. Voluntary data and profiling

Providing data is voluntary, but without it I cannot answer your message or book a session. I make no decisions based solely on automated processing and I do not build advertising profiles of you.

7. Cookies

The site stores little on your device: your choice from the banner (browser local storage), the language you pick (a cookie) and, only with your consent, the Google Analytics cookies and, if Meta Pixel is used, the Meta cookies. The Cookie settings page lists each item and explains what each tool does. You can change or withdraw your choice at any time with the “Change cookie settings” link in the footer. The booking terms are described on the Booking rules page. Contact details are on the Contact page.