PRIVACY POLICY

INTRODUCTION

Nate D Tattoo ("we", "us", "our") is the data controller responsible for the personal data you provide through this website (natedtattoo.co.uk). We are committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. This policy explains what data we collect, why we collect it, how long we keep it, and the rights you have over it.

DATA WE COLLECT

We only collect the personal data you voluntarily provide when you submit a booking enquiry through our contact form. This includes:

• —Your name and email address (required to respond to your enquiry)
• —Your phone number (optional, for appointment coordination)
• —Your preferred location, tattoo idea, placement, approximate size and preferred days (to understand your requirements)
• —Any additional information you choose to include in your message
• —A reference image you choose to upload (stored privately; only you and the artist can access it)
• —Your IP address, collected automatically and used solely for abuse and rate-limit protection — never shown publicly or shared

ANONYMOUS USAGE DATA

We use Google Analytics to understand how visitors use this site. This collects anonymous, aggregated data such as page views and general location. It does not identify you personally. You can opt out of analytics tracking through your browser settings or by disabling cookies.

WHY WE COLLECT YOUR DATA

Our lawful basis for processing your personal data is your consent (UK GDPR Article 6(1)(a)) — given when you submit the enquiry form — and our legitimate interest (UK GDPR Article 6(1)(f)) in responding to your request and managing potential appointments. We process your data for the following purposes:

• —To respond to your booking enquiry and discuss your tattoo requirements
• —To arrange and manage appointments and consultations
• —To maintain records of client communications for the duration of the enquiry
• —To prevent spam, abuse and fraudulent submissions (IP-based rate limiting)

WHO WE SHARE YOUR DATA WITH

We do not sell, rent or trade your personal data. Your data is only shared with:

• —Our email service provider, to deliver booking enquiry notifications to the artist
• —Our hosting and storage provider (Base44), where enquiry records and any uploaded reference images are stored securely
• —Google Analytics, which receives anonymous, aggregated usage data only

HOW LONG WE KEEP YOUR DATA

We retain booking enquiry records only for as long as necessary to fulfil the purpose for which they were collected. Enquiries that are confirmed or declined are automatically deleted after 30 days. Enquiries that lead to a completed appointment are kept for the duration of the client relationship and then securely removed. You may request early deletion of your data at any time (see Your Rights below).

INTERNATIONAL DATA TRANSFERS

Some of our service providers (such as our hosting platform and analytics provider) may process data outside the UK. Where this occurs, appropriate safeguards such as UK International Data Transfer Agreements or recognised adequacy decisions are in place to ensure your data is protected to UK GDPR standards.

YOUR RIGHTS

Under UK GDPR you have the following rights regarding your personal data:

• —The right to access — you can ask what data we hold about you
• —The right to rectification — you can ask us to correct inaccurate or incomplete data
• —The right to erasure — you can ask us to delete your data (the "right to be forgotten")
• —The right to restrict processing — you can ask us to limit how we use your data
• —The right to data portability — you can request a copy of your data in a structured format
• —The right to object — you can object to processing based on legitimate interests
• —The right to withdraw consent — you can withdraw consent at any time without affecting processing already carried out

HOW TO EXERCISE YOUR RIGHTS

To exercise any of these rights, or to ask a question about how we use your data, contact us at nate@natedtattoo.co.uk. We will respond to your request within one month, as required by UK GDPR.

SECURITY

We take appropriate technical and organisational measures to protect your personal data, including encrypted storage for reference images, access controls limited to the artist, and rate-limiting to prevent automated abuse. However, no method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

CHILDREN'S PRIVACY

Our services are not directed at individuals under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with data, please contact us and we will promptly delete it.

CHANGES TO THIS POLICY

We may update this privacy policy from time to time to reflect changes in our practices or legal requirements. The updated version will be posted on this page with a revised "last updated" date.

CONTACT THE ICO

If you are not satisfied with how we handle your personal data, you have the right to complain to the Information Commissioner's Office (ICO), the UK's independent data protection authority. You can contact them at ico.org.uk or by calling 0303 123 1113.