Confidentiality policy

Last updated: 04 March 2026

1. Who we are (Data Controller)

The website www.funkytattoo.ro is operated by SC Funky Tattoo Studio SRL (hereinafter “Funky Tattoo”, “we”, “us”),
acting as the Data Controller for the purposes of the General Data Protection Regulation (GDPR).

Contact details:

Address: Bd-ul Magheru nr. 35, Bloc 52, Staircase B, Apt. 1, Intercom 1, Bucharest, Romania (Piata Romana area)

Phone: +40 731 525 808 / +40 772 047 223

Email: contact@funkytattoo.ro

2. What this policy covers

This Privacy Policy explains what personal data we process, why we process it, the legal basis for processing, how long we keep it, who we may share it with,
and your rights under the GDPR (Regulation (EU) 2016/679).

3. Personal data we may process

Depending on how you interact with us, we may process:

  • Identification and contact data: name, phone number, email address, message content (and any information you choose to include).
  • Booking-related data: preferred date/time, type of service (tattoo/piercing), details needed for an estimate (placement, size, style, reference images you choose to send).
  • Technical data (when you use the website): IP address, browser/device information, visited pages, server logs and aggregated statistics (depending on your cookie consent settings).
  • Compliance data: where applicable, verification of age/identity for appointments and services.

4. Where we collect data from

  • Directly from you: when you complete a contact form, email us, call us, or send information for estimates/appointments.
  • Automatically: via cookies/similar technologies and server logs (in line with your consent preferences).

5. Purposes and legal bases (GDPR)

We process personal data mainly for:

  • Responding to enquiries and communication (Art. 6(1)(b) – steps at your request / Art. 6(1)(f) – legitimate interest to respond properly and promptly).
  • Appointments and providing services (Art. 6(1)(b) – performance of a contract / pre-contractual steps).
  • Legal obligations (Art. 6(1)(c) – e.g., accounting, archiving, responding to authorities when required).
  • Security and abuse prevention (Art. 6(1)(f) – legitimate interest: website security, preventing fraud/abuse).
  • Non-essential cookies (analytics/marketing) only with your consent (Art. 6(1)(a) – consent), managed through our cookie consent tool.

6. Cookies and similar technologies

We use a cookie consent mechanism (Ultimate GDPR & CCPA) that allows you to accept or refuse cookies by categories
(e.g., Essential / Functionality / Analytics / Advertising) and to change your preferences at any time.
Essential cookies are required for the website to function. Analytics/marketing cookies are used only if you consent.

For full details and a cookie list (where available), please see our Cookie Policy.

7. Who we may share data with (Recipients / Processors)

We do not sell personal data. We may share data only when necessary, with:

  • IT service providers (hosting, maintenance, email delivery, security);
  • service providers related to contact forms and cookie consent management;
  • public authorities, when legally required.

Where third parties process data on our behalf, they are engaged under contractual obligations, including confidentiality and appropriate security measures.

8. International transfers (outside the EU/EEA)

If any service provider uses infrastructure outside the EU/EEA, transfers will be carried out with appropriate safeguards
(such as Standard Contractual Clauses), as required by applicable law.

9. Data retention (how long we keep data)

  • Contact enquiries: typically up to 3 years from the last interaction (for communication history and handling requests), unless a longer period is required by law.
  • Client/contractual relationship: for the duration of the relationship and afterwards as required by applicable legal obligations (e.g., accounting records – statutory retention periods).
  • Technical logs: reasonable periods for security and troubleshooting.
  • Cookies: according to their specific duration and your consent settings (where available via the cookie list).

10. Data security

We apply reasonable technical and organisational measures to protect personal data (access control, IT security measures, backups, internal procedures).
However, no method of transmission over the internet is 100% secure.

11. Your rights (GDPR)

Subject to the conditions under GDPR, you have the following rights:

  • right of access;
  • right to rectification;
  • right to erasure (“right to be forgotten”);
  • right to restriction of processing;
  • right to data portability (where applicable);
  • right to object (especially where processing is based on legitimate interests and for direct marketing);
  • right to withdraw consent (where processing is based on consent, e.g., non-essential cookies), without affecting the lawfulness of processing before withdrawal.

12. How to exercise your rights

To submit a GDPR request, contact us at contact@funkytattoo.ro. We may request additional information to verify your identity where necessary.

13. Complaints

If you believe your rights have been infringed, you may lodge a complaint with the Romanian data protection authority (ANSPDCP) or address the competent courts.

14. Minors

The website is not intended for minors. For age rules related to services (tattoo/piercing), please refer to our booking information and studio policies.

15. Updates to this policy

We may update this Privacy Policy to reflect legal or operational changes. The current version is available on this page together with the “Last updated” date.

Vreau programare