Privacy

Who is the data controller

Name

Natalia Salgado Funes

Tax ID (NIF)

43562929D

Address

Passatge de Lluís Pellicer, 5, Eixample, 08036 Barcelona

Contact

hola@nataconsal.com

I am a self-employed tattoo artist and work as a resident artist at the Mistika Fineline Tattoo studio in Barcelona.

What data I collect

What you give me in the booking form: your name, your email, your idea, the area of the body, the size, the dates that suit you and any reference images you want to attach. You also confirm that you are 18 or older.

To protect the form from bots and mass submissions, some technical data about your connection, such as the IP address and the browser, is used when you submit it. I do not store it with your request.

If you write to me by email, Instagram or WhatsApp, I use what you tell me there for the same purpose: to reply to you and organise your appointment.

What I use it for

• Reading your idea and replying to you.
• Preparing a design proposal, an approximate quote and dates for you.
• Organising the appointment if you decide to go ahead.

I do not use it for advertising or to send you newsletters or updates, I do not build profiles with it and I do not make automated decisions about you.

Why I can use it

Your request

Because you ask me for information and a proposal before entering into an agreement for a tattoo, which are steps taken at your request (Article 6(1)(b) GDPR). Without your name, your email and your idea I cannot reply to you.

Protecting the form

My legitimate interest in keeping the website secure and free of fake submissions (Article 6(1)(f) GDPR).

Photos of your tattoo

Your consent, which you give me in writing at the studio (Article 6(1)(a) GDPR).

Health matters, at the studio

You do not need to tell me anything about your health in the form. I go over that with you in person, in the informed consent you sign on paper at the studio. If you do tell me something (for example, that you want to cover a scar), I use it only to assess your design and it is deleted with your request.

Adults only (18 or over)

I only tattoo people aged 18 or over, so the form is for adults only. If I see that a request comes from a minor, I delete it.

Photos of your tattoo

I love showing my work, but I only publish photos of your tattoo, on this website and on my Instagram, if you give me written permission at the studio. You can withdraw it whenever you like: write to me at hola@nataconsal.com and I will remove the photo from the website and from my Instagram. Withdrawing it does not change what was published while I had your permission.

Who else sees it

Edu

He looks after the technical side of the website. He sees the requests in the admin panel and receives an email notice when one arrives. He does so on my behalf and is committed to keeping them confidential.

Cloudflare

Hosts the website, stores the requests and the images, sends the email notices and runs the anti-bot check (Turnstile).

Google (Gmail)

Where Edu and I receive the notice of your request and from where I reply to you.

Meta (Instagram and WhatsApp)

Only if you choose to talk to me there. Those messages stay in those apps, which have their own privacy policy.

Cloudflare and Google process the data on my behalf and only to provide me with their service. I do not sell your data or give it to anyone, unless the law requires me to.

Data outside the European Union

Cloudflare, Google and Meta are US companies and may process data there. They are certified under the EU-US Data Privacy Framework, which the European Commission recognises as providing adequate protection (Decision of 10 July 2023), and they also use the Commission's standard contractual clauses.

How long I keep it

• Your request, its images and the notices it generates: up to 12 months after the last time we spoke. After that they are deleted automatically from the website, and I delete the emails.
• Backups are rotated: what is deleted disappears from the automatic database copy within 7 days and from the monthly copies within 35 days at most.
• Technical data from the anti-bot check and the website logs: a few days.
• If you get a tattoo with me, the papers you sign at the studio are kept there for as long as health regulations require.
• If you ask me to delete it sooner, I delete it sooner.

Your rights

You can ask me at any time to:

• Show you what data I hold about you and give you a copy.
• Correct it if something is wrong.
• Delete it.
• Stop using it, or use it only for something specific while we sort it out.
• Receive it in a format you can reuse elsewhere (data portability).
• Withdraw permission to publish photos of your tattoo.

Write to me at hola@nataconsal.com, preferably from the email you wrote to me with, so I know it is you. I will reply within a month at most.

If you think I have not handled your data properly, you can complain to the Spanish Data Protection Agency (aepd.es).

How I protect it

Requests and reference images are not public. They can only be seen from the website's admin panel, which requires logging in and which only Edu and I can access. The website is always encrypted.

Cookies

This website does not use advertising or tracking cookies, and does not store anything in your browser to follow you. It only uses technical cookies (the ones listed below), which do not need your consent. That is why it does not ask you to accept anything in order to browse.

Anti-bot check

On the booking page, Cloudflare Turnstile checks that you are not a robot before the form is sent. It uses technical data from your browser only for that, and it is necessary for the form to work securely.

Cloudflare security

If Cloudflare sees unusual traffic, it may set a short-lived technical security cookie (for example __cf_bm or cf_clearance) that is only used to protect the website.

Private panel

The admin panel pages, for Edu and me only, use session cookies to know it is one of us. If you do not enter the panel, you do not receive them.

Language

If you choose a language with the selector (ES, CA, EN), the idioma cookie is stored in your browser to remember your choice. It lasts 30 days. It is a technical personalisation cookie that you ask for by choosing the language: it does not identify you, is not used to track you or for advertising, and is not shared with anyone, so it does not need your consent. You can delete it in your browser settings; if you do, the website will forget your choice.

If I change something

If I change something important in this policy, you will see it here, with the revision date below.

This policy is also available in Catalan and English. If there is any difference between the versions, the Spanish one prevails.