Data Privacy Policy

Datenschutzerklärung according to GDPR & TDDDG

Last Updated: August 2026

1. Data Controller

The entity responsible for processing your personal data on this website (the “Controller”) under the General Data Protection Regulation (GDPR) and the German Telecommunications-Telemedia Data Protection Act (TDDDG) is:

Aubergine Tattoo
Owner: Craig McGuigan
Address: Anzengruberstr. 12, 12043 Berlin, Germany
Email: auberginetattoo@googlemail.com
Phone: +49 173 8715338
Data Protection Officer: Not applicable pursuant to Art. 37 GDPR and § 38 BDSG

2. Overview

We keep the number of tools we use to a minimum. In short:

Our website itself does not set cookies, local storage, or any tracking technology.
We use Cloudflare to host the site and run its booking, contact, and newsletter functions.
We use Sanity to manage page content (no customer data).
We show a live Instagram feed via the third-party widget Behold.
Our “Book Now” buttons link out to TidyCal, an independent booking service.
Our newsletter sign-up is handled by Brevo.
Our contact form and tattoo consent/medical history form are delivered by email via Resend to our studio inbox.

Each of these is explained in detail below.

3. What Personal Data We Collect & Why

A. Visiting Our Website (Hosting & Security Logs)

Our website is hosted on Cloudflare’s infrastructure. When you visit, Cloudflare’s servers automatically process technical request data transmitted by your browser.

Data Collected: IP address, browser type/version, operating system, referring URL, time and date of request.
Purpose: Delivering the website to you, maintaining network security, preventing abuse (e.g. DDoS attacks), and ensuring fast page loading.
Legal Basis: Legitimate Interest (Art. 6(1)(f) GDPR) in operating a safe and functioning website.
Note on Cookies: We do not set any cookies, local storage, or similar tracking technology of our own on this website. There is currently no cookie consent banner because we do not need visitor consent for anything we control directly — see Section 4.

B. Instagram Feed (Behold)

On our artists’ profile pages, we display a live feed of our recent Instagram posts using a third-party widget provided by Behold (Behold Technologies / behold.so). When that part of the page becomes visible, your browser loads a script directly from Behold’s servers (w.behold.so) and requests the feed content.

Data Collected: Your IP address and standard browser/request data are transmitted to Behold when the widget script and feed load. Behold sources the post content from Instagram; we do not receive or store any personal data about you from this widget ourselves.
Purpose: Showcasing our current tattoo/piercing portfolio directly from Instagram.
Legal Basis: Legitimate Interest (Art. 6(1)(f) GDPR) in presenting our up-to-date portfolio. Because this is a third-party script that loads automatically (not on click), you should also review Behold’s own privacy policy for details on what they collect and how they use it.
You can avoid this by not scrolling to the “Instagram” section of an artist’s page, or by using browser extensions that block third-party scripts.

C. Booking an Appointment or Consultation (TidyCal)

The “Book Now” buttons on our site (including the fixed booking bar) link out to our scheduling page hosted at tidycal.com/team/auberginetattoo. We do not embed this booking form on our own site.

Data Collected: We do not collect or process your booking details (name, email, phone, appointment time) ourselves. Once you click through, TidyCal collects this data directly, acting as an independent data controller under its own privacy policy.
Purpose: Scheduling tattoo and piercing appointments/consultations.
What We Recommend: Please review TidyCal’s privacy policy before booking, since we do not control how TidyCal processes your data.

You can subscribe to our newsletter via the sign-up form on our homepage, or via the newsletter opt-in checkbox on our tattoo consent form.

Data Collected: Email address, first name, last name.
Purpose: Sending you news, updates, and promotional content from Aubergine Tattoo.
Process: We use a double opt-in process — after signing up, you receive a confirmation email and are only added to our active mailing list once you confirm. This is handled by an automation inside our email marketing platform, Brevo (Sendinblue SAS).
Legal Basis: Consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You can withdraw consent at any time by unsubscribing via the link in any newsletter email, or by contacting us directly.
Processor: Brevo (Sendinblue SAS), 7 rue de Madrid, 75008 Paris, France. Brevo may track email opens and link clicks within the newsletter itself to measure engagement.

