Effective from 14 September 2026

Privacy policy

This policy explains what personal data we process when you visit stintattoostudio.com, send us a booking enquiry or contact us in another way, and what rights you have.

1. Who processes your data

The data controller is Liudmyla Yemelianova, a self-employed sole trader, company ID (IČO) 23110716, registered at Karlínské náměstí 170/3, 186 00 Prague 8 – Karlín, Czech Republic, who runs STIN Tattoo Studio, Míšeňská 73/5, 118 00 Prague 1 – Malá Strana.

Data protection

[email protected]

Studio

[email protected] · +420 724 266 125

We have not appointed a data protection officer, as we are not required to.

2. What data we process and why

Booking enquiries

Data

Name, email, phone number or Instagram handle, chosen tattoo style, a description of your idea, and anything else you send us through the form, by email, by phone or on Instagram.

Purpose

Replying to your enquiry and arranging a consultation, design and appointment.

Legal basis

Steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).

Retention

If no appointment follows, we delete the data no later than 12 months after our last contact. If you become a client, we keep it for as long as we work together, and tax and accounting records for as long as the law requires.

Please don't include health information in the form. We discuss health questions, such as allergies, in person at the studio.

Photos of your tattoo

Data

Photos and videos of the finished tattoo.

Purpose

Showing our work on the website, on Instagram and in studio promotion.

Legal basis

Your consent (Art. 6(1)(a) GDPR), given in the form or at the studio.

Retention

Until you withdraw consent. We then remove the photos from the website and our profiles; we cannot control copies other people have already shared.

News and available dates

Data

Email address or phone number.

Purpose

Sending news, offers and available appointment dates by email or SMS.

Legal basis

Your consent (Art. 6(1)(a) GDPR).

Retention

Until you withdraw consent, and no longer than 3 years after our last contact.

Website analytics

Data

Pages visited, clicks, device and browser type, approximate location derived from your IP address, and online identifiers stored in cookies. Microsoft Clarity also records how you move around a page (session recordings and heatmaps) and, by default, masks sensitive information typed into forms.

Purpose

Understanding how the website is used and which pages lead to bookings, so we can improve it.

Legal basis

Your consent in the cookie banner (Art. 6(1)(a) GDPR and Section 89(3) of Czech Act No. 127/2005 Coll., on Electronic Communications).

Retention

Google Analytics up to 14 months; Microsoft Clarity up to 13 months (session recordings 30 days).

Until you give consent, Google Analytics stores no cookies or identifiers and receives only limited signals that are not linked to your device (Google Consent Mode). Microsoft Clarity does not run without consent.

Running and securing the website

Data

IP address, browser details and details of the request to the server.

Purpose

Delivering the website, protecting it against attacks and automated traffic, and forwarding form messages.

Legal basis

Our legitimate interest in running the website securely and reliably (Art. 6(1)(f) GDPR).

Retention

Technical logs are kept briefly, according to our provider Cloudflare's settings.

Google Maps

On the home page you can display a Google Maps map to see where the studio is. The map only loads when you click “Show map”. Only then is your IP address sent to Google, which may use its own cookies under its privacy policy.

3. Who we share data with

We don't sell your data. These processors and service providers help us handle it:

• Cloudflare, Inc. (USA) – website hosting, security and forwarding of form messages.
• Google Ireland Limited / Google LLC – Google Analytics, Google Sheets (enquiry records), Gmail and Google Maps.
• Microsoft Corporation (USA) – Microsoft Clarity.
• Telegram FZ-LLC (United Arab Emirates) – notifications of new enquiries in the studio's messaging app.
• Meta Platforms Ireland Limited – if you message us on Instagram.

We may also share data with public authorities where the law requires it.

4. Transfers outside the EU

Cloudflare, Google and Microsoft are certified under the EU-U.S. Data Privacy Framework, so transfers of data to these companies in the USA are covered by the European Commission's adequacy decision.

Telegram is based in the United Arab Emirates, for which no such decision exists. We send your enquiry message there because it is necessary to handle your request (Art. 49(1)(b) GDPR). If you would rather we didn't, contact us directly by email or phone instead.

5. Cookies and browser storage

We always store what is strictly necessary, and analytics only with your consent. You can change your cookie settings at any time.

stin_consent_v2 and stin-lang are kept in your browser's local storage (localStorage), not in cookies. If you decline, we delete the Google Analytics and Clarity cookies from your browser.

6. Your rights

You have the right to:

• access your data and get a copy of it,
• have inaccurate data corrected,
• have your data erased,
• restrict processing,
• receive your data in a machine-readable format (portability),
• object to processing based on legitimate interest,
• withdraw consent at any time, without affecting processing carried out before you withdrew it.

Just write to [email protected]. We reply without undue delay, and within one month at the latest.

You can also lodge a complaint with the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 727/27, 170 00 Prague 7, uoou.gov.cz.

7. Automated decision-making

We don't use automated decision-making or profiling that has legal or similarly significant effects on you.

8. Changes to this policy

We may update this policy, for example when we change the services we use. The current version, with its effective date, is always on this page.