[PLACEHOLDER: Draft. Have this checked, or replace it with text from a German legal-text generator or a lawyer, before the site goes live.]
Who is responsible
The controller under the GDPR (DSGVO) is:
Stacey Kenny, working as Inked Xtacey
[PLACEHOLDER: street and house number], 12555 Berlin, Germany
Email: studio (at) inkedxtacey.com
Visiting this site
When you open a page, the hosting provider's servers record technical data: your IP address, the date and time, the page requested, and your browser and operating system. This is needed to deliver the site and keep it secure (Art. 6(1)(f) GDPR).
Hosting provider: Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA (Cloudflare Pages). Cloudflare is certified under the EU–US Data Privacy Framework, and its data processing addendum is part of its terms of service. [PLACEHOLDER: how long Cloudflare keeps these logs]
No tracking
This site sets no cookies and uses no analytics, advertising or tracking tools. The fonts are stored on this site itself, so opening a page sends nothing to Google or any other font service.
If you switch between Day and Night, that choice is saved in your own browser (local storage, key xt-theme) so the site remembers it. It never leaves your device. Saving it is strictly necessary for the function you asked for (§ 25(2) no. 2 TDDDG). You can delete it at any time by clearing this site's data in your browser.
The waitlist and contact forms
The waitlist asks for your name, age, email address, Instagram handle (optional), placement, scale, the design you are interested in, and a description of your idea. Age is asked because no one under eighteen is tattooed. The contact form asks for your name, email address, subject and message.
This is used only to read and answer your request and, for the waitlist, to prepare a possible tattoo appointment (Art. 6(1)(b) GDPR). Messages sent through the contact form are answered on the basis of a legitimate interest in replying (Art. 6(1)(f) GDPR).
Form service: [PLACEHOLDER: name and address of the form provider, e.g. Formspree; where it stores data; for providers outside the EU, the safeguard used, e.g. EU–US Data Privacy Framework or standard contractual clauses]
How long it is kept: [PLACEHOLDER: e.g. deleted when the request is closed, or after X months if no appointment follows. Records of tattoo appointments may need to be kept longer for tax or health reasons; state those periods.]
Writing by email
If you write by email, your address and message are used only to answer you (Art. 6(1)(b) or (f) GDPR) and are deleted when no longer needed, unless a legal retention period applies.
Email provider: Apple iCloud Mail (Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland).
This site links to Instagram but does not embed it. No data goes to Instagram unless you follow the link. Once you are on Instagram, Meta's privacy policy applies.
Your rights
You have the right to access the data held about you, to have it corrected or deleted, to restrict its use, to receive it in a portable format, and to object to its use (Art. 15–21 GDPR). Where you gave consent, you can withdraw it at any time. Write to the email address above.
You may also complain to a data protection supervisory authority, for example the one responsible here: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin.
Last updated: [PLACEHOLDER: date]