1. Controller
Shark Tattoo Owner: Marius Constantin Basca Lange Str. 63, 49661 Cloppenburg, Germany
E-mail: shark.tattoo03@gmail.com Phone: +49 174 4552303
Our studios:
- Studio Cloppenburg: Lange Str. 63, 49661 Cloppenburg
- Studio Minden: Bäckerstraße 48, 32423 Minden
For any question about data protection and to exercise your rights, contact us using the details above.
2. Visiting the website
When you visit our website, our web server automatically processes your device's IP address, the date and time, the page requested, the referrer and the browser identifier (server log files). This is technically necessary to deliver the site and helps us fend off attacks. The legal basis is our legitimate interest in secure operation (Art. 6(1)(f) GDPR). Web server and application log files are deleted automatically after 14 days.
For the duration of your visit we store a session (including your IP address) on our server; it is deleted after 120 minutes of inactivity.
Cookies. Strictly necessary cookies (session, protection against form abuse, your cookie choice) are set without consent (§ 25(2) TDDDG). All other cookies and services (e.g. statistics or advertising) are only used with your consent (§ 25(1) TDDDG, Art. 6(1)(a) GDPR); details and your choice are in our Cookie Policy. The studio map (Google Maps) is only loaded when you click it or have consented to the "Functional" category.
3. Appointment requests and bookings
When you request an appointment on our website, or when we create an appointment for you in the studio, by phone or by message, we process:
- first and last name, e-mail address, phone number, date of birth (age check),
- studio, artist, service, requested or agreed date,
- your description of the design, the body area and your messages to us,
- reference and body photos if you upload them (section 5),
- the studio's internal planning notes, deposits and payments.
The purpose is to handle your request, to plan and carry out the appointment and to communicate about it. The legal basis is the performance of pre-contractual measures or of the contract (Art. 6(1)(b) GDPR). Without a name and a way to contact you we cannot give you an appointment.
Our staff plan appointments in a protected admin area and a staff app. Your contact details (phone, e-mail) are visible there only to the owner and studio management; artists see the appointments assigned to them, without your contact details.
Retention. We keep booking data as long as it is needed for your appointments, touch-ups and questions and for possible claims (regular limitation period of three years, § 195 BGB), and beyond that only where statutory retention obligations apply (payment records up to 10 years, § 147 AO, § 257 HGB). We log changes our team makes to your client record (who, when, which field, previous and new value; for health information only that it was changed) so that mistakes can be traced (Art. 6(1)(f) GDPR); the log is deleted with your client data and removed when your data is anonymised. At your request, or when you delete your customer account, we anonymise your data (section 4).
4. Customer account
You can create a customer account or access it through the link in an appointment message. In the account you see your appointments, payments and receipts, can confirm or cancel appointments, upload photos, change your contact details and notification settings, and delete the account.
We store your name, e-mail address, phone number, your password only as a cryptographic hash, your chosen language and the times of sign-up and e-mail confirmation (Art. 6(1)(b) GDPR). Security-relevant account events (e.g. a change of password or e-mail address) are logged with the IP address and the log is deleted after 365 days; the purpose is detecting misuse (Art. 6(1)(f) GDPR).
Deleting your account. When you delete your account, we anonymise your account and your customer data: name, e-mail address, phone number, date of birth and notes are removed, your photos deleted, the contents of the messages sent to you cleared and your consents withdrawn. Only the key data of appointments and payments (date, service, studio, amounts) remain, without your name, as far as we must keep them for tax reasons.
5. Photos (reference and body photos)
You can send us photos of your design or the body area through the booking form, your account or the studio. We store these files in a non-public area of our server; only the owner, studio management and the responsible artist can see them. Images are re-encoded on upload, which removes metadata such as the location (GPS); PDF files are stored unchanged.
Photos of body areas may reveal information about your health (e.g. scars, skin conditions). Where this is the case, we process them only with your explicit consent (Art. 9(2)(a) GDPR), which you give by uploading them voluntarily and can withdraw at any time; otherwise Art. 6(1)(b) GDPR applies.
