Privacy Policy

Who this policy covers

This policy explains how KM Realism (that's Kacper), working within Onyx Tattoo Studio, collects and uses your personal data when you send an enquiry, book a planning session or tattoo appointment, or simply get in touch. It covers clients and prospective clients only, not Onyx Tattoo Studio's other artists or their own clients.

What data is collected

Contact and enquiry details: your name, email address, phone number, and whatever you tell me about the tattoo you're after (description, placement, size, and any reference images you send).

Booking and appointment details: the dates and times of planning sessions and tattoo appointments, plus payment-related information like deposit amounts and payment method. Full card or bank details are handled by the relevant payment provider directly and never stored here.

Health information: if you book a tattoo appointment, you'll complete a consent and medical history form covering allergies, relevant medical conditions, medications, and anything else needed to tattoo you safely. This counts as 'special category data' under UK GDPR, and it's only ever collected with your explicit consent when you fill in that form.

Communications: a record of emails sent to you, and whether they were delivered, so I can keep track of what you've been told and when.

Why this data is used, and on what legal basis

To review and respond to your enquiry, arrange planning sessions and appointments, and manage your booking: necessary to perform our contract (or to take the steps you've asked for before one is in place).

To send appointment reminders, aftercare check-ins, and other booking-related messages: necessary to perform that same contract.

To safely carry out your tattoo appointment, using the health information from your consent form: this is special category data under UK GDPR, processed only with your explicit consent given when you complete that form.

To keep basic business records (who was tattooed, when, and their consent form): necessary to meet legal obligations, including the conditions of the special-treatments licence held with the London Borough of Ealing (more on this under 'How long data is kept' below).

Where you've asked to be referred to another artist at Onyx Tattoo Studio, your enquiry details are passed to the studio for that purpose only: necessary to take the steps you've asked for towards that referral.

If you've ticked the box to hear from KM Realism by email, your details are used to send occasional promotional offers and birthday rewards, based on your consent, which you can withdraw at any time by getting in touch or using the unsubscribe option in any marketing email. This is entirely separate from the booking-related emails above, which aren't optional in the same way since they're needed to run your appointment.

A first-pass compatibility score is generated automatically from your enquiry details to help sort new enquiries, a legitimate interest in managing enquiry volume fairly and consistently. It's only ever a starting point: a real person (Kacper) reviews it and makes the actual call on whether to accept, decline, or refer your enquiry. It's never used to make that decision on its own.

Who this data is shared with

Your data is only ever shared with the specific outside services that help run the studio, never sold, and never used for advertising. These are Resend (sends emails on the studio's behalf), Google Calendar (keeps the appointment schedule), and Supabase (stores enquiry and booking records). Each handles your data under its own security and data protection terms.

If your enquiry is referred to Onyx Tattoo Studio, your enquiry details go with it so they can follow up with you directly.

As a condition of the special-treatments licence held with the London Borough of Ealing, consent form records, including the medical history and ID information they contain, need to be available for Ealing Council's licensing and environmental health officers to inspect on request.

Enquiries submitted via Meta (Facebook/Instagram) Lead Ads

If you submit an enquiry through a KM Realism Facebook or Instagram lead ad, Meta collects the answers you give in that ad form. This typically includes your name, phone number, email address, and a description of the tattoo you're after, and Meta shares these with KM Realism so the enquiry can be processed.

Once that enquiry reaches KM Realism, it's treated exactly the same as any other enquiry submitted directly through the website: it goes through the same review, planning, booking, and record-keeping process described elsewhere in this policy.

While you're still on Facebook or Instagram filling in the lead ad form, Meta's own collection and handling of your data is governed by Meta's own privacy policy, not this one. You can review that at facebook.com/privacy/policy or instagram.com/legal/privacy.

International data transfers

A few of the services listed above (Resend and Google Calendar in particular, and possibly Supabase depending on how its infrastructure is set up) are based in, or route data through, the United States rather than the UK or EEA. Where that happens it counts as a 'restricted transfer' under UK GDPR, and each provider has its own safeguards for this (such as the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK-US Data Bridge, depending on the provider and when the transfer happens). If you'd like details of the specific safeguard used for any given provider, just ask at kmrealism@gmail.com.

How long data is kept

Consent form records, including the medical history, ID photo, and signature they contain, are kept for a minimum of 3 years, as required by the special-treatments licence held with the London Borough of Ealing, and need to stay available for the council to inspect throughout that period. Because this is a legal requirement rather than a discretionary choice, a request to delete a consent form sooner may need to be declined until the 3 years are up.

Other enquiry, booking, and communication records are kept for as long as needed to provide the service and to maintain a reasonable business record afterwards. If you'd like your data reviewed or deleted, see 'Your rights' below.

Data Retention

Personal data is only ever kept for as long as it's actually needed, and no longer.

Tattoo consent forms, treatment records (including medical history and health information), and booking information are retained for 7 years after your last appointment with KM Realism, unless a longer period is required by law.

If you send an enquiry that doesn't go on to become a booking, that enquiry record is kept for up to 12 months before it's deleted or anonymised.

Once a retention period expires, the relevant data is securely deleted or anonymised so that it can no longer be linked back to you.

Marketing Communications

If you've ticked the marketing checkbox on the enquiry form or the consent form, KM Realism may send you occasional emails about exclusive offers, flash releases, available designs, promotions and the latest updates.

Marketing emails are only ever sent with your consent, or in the narrow circumstances that UK GDPR and the Privacy and Electronic Communications Regulations (PECR) otherwise permit.

You can withdraw marketing consent at any time, either by using the unsubscribe link included in any marketing email or by getting in touch at kmrealism@gmail.com. Withdrawing marketing consent never affects booking-related emails, which aren't optional in the same way since they're needed to run your appointment.

Withdrawing your consent doesn't affect the lawfulness of any marketing email already sent to you before you withdrew it.

Your data is never sold, and is never passed to any third party for their own marketing purposes.

Your rights

Under UK GDPR, you can ask what personal data is held about you, have inaccurate data corrected, ask for it to be deleted, restrict or object to certain processing, and receive a copy of your data in a portable format. Where processing relies on your consent (health information, or marketing emails), you can withdraw that consent at any time, though see the note above about the minimum retention period that applies specifically to consent form records.

To exercise any of these rights, get in touch at kmrealism@gmail.com. If you're not happy with the response, you have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

KM Realism is registered with the ICO as a data controller, registration reference ZC196547.

Cookies

Client-facing pages (the enquiry form, booking pages, consent forms) don't use cookies to track you. A session cookie is used only when studio staff log into the internal dashboard.

Children

This service isn't directed at anyone under 18, and I don't knowingly collect data from anyone under that age.

Changes to this policy

This policy may be updated occasionally as the studio's processes evolve. Any material changes will be reflected here with an updated date.

Contact

Questions about this policy or your data are always welcome at kmrealism@gmail.com.