Privacy Policy

Who this policy covers

This privacy policy explains how KM Realism (Kacper), operating within Onyx Tattoo Studio, collects and uses your personal data when you submit an enquiry, book a planning session or tattoo appointment, or otherwise get in touch. It applies to clients and prospective clients, not to Onyx Tattoo Studio's other artists or their clients.

What data is collected

Contact and enquiry details: your name, email address, phone number, and the details you provide about the tattoo you're interested in (description, placement, size, and any reference images).

Booking and appointment details: dates and times of planning sessions and tattoo appointments, and payment-related information such as deposit amounts and payment method (full card/bank details are handled by the relevant payment provider, not stored here).

Health information: if you book a tattoo appointment, you'll be asked to complete a consent and medical history form covering allergies, relevant medical conditions, medications, and other health information needed to tattoo you safely. This is 'special category data' under UK GDPR and is only collected with your explicit consent, given when you complete that form.

Communications: records of emails sent to you (and whether they were delivered), so the studio can keep track of what you've been told and when.

Why this data is used, and on what legal basis

To assess and respond to your enquiry, arrange planning sessions and appointments, and manage bookings — necessary to perform the contract between us (or to take steps at your request before entering into one).

To send appointment reminders, aftercare check-ins, and other service-related communications — necessary to perform that same contract.

To safely carry out your tattoo appointment, using the health information you provide on your consent form — this is 'special category data' under UK GDPR, and is only processed with your explicit consent, given when you complete that form.

To keep basic business records (e.g. who was tattooed, when, and their consent form) — necessary to comply with our legal obligations, including the conditions of the special-treatments licence the studio holds with the London Borough of Ealing (see 'How long data is kept' below).

Where you've asked to be referred to another artist at Onyx Tattoo Studio, your enquiry details are shared with the studio for that purpose only — necessary to perform the contract you've asked us to take steps toward (arranging that referral).

A first-pass compatibility score is generated automatically from your enquiry details to help triage new enquiries — legitimate interest in managing enquiry volume fairly and consistently. This score is only ever a starting point: a person (Kacper) reviews it and makes the actual decision to accept, decline, or refer your enquiry — it's never used to make that decision on its own.

Who this data is shared with

Your data is only shared with the specific outside services needed to run the studio, not sold or used for advertising: Resend (sends emails on the studio's behalf), Google Calendar (schedules appointments), and Supabase (stores enquiry and booking records). Each of these providers processes data under their own security and data protection terms.

If your enquiry is referred to Onyx Tattoo Studio, your enquiry details are shared with them so they can follow up with you directly.

As a condition of the special-treatments licence the studio holds with the London Borough of Ealing, consent form records (including the medical history and ID information they contain) must be available for inspection by Ealing Council's licensing/environmental health officers on request.

International data transfers

Some of the outside services listed above — Resend and Google Calendar in particular, and potentially Supabase depending on how its infrastructure is configured — are based in, or route data through, the United States rather than the UK or EEA. Where that happens, it's a 'restricted transfer' under UK GDPR, and each of these providers has its own safeguards in place for this (such as the UK's International Data Transfer Addendum to the EU Standard Contractual Clauses, or the UK-US Data Bridge, depending on the provider and the time of transfer). You can ask for details of the specific safeguard relied on for any given provider by contacting kmrealism@gmail.com.

How long data is kept

Consent form records (including the medical history, ID photo, and signature they contain) are kept for a minimum of 3 years, as required by the conditions of the special-treatments licence held with the London Borough of Ealing, and must remain available for inspection by the council throughout that period. Because this is a legal retention requirement rather than a discretionary choice, a request to delete a consent form record sooner may need to be declined until the 3-year period has passed.

Other enquiry, booking, and communication records are kept for as long as needed to provide the service and to maintain a reasonable business record afterwards. If you'd like your data reviewed or deleted, see 'Your rights' below.

Your rights

Under UK GDPR, you have the right to ask what personal data is held about you, to have inaccurate data corrected, to ask for it to be deleted, to restrict or object to certain processing, and to receive a copy of your data in a portable format. Where processing relies on your consent (such as health information), you can withdraw that consent at any time — though see the note above about the minimum retention period that applies to consent form records specifically.

To exercise any of these rights, contact kmrealism@gmail.com. If you're not satisfied with the response, you have the right to complain to the UK Information Commissioner's Office (ico.org.uk).

Cookies

Client-facing pages (enquiry form, booking pages, consent forms) don't use cookies to track you. A session cookie is used only for studio staff logging into the internal dashboard.

Children

This service is not directed at, and does not knowingly collect data from, anyone under 18.

Changes to this policy

This policy may be updated from time to time as the studio's processes change. Material changes will be reflected here with an updated date.

Contact

Questions about this policy or your data can be sent to kmrealism@gmail.com.