General information

The following notes give a simple overview of what happens to your personal data when you visit this website. Personal data is any data by which you can be personally identified. Detailed information on the subject of data protection can be found in the privacy policy below.

Data collection on this website

Who is responsible for data collection on this website?
Data processing on this website is carried out by the website operator. You can find their contact details in the "Responsible party" section of this privacy policy.

How do we collect your data?
On the one hand, your data is collected when you provide it to us (e.g. via the booking form or the newsletter signup). Other data is collected automatically or with your consent when you visit the website by our IT systems. This is primarily technical data (e.g. web browser, operating system or time of the page view). This data is collected automatically as soon as you enter this website.

What do we use your data for?
Some of the data is collected to ensure the website is provided without errors. Other data may be used to analyse your user behaviour. Where a contract is to be concluded or initiated via this website (e.g. a tattoo appointment), we use your information to perform and prepare that contract.

What rights do you have regarding your data?
You have the right to receive information about the origin, recipient and purpose of your stored personal data free of charge at any time. You also have the right to request the correction, blocking or deletion of this data. You can contact us at any time using the address given in the imprint for this and other questions on the subject of data protection. You also have the right to complain to the competent supervisory authority (see "Your rights" section).

2. Responsible party

The responsible party for data processing on this website is:

Maya Witulski Morales (Ixchel Tattoo)
Harburger Chaussee 119A
20539 Hamburg, Germany
Phone: +49 1575 2631244
E-mail: info@ixchel-tattoo.com

The responsible party is the natural or legal person who, alone or jointly with others, decides on the purposes and means of processing personal data.

3. Hosting

This website is hosted by an external service provider:

ALL-INKL.COM – Neue Medien Münnich
Owner: René Münnich
Hauptstraße 68, 02742 Friedersdorf, Germany
Data processing agreement pursuant to Art. 28 GDPR concluded.

The hosting services include the provision of servers and webspace, databases and website security. The data centre is located in Germany.

When you visit the website, server log files are stored, including:

• Browser type and version
• Operating system used
• Referrer URL (previously visited page)
• Host name of the accessing computer
• Time of the server request
• IP address (truncated/anonymised where possible)

This data is used for the technically secure and trouble-free operation of the website and to defend against attacks (Art. 6 (1) (f) GDPR). This data is not merged with other data sources. Deletion: Server log files are deleted automatically 7 days after collection at the latest (according to the host's privacy information). Longer storage is only possible in individual cases, e.g. attacks on the IT systems.

4. Content Delivery Network (KeyCDN)

Static content of this website (images, CSS, JavaScript) is delivered via the content delivery network KeyCDN (domain kxcdn.com). When you access it, KeyCDN processes, among other things, your IP address in order to deliver content from an edge server. KeyCDN has been engaged by us as a data processor (Art. 6 (1) (f) GDPR, Art. 28 GDPR). Client IP addresses are anonymised in the content delivery logs; no storage-based user analysis takes place.

5. Cookies

This website only uses cookies and browser storage that are technically necessary. The legal basis is § 25 (2) TDDDG in conjunction with Art. 6 (1) (f) GDPR. You can configure your browser to reject or delete cookies; the website remains usable.

6. Contact and booking form

Via the form offered on this website you can submit a request or booking enquiry. When you submit the form, the data you enter is processed by us and our form service provider:

• Data processed: first name, last name, e-mail address, phone number (optional), desired placement/size of the tattoo, your description of the request and files you optionally upload (inspiration images, possibly body pictures).
• Purpose: Handling your enquiry and contract performance/preparation (Art. 6 (1) (b) GDPR).
• Service provider: The forms are technically provided via the platform JUNE (juneapp.com) and transferred to engagement.juneapp.com. JUNE processes the data as a data processor (Art. 28 GDPR) — a data processing agreement is in place.
• Note on body pictures: Uploaded body pictures and placement details are used exclusively for planning the requested design. Please only upload images you are comfortable sharing. We delete such images once the matter is concluded unless legal retention obligations apply.
• Retention: Data from booking requests is deleted as soon as the purpose ceases to apply and no statutory retention periods prevent deletion (usually six months if no appointment is booked).

7. Newsletter

You can subscribe to our newsletter on this website. For this we need your e-mail address and confirmation that you wish to receive it.

Double opt-in

We only send newsletters after e-mail confirmation (double opt-in procedure). This allows us to prove your consent in a legally secure manner (Art. 6 (1) (a) GDPR; § 7 (2) UWG). You can revoke your consent at any time via the unsubscribe link in every newsletter — your e-mail address will then be removed from the mailing list.

Newsletter service provider

Newsletter delivery and subscription management run via JUNE (juneapp.com). E-mail delivery, opening rates and link clicks are processed for statistical purposes (on the basis of your consent, Art. 6 (1) (a) GDPR). JUNE acts as our data processor.

8. Your rights

Within the framework of the applicable legal provisions you have the right to free information about your stored personal data, its origin and recipients and the purpose of the data processing at any time (Art. 15 GDPR). You also have the right to:

• Rectification of inaccurate data (Art. 16 GDPR)
• Erasure of personal data (Art. 17 GDPR)
• Restriction of processing (Art. 18 GDPR)
• Data portability (Art. 20 GDPR)
• Objection to processing (Art. 21 GDPR)
• Complaint to a supervisory authority (Art. 77 GDPR)

Competent supervisory authority (for the operator, based in Hamburg, Germany):

Hamburgische Beauftragte für Datenschutz und Informationsfreiheit
Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany
www.datenschutz-hamburg.de

Right of objection (Art. 21 GDPR)

If your personal data is processed on the basis of legitimate interests (Art. 6 (1) (f) GDPR), you may object to the processing if there are grounds arising from your particular situation. Please direct your objection to the e-mail address stated above.

9. SSL / TLS encryption

For security reasons and to protect the transmission of confidential content, this site uses SSL/TLS encryption. You can recognise an encrypted connection by "https://" in the address bar and the padlock symbol in your browser.

10. External links

We link to our Instagram profile. This is a plain hyperlink: when you visit this website, no data is transferred to Instagram/Meta. Only when you click the link do you leave our website and enter the area of responsibility of Meta Platforms Ireland Ltd. (please refer to Instagram's privacy policy).