1. Controller
[company] [legalform], [street], [zipcity], Deutschland
Email: [email]
Data protection contact: [dpo]
2. What we process and why
Visiting the site: our hosting provider (Hostinger International Ltd., Larnaka, Zypern) processes technical connection data (IP address, time, requested page, browser) in server logs to deliver the site and keep it secure (Art. 6(1)(f) GDPR).
Account: if you register we store your username, email address and a password hash, plus the content you publish, likes and comments, to provide the community (Art. 6(1)(b) GDPR).
Purchases: payments are handled by Stripe Payments Europe Ltd. (Ireland) and, for sellers, Stripe Connect. We receive order data (product, amount, email) and store it to fulfil the contract and meet tax retention duties (Art. 6(1)(b) and (c) GDPR).
Visitor statistics: we count visits without storing IP addresses or user agents – only a hash that changes daily and cannot be traced back to you. Statistics are deleted after 400 days (Art. 6(1)(f) GDPR).
Chat and booking requests: messages, booking requests, reference images and deposit requests are stored so the conversation between you and the tattooist works (Art. 6(1)(b) GDPR). Messages are deleted after 180 days. Images are re-encoded, which removes location data (EXIF). If a conversation is reported, we may read its latest messages.
Healing diary: if you create a diary we store your photos, notes and symptom details about your tattoo. These are health-related data; we process them only with your explicit consent (Art. 9(2)(a) GDPR), given when you create the diary. The diary is private until you share it with your tattooist or via a secret link. You can delete it completely at any time; photos are then removed from our server.
Push notifications: only if you switch them on in your browser; we store the push address of your device until you turn them off (Art. 6(1)(a) GDPR).
Emails: we send transactional emails (confirmation, password reset, receipts, notifications you enabled).
3. Cookies and local storage
We use strictly necessary cookies (session, language choice, consent choice, portfolio visit throttle) and your device storage for display settings (theme, layout). They do not require consent. Optional services only load after you consent in the cookie settings.
4. Recipients and third countries
Hosting: Hostinger International Ltd., Larnaka, Zypern. Payments: Stripe. Embedded YouTube videos load from Google only when you play them / consent. Where data is transferred outside the EU/EEA this happens on the basis of EU standard contractual clauses or an adequacy decision.
5. Storage period
Account data until you delete your account. Order data for 10 years (tax law). Server logs for a short period set by our host.
6. Your rights
You have the right to access, rectification, erasure, restriction, data portability and to object, and to withdraw consent at any time. You can complain to a data protection authority.
Note: these texts are templates and must be reviewed for your actual setup.