E. Contact Form (Resend)

Our “Find Us” page includes a contact form.

Data Collected: Name, email address, and the message you write.
Purpose: Responding to your inquiry.
Process: Submissions are sent by email, via the transactional email service Resend, directly to our studio inbox. We do not store submissions in a separate database.
Legal Basis: Performance of a contract / pre-contractual steps (Art. 6(1)(b) GDPR) where your inquiry relates to a potential booking, otherwise Legitimate Interest (Art. 6(1)(f) GDPR) in responding to general inquiries.

Before your appointment, we ask you to complete an online consent form for either a tattoo or a piercing. Both forms collect significantly more data than the rest of our website, including health data, which is a “special category” of personal data under Art. 9 GDPR.

Identity & Contact Data: Full name, date of birth, home address, email address, phone number, and an optional pronouns field. The tattoo form additionally asks for an emergency contact name and phone number.
Appointment Data: Date (and, on the piercing form, time) of signing, your typed signature. The tattoo form also records the artist’s name and the body part being tattooed; the piercing form records the body part/piercing requested and the piercing price.
Health Data (Special Category, Art. 9 GDPR) — Tattoo Form: Allergies (latex, adhesives, metals, soaps, cosmetics, antibiotics), prior antibiotic prescriptions, other medical or skin conditions, use of blood thinners/anticoagulants, medication taken in the last 7 days, alcohol/drug use in the last 24 hours, tendency toward keloid scarring, heart valve disease, pregnancy/breastfeeding status, and any existing scars in the area to be tattooed.
Health Data (Special Category, Art. 9 GDPR) — Piercing Form: Whether you have eaten/had enough to drink, current alcohol/drug/medication influence, blood clotting disorders or blood-thinning medication, diabetes, immune-system conditions or treatment, allergies (metals, latex, disinfectants, and similar), epilepsy or fainting/seizure conditions, cardiovascular or other pre-existing conditions, pregnancy/breastfeeding status, and any other health limitations or medications relevant to the piercing, plus any optional free-text details you provide.
Minors (Piercing Form Only): If you indicate that the person getting pierced is a minor, we additionally collect the parent’s/legal guardian’s full name, date of birth, consent confirmation, and typed signature.
Marketing Consent (optional): Whether you tick the separate newsletter opt-in checkbox on either form.

Purpose: To assess whether it is safe to proceed with your tattoo or piercing, to obtain your informed consent to the risks involved (including, for the piercing form, an explicit liability waiver and photo/portfolio release equivalent to the tattoo form’s), and to keep a record fulfilling our duty of care as a studio.

Legal Basis:

For the health-related data specifically: your explicit consent (Art. 9(2)(a) GDPR), given when you tick the relevant agreement checkboxes and submit the form.
For the remaining contact, appointment, and waiver data (including any guardian data for minors on the piercing form): Performance of a contract / pre-contractual steps (Art. 6(1)(b) GDPR) and our legitimate interest in maintaining accurate liability and safety records (Art. 6(1)(f) GDPR).
For the optional newsletter opt-in on either form: Consent (Art. 6(1)(a) GDPR), processed the same way as described in Section D.

Recipients: The completed form is sent by email, via Resend, directly to our studio inbox. It is only accessed by the studio owner and the treating artist/piercer. If you tick the newsletter opt-in box, your name and email (but not your health data) are additionally sent to Brevo as described in Section D.

Withdrawing Consent: You may withdraw your consent to the health-data processing at any time for the future by contacting us, though this does not affect the lawfulness of processing already carried out, and we may still need to retain a record of the waiver/consent already given for liability and statutory retention purposes (see Section 6).

G. Where Your Data Is Stored

Form submissions delivered by Resend (Section E and F) and TidyCal’s booking notifications are ultimately received in our studio’s email inbox, which is a Google (Gmail) account. Google therefore also processes and stores this data on our behalf as part of normal email delivery and storage.