Retention. Deleted photos are removed from the server for good after 30 days; otherwise together with the booking data (section 3).
6. Notifications by e-mail and SMS
We send you messages about your appointment: receipt of your request, confirmation, rescheduling, cancellation, a reminder before the appointment, payment request and receipt. The messages contain a personal link to your appointment page.
- E-mail to the address you gave us — to perform the contract (Art. 6(1)(b) GDPR).
- SMS to your mobile number: for a booking on our website only if you agreed in the booking form (Art. 6(1)(a) GDPR). If we create the appointment for you in the studio, by phone or by message, we also send the appointment messages by SMS to the number you gave us for this (Art. 6(1)(b) GDPR). You can stop SMS at any time in your account or in the studio.
For each message we store the recipient, content and delivery status so that we can trace delivery problems and resend messages. After 12 months we delete the recipient and the content; only the type, date and status of the message remain.
Service providers. We send e-mails via Resend (Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) and SMS via the provider seven.io (seven communications GmbH & Co. KG, Willestr. 4-6, 24103 Kiel, Germany). Both receive the recipient address or number and the content of the message. For transfers to the USA see section 13.
7. Deposits and online payment (Stripe)
For some appointments we ask for a deposit. You can pay it in the studio, by bank transfer or online via a payment link. For online payment we use Stripe (Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland). We pass on to Stripe the amount, the appointment reference, a description of the appointment (service, studio, artist, date and time) and your e-mail address. You enter your card or account details directly at Stripe; we do not receive them. Stripe tells us whether and when payment was made and with which payment method.
The legal basis is the performance of the contract (Art. 6(1)(b) GDPR); we keep receipts because the law requires it (Art. 6(1)(c) GDPR with § 147 AO, § 257 HGB). Where Stripe processes data for its own purposes (e.g. fraud and money-laundering prevention), Stripe is itself responsible; Stripe's privacy policy then applies (https://stripe.com/privacy).
8. Appointment planning in Google Sheets
Our studios also keep the appointment calendar in a spreadsheet on Google Sheets (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). Appointment data is transferred there automatically: date, time, studio, artist, service, status and amounts, as well as the client's name, phone number, e-mail address, date of birth and note. Only persons we have authorised have access.
The purpose is joint appointment planning in the team; the legal basis is the performance of the contract (Art. 6(1)(b) GDPR) and our legitimate interest in simple, reliable planning (Art. 6(1)(f) GDPR). The retention periods in section 3 apply to the data in the spreadsheet. For possible transfers to the USA see section 13.
9. Push notifications to our staff (Firebase)
Our studios' staff app receives push notifications via Firebase Cloud Messaging (Google Ireland Limited, address as above). Such a notification may contain your first name, the date and time of the appointment, the studio, the artist and, where applicable, a payment amount — no phone number, no e-mail address and no last name. The legal basis is our legitimate interest in handling your request quickly (Art. 6(1)(f) GDPR).
10. Newsletter
You can subscribe to our newsletter on our home page. In it we tell you about new guest artists, short-notice free slots and offers at our studios in Cloppenburg and Minden.
Double opt-in. After you submit the form, you receive an e-mail with a confirmation link. You are only subscribed once you confirm through this link.
What we store. Your e-mail address, the website language and – as proof of your consent – the date, time and IP address of the sign-up, the version of the consent text, and the date, time and IP address of the confirmation.
Purpose and legal basis. We process this data only to send you the newsletter. The legal basis is your consent (Art. 6(1)(a) GDPR). Logging the sign-up and confirmation serves as proof of consent (Art. 7(1) GDPR in conjunction with Art. 6(1)(c) GDPR).
Withdrawal and retention. You can withdraw your consent at any time with effect for the future: via the unsubscribe link in every e-mail, via the "Unsubscribe" button of your e-mail program or by writing to us. After you unsubscribe we delete your e-mail address and all related data. Sign-ups that are not confirmed within 30 days are deleted automatically. Resend handles delivery (section 6).
