Privacy Policy — Naomi Garcia Tattoo
Last updated: 28/09/2026
This policy explains how Naomi Garcia Tattoo (“we”, “us”, “our”) collects, uses and protects your personal data when you visit this website, make an enquiry, book an appointment, or sign a consent form. It is written to comply with the UK GDPR and the Data Protection Act 2018.
1. Who we are
Naomi Garcia Tattoo is a tattoo artist operating from:
Other World Studio
Unit 1, wellington Lane, BS6 5PY
Contact for privacy matters: hola@naomigarciatattoo.co.uk
This is the data controller for the personal data described in this policy.
2. What personal data we collect
Depending on how you use this site, we may collect:
- Contact / enquiry form: name, email address, and the message or reference you send us.
- Custom tattoo form: name, email, phone number, your tattoo idea, reference images, placement and size details.
- Booking form (via our online booking system): name, email, phone number, appointment date/time, service selected, and deposit payment confirmation.
- Consent form (before your appointment): date of birth or age confirmation, health and medical information relevant to tattooing (allergies, skin conditions, medication, pregnancy status), and your signature.
- Newsletter sign-up: your email address, if you choose to give it to us.
- Payment information: we do not store your card details. Payments and deposits are processed directly by Stripe and/or PayPal, who each act as an independent data controller for the payment data they handle.
- Technical/analytics data: standard website usage data (see our separate Cookies Policy for full details).
3. Health information (special category data)
The consent form collects health-related information because it is necessary to assess whether it is safe to tattoo you. This is “special category data” under UK GDPR, and we only collect it with your explicit consent, given when you complete and sign the consent form. You can withdraw this consent at any time by contacting us, though this may affect our ability to go ahead with or complete a tattoo appointment.
4. Why we use your data, and our legal basis
| Purpose | Legal basis |
|---|---|
| Responding to enquiries and custom tattoo requests | Legitimate interest (running our business) / steps taken at your request before entering a contract |
| Processing bookings and deposits | Performance of a contract with you |
| Assessing health and safety before tattooing | Explicit consent (special category data) |
| Verifying age | Legal obligation (tattooing under-18s is prohibited by law) |
| Sending newsletter updates | Consent |
| Website analytics | Consent / legitimate interest, as set out in our Cookies Policy |
5. About our newsletter sign-up
At present, our newsletter sign-up only asks for your email address and does not yet include a separate consent checkbox or description of what you’ll receive. We are in the process of moving this over to a dedicated email platform (Brevo), at which point sign-up will include clear opt-in consent, a description of what you’re subscribing to, and an easy way to unsubscribe from every email. Until then, if you’ve given us your email for the newsletter, you can ask us to remove it at any time by contacting us — see Section 9.
6. Who we share your data with
We do not sell your personal data. We share it only where necessary, with:
- Stripe / PayPal — to process deposit and appointment payments.
- Our website hosting provider — to store website and booking data securely.
- Brevo — for sending email updates to subscribers who have opted in.
- Google Analytics — for website traffic and usage statistics (see our Cookies Policy).
We do not use any other third-party services to process your personal data at this time.
7. International data transfers
Some of the providers above (for example Stripe and PayPal) may process data outside the UK, including in the United States, under their own data protection safeguards (such as Standard Contractual Clauses). Brevo, when adopted, is based in the EU. Where data is transferred outside the UK, we rely on the safeguards these providers have in place.
8. How long we keep your data
- Consent form data (health information, ID/age confirmation, signature): kept for at least 6 years from your appointment date, in line with standard industry practice for tattoo studios and typical UK limitation periods for potential claims.
- Booking and payment records: kept for as long as needed for accounting and legal purposes.
- Enquiry / custom form submissions that don’t lead to a booking: kept for a reasonable period to allow follow-up, then deleted.
- Newsletter email addresses: kept until you unsubscribe or ask us to remove them.
9. Your rights
Under UK GDPR, you have the right to:
- Ask for a copy of the personal data we hold about you
- Ask us to correct inaccurate data
- Ask us to delete your data (subject to our legal/record-keeping obligations, such as retaining consent forms)
- Ask us to restrict or object to certain processing
- Withdraw consent at any time, where consent is our basis for processing
- Request your data in a portable format, where applicable
- Complain to the Information Commissioner’s Office (ICO) at ico.org.uk if you believe your data has been mishandled
To exercise any of these rights, contact us at hola@naomigarciatattoo.co.uk
10. Under-18s
We do not knowingly collect personal data from anyone under 18. Tattooing anyone under 18 is illegal in the UK, and age verification is part of our booking process.
11. Security
We take reasonable technical and organisational steps to protect your personal data, including secure hosting and restricted access to consent form records.
12. Changes to this policy
We may update this policy from time to time. The “last updated” date at the top will reflect any changes.
13. Cookies
This policy covers personal data generally. For details on cookies and tracking technologies used on this site, see our separate Cookies Policy.