4. Cookies & Similar Technologies

Our website does not set cookies, local storage, or any comparable tracking technology of its own, and we do not use any analytics or advertising tracking. Because of this, no cookie consent banner is currently shown.

The one exception is the Behold Instagram widget described in Section 3.B: it is a third-party script and may set its own cookies or use browser storage outside of our control once it loads. Please refer to Behold’s privacy policy for details.

If we add any analytics, advertising, or additional tracking tools in the future, we will update this policy and implement a consent mechanism before doing so.

5. Third-Party Service Providers

We do not sell your personal data. The table below lists everyone who processes personal data on our behalf, or who independently collects data when you interact with a link on our site:

Provider	Role	Purpose	Data Handled
Cloudflare, Inc.	Processor	Website hosting, CDN, security, and running our contact/consent-form/newsletter functions	IP address, technical logs, form data in transit
Sanity AS	Processor	Content Management System (CMS) for site content (portfolio, artist bios, Instagram widget IDs)	No customer personal data
Behold (behold.so)	Processor / independent service	Instagram feed widget on artist pages	IP address and browser data of visitors who load the widget
TidyCal	Independent Controller	Appointment booking	Name, email, phone, booking time (collected by TidyCal directly, not by us)
Brevo (Sendinblue SAS)	Processor	Newsletter sign-up and delivery	Email address, first/last name
Resend, Inc.	Processor	Email delivery for the contact form and consent forms	Contact form: name, email, message. Consent forms: full form contents, including health data
Google LLC	Processor	Hosting of our studio email inbox, where form submissions are received	Contents of received emails, including health data from the consent forms

6. International Data Transfers

Cloudflare, Resend, and Google are US-based providers. Where personal data is transferred to the United States, we rely on the EU-U.S. Data Privacy Framework (DPF) adequacy decision under Art. 45 GDPR where the provider participates in it, supplemented by Standard Contractual Clauses (SCCs) under Art. 46 GDPR. Sanity (Norway) and Brevo (France) process data within the European Economic Area. For Behold and TidyCal, please refer to their respective privacy policies for details on data location and international transfer safeguards, as we do not control their infrastructure.

7. How Long We Keep Your Data

Tattoo & Piercing Consent Forms: Retained for as long as necessary to defend against potential liability or personal-injury claims, in addition to statutory German tax and commercial retention periods (up to 10 years for invoice/financial records under § 147 AO / § 257 HGB). Given the health data and liability waiver involved, we retain these records for a longer period as a matter of prudent risk management; please contact us if you would like specifics or to request earlier deletion where legally possible.
Contact Form Submissions: Retained only as long as necessary to handle your inquiry, then deleted, unless a longer retention is required to comply with a legal obligation.
Newsletter Data (Brevo): Retained until you unsubscribe or request deletion.
Technical Server Logs (Cloudflare): Automatically erased or anonymized within 30 days.

Under the GDPR, you have the following rights:

Right of Access (Art. 15): Request a copy of all personal data held about you.
Right to Rectification (Art. 16): Request correction of inaccurate personal data.
Right to Erasure (Art. 17): Request deletion of your data (“Right to be Forgotten”), provided statutory retention rules or liability record-keeping needs do not prevent it.
Right to Restrict Processing (Art. 18): Request restriction of data processing under certain conditions.
Right to Data Portability (Art. 20): Receive your personal data in a structured, standard digital format.
Right to Object (Art. 21): Object to data processing carried out under the legal basis of legitimate interest, including the Instagram widget described in Section 3.B.
Right to Withdraw Consent (Art. 7(3) & Art. 9(2)(a)): Withdraw consent for the newsletter or for health-data processing at any time with future effect.

To exercise any of these rights, contact us via email at: auberginetattoo@googlemail.com

9. Supervisory Authority (Right to Lodge a Complaint)

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a regulatory authority. In Berlin, the competent authority is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
Web: www.datenschutz-berlin.de