What data of yours we process, what for, on what legal basis, who we share it with, and what you can require of us. Written under Regulation (EU) 2016/679 (GDPR) and Spanish Organic Act 3/2018.
Data controller
[pendiente de alta fiscal], tax ID [pendiente de alta fiscal], address [pendiente de alta fiscal]. For anything about your data, including exercising your rights, write to info@victorchil.com.
What we process and why
We ask for nothing we do not need. This is all of it, purpose by purpose:
| Purpose | Data | Legal basis | How long we keep it |
|---|---|---|---|
| Handling and shipping your shop order | Name, email, phone and delivery address; order details | Performance of the contract (art. 6.1.b) | 6 years, for accounting and tax obligations |
| Handling your appointment request and communicating with you | Name, email, phone, description and reference images of the tattoo, body area, city | Performance of the contract and pre-contractual steps (art. 6.1.b) | For the duration of the relationship and 6 years from the last appointment |
| Informed consent and health questionnaire before tattooing | Full name, ID document, date of birth, health answers, handwritten signature, date, IP address and browser | Explicit consent for health data (art. 9.2.a) and legal obligation under tattoo health regulations | As long as health regulations require, minimum 5 years |
| Health traceability of the materials used | Ink and needle brand and batch, linked to your session | Legal obligation (art. 6.1.c) | As long as health regulations require |
| Taking payment and preventing fraud | Amount, payment reference and data collected by the gateway | Performance of the contract and legitimate interest in preventing fraud | 6 years |
| Sending you the newsletter | Email and language | Your consent (art. 6.1.a) | Until you unsubscribe |
| Customer record and tags to organise the studio | Name, email, phone, country and city, internal notes | Legitimate interest in managing our customer relationships | For the duration of the relationship |
| Publishing photos of your tattoo on social media | Photographs of the finished work | Your consent, asked for separately and refusable without losing the service | Until you withdraw it |
Your health data
The questionnaire before your session includes health data, which the GDPR treats as a special category and protects more strictly. We process it for two reasons, and only those two: because it is essential to tattoo you safely, and because tattoo health regulations require us to collect it.
It is never used for marketing, never combined with your commercial customer record, never shared with anyone except at the request of the health authority, and only accessible to studio staff involved in your session.
Who we share it with
We neither sell nor give your data to anyone. To operate, we rely on the following providers, who process it on our behalf, under contract and on our instructions:
| Provider | Purpose | Where it processes data |
|---|---|---|
| Stripe Payments Europe, Ltd. | Processing payments | Ireland, with transfers to the USA |
| Resend | Sending emails | USA |
| Twilio | Sending SMS for admin two-factor authentication | USA |
| Vercel | Hosting the site | USA |
| Neon | Database | USA (us-east-1) |
| Amazon Web Services (S3) | Storing images and signatures | European Union (Stockholm) |
| OpenStreetMap / Nominatim | Studio location maps | European Union — coordinates only, no personal data |
We also disclose data to public authorities where a rule obliges us to: the tax authority, the health authority or the courts.
Transfers outside the European Union
Five of the providers above process data in the United States. Those transfers are covered by the EU-US Data Privacy Framework, to which they adhere, and by the standard contractual clauses approved by the European Commission, which apply as an additional safeguard.
The health data from the informed consent form, and the signatures, are stored in the European Union.
What you can require of us
- Access the data we hold about you and obtain a copy.
- Rectify anything that is inaccurate.
- Erase it, where it is no longer needed and no law obliges us to keep it.
- Restrict or object to its processing, including processing based on our legitimate interest.
- Receive it in a structured, commonly used format, or ask us to send it to another controller.
- Withdraw your consent at any time, without affecting processing carried out beforehand.
To exercise any of these, write to info@victorchil.com saying which one. We will reply within one month. It is free. We may ask you to prove your identity, purely to make sure we do not hand your data to someone else.
If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (www.aepd.es) at no cost.
Unsubscribing from the newsletter
Every message we send carries a one-click unsubscribe link, with no sign-in and no explanation required. Once you unsubscribe we stop writing to you immediately; we keep the record of the unsubscription precisely so that we do not write to you again by mistake.
Minors
We do not tattoo people under eighteen, and neither the shop nor the booking system is aimed at minors. We do not knowingly collect minors' data; if we find that we have, we delete it.
Security
We apply technical and organisational measures to protect your data: encryption in transit, passwords stored using secure derivation functions, multi-step verification for staff access to the management panel, and access limited to those who need it for their work. If a breach nonetheless occurred that posed a risk to your rights, we would tell you and notify the supervisory authority.
This is a translation for your convenience. The Spanish version is the reference text and prevails in the event of any discrepancy.