11. Birthday greeting and request for a Google review
If you expressly allow it in the booking form, in your customer account or in the studio, we send you by SMS and/or e-mail a birthday greeting with a discount code once a year and, after a completed appointment (at most every 180 days, not after consultations), a request to review your studio on Google. For this we use your name, your phone number and/or e-mail address, your date of birth and the date and studio of your appointment.
Legal basis and withdrawal. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future – via the unsubscribe link in every message, in your customer account or in the studio. After that we no longer send you any of these messages.
Review link. The link in the message leads via our address (sharktattoo.de/r/…) to Google's review page. We only count how often a studio's link was opened – without your IP address or any other data. On Google's page, Google's privacy policy applies.
12. Google reviews on the website
The reviews and star rating of our studios come from Google Maps (Google Places API, Google Ireland Limited). Our server fetches them once a day and stores the latest version (name and profile link of the reviewer, stars, text, date); each new fetch replaces the previous one, and a version older than 30 days is no longer shown. When you visit our website, your browser loads nothing from Google servers for this: none of your data is sent to Google, no cookies are set and no profile pictures are loaded from Google. Only when you click a link to Google do you leave our website; Google's privacy policy then applies.
Monthly raffle
If your appointment at one of our studios was completed and you are 18 or older, you automatically take part in that studio's monthly raffle (terms). Taking part does not depend on a review. For this we process your name, the studio and the month of your appointment, your date of birth if we have it on file (only to check the minimum age of 18), and – only to notify you if you win – your e-mail address or phone number (SMS only if you have agreed to SMS). On our website and in videos of the draw we only show your first name and the first letter of your last name. The winner is drawn by a random generator; this involves no automated decision with legal effect within the meaning of Art. 22 GDPR.
Legal basis and objection. The legal basis is our legitimate interest in customer loyalty (Art. 6(1)(f) GDPR). You can object at any time (Art. 21 GDPR) – by e-mail, in your customer account or in the studio; you will then no longer take part or be shown.
Retention. We delete a draw's list of participants automatically three months after the draw. We keep the draw record (studio, month, number of participants, time, a reference to the winner's customer record and to the voucher) while the voucher is valid and for 10 years after that (retention period for accounting records, § 147 AO, § 257 HGB); draws without a winner for 10 years from the draw. It is then deleted automatically. The voucher itself is subject to the periods for payment records (section 3).
13. Hosting, backups and transfers to third countries
Hosting. Our website, the database and uploaded photos are on a server of Contabo GmbH (Aschauer Straße 32a, 81549 Munich, Germany), which operates it for us as a service provider.
Backups. We back up the database and files daily on the same server and delete these backups after 7 days; before every software update we also back up the database and delete those backups after 30 days.
Third countries. Resend (USA) as well as Stripe and Google (within their groups, possibly USA) may process data outside the EU. Transfers are based on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).
14. Contact via WhatsApp and social networks
Our website links to WhatsApp and to our social media profiles. These links are plain links: no data is sent to the providers when you visit our website. If you write to us on WhatsApp, WhatsApp (WhatsApp Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) processes your message and phone number under its own terms; we use your message only to answer your request (Art. 6(1)(b) GDPR).
15. Recipients
Within our business, your data is only available to the people who need it for appointment planning (owner, studio management, the responsible artist). External recipients are only the service providers named above: Contabo (hosting), Resend (e-mail), seven.io (SMS), Stripe (payment), Google Ireland (Sheets, Places, Firebase) and – where required by law – authorities and our tax advisor.
16. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). Contact us using the details in section 1; much of this you can also do directly in your customer account.
You can lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), e.g. the authority responsible for our seat in Lower Saxony: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany.
17. Automated decisions
We do not make solely automated decisions and do not carry out profiling within the meaning of Art. 22 GDPR.
18. Changes
We update this privacy policy when our processing changes. The version published on this page applies.