TATERKAINKGDPR
Privacy Policy
Controller: Tereza Sobotková, a Czech self-employed natural person, business ID No. 08548200, registered address Skalice u České Lípy 511, 471 17 Skalice u České Lípy, Taterka Ink brand, not registered for VAT. Contact: booking@taterkaink.com.
What we process, why and for how long
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Account email, name, phone, form of address, profile image | account management | contract; legitimate interest for security | account lifetime |
| Booking contact details, design, size, placement, budget, appointment, history | preparing and providing the service | pre-contractual steps and contract | during the relationship and generally 3 years afterwards; tax records as required |
| Uploads references and body-area images | design and tattoo performance | contract; consent for optional body image | through performance, then no longer than 90 days; cover-up images with separate consent until its withdrawal |
| Payments amount, status and bank-transfer identifier | deposit/payment and accounting | contract and legal obligation | statutory accounting and tax periods |
| Technical data IP, time, browser, device, security log | operation and security | legitimate interest; analytics only with consent | necessary period under settings |
| Newsletter email, status, time, source and wording version | news and released appointments | consent | until withdrawal; evidence retained proportionately for legal defence |
Body photographs
A photograph may indirectly reveal sensitive data. Upload is optional and the image may instead be shown in the studio. Do not include a face, intimate areas or medical documents. If it nevertheless contains special-category data, it will be processed only with explicit consent for the specific booking, withdrawable for future processing.
Recipients and transfers
Access is limited to Taterka and necessary hosting, database/storage, authentication and email providers. Identified services: OpenAI Sites / Cloudflare infrastructure, Supabase, Resend and FORPSI. Payments are not processed by the website; the deposit is paid by bank transfer using the displayed QR code. Any transfer outside the EEA must use a GDPR-compliant mechanism.
Your rights
You may request access, correction, erasure, restriction and portability, object and withdraw consent. You may complain to the Czech Data Protection Authority. Required booking data is necessary to provide the service. No solely automated decision-making with legal effects is used.