Privacy Policy

1. Data controller

Data submitted through badass-tattoo.ro is processed by the operator identified in the “Operator details” section at the end of this page.

2. Forms and flows covered

This policy covers the Tattoo form, Piercing form, recommendation request, Timișoara interest form, the course form that remains on the website, and communication by email, phone or WhatsApp.

3. Data the system may collect

Depending on the form, this may include: name, phone, email, preferred channel, service, location, requested artist, style, colour direction, body placement, size, project type, description, preferred period, optional budget, Piercing service, client age, jewellery option and submitted messages.

The system may also store the source page, language, referrer, UTM parameters, submission date and consent time. The IP address is used temporarily for anti-abuse protection and rate limiting; it is not stored as a lead field.

4. Photographs and uploads

Forms may receive reference photographs, body-area photographs or images of an existing tattoo. Files are validated, stored in a protected location outside the public document root and may be downloaded only by authorised WordPress users. Uploads are not published automatically.

5. Leads, notes and history

The request is saved as a private WordPress lead. The team may add a status, artist recommendation and internal notes needed to manage the enquiry. Statuses, notes, routing information and notification results are not public.

6. Purposes and legal bases

Data is used to reply, assess the project, recommend a location or artist, manage the appointment, provide the service, record consent, prevent abuse and meet legal obligations. Legal bases may include pre-contractual steps, performance of a contract, legal obligations, legitimate interest and consent, as applicable.

7. Who may access the data

Access is limited to authorised Badass team members, administrative staff and routing recipients required for the selected location or service. Data may be shared with technical hosting, email or maintenance providers and with authorities where required by law. Data is not sold.

8. Email and WhatsApp

Replies may be sent through the selected channel. If the user continues on WhatsApp, communication is also processed under WhatsApp/Meta rules. The WhatsApp link opens only following a user action.

9. Retention

Data is retained as long as needed to assess the enquiry, schedule and provide the service, communicate, meet legal obligations and defend rights. Optional communications stop when consent is withdrawn or the purpose no longer exists. A single internal deletion schedule for every lead is not currently configured and must be validated by the operator; deletion may be requested where the legal conditions are met.

10. Data subject rights

You may request access, rectification, erasure, restriction, objection, portability where applicable and withdrawal of consent. Details and the request channel are provided on the “GDPR Rights” page.

11. Security and updates

We use reasonable technical and organisational measures, including private leads, protected uploads, nonce validation, a honeypot and rate limiting. No internet transmission can be guaranteed absolutely secure. This policy is updated when flows, providers or legal requirements change.