Privacy notice under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
Privacy
This page explains what personal data the website andreamassiminitattoo.com collects, why it collects it, how long it keeps it and what your rights are. In short: your data is used only to reply to your tattoo request. It is not sold, not used for advertising and not passed on to anyone.
01Data controller
Andrea Massimini
VAT no. [P.IVA]
[INDIRIZZO DELLA SEDE O DEL DOMICILIO FISCALE]
For any question about this notice or your data, you can write to the email address above.
02What data we collect
Data you send with the request form (Booking page):
- full name, email address, city;
- optional: phone / WhatsApp number, Instagram username;
- the details of your project: idea, description, style, body placement, size and measurements, the city where you would like to get tattooed (Rome, Florence, Osnabrück);
- the images you choose to upload (references and, if you wish, photos of the body area);
- your confirmation that you are 18 or older and the date on which you accepted this notice;
- the language of the form and, where present, the channel you came from (for example Instagram or TikTok).
Emails: the messages we exchange after your request (confirmations, questions, quotes, dates).
Technical browsing data: like any website, the server automatically records some technical data (IP address, date and time, requested page, browser type) in the hosting provider’s logs, used only for security and for the website to work properly. To protect the form from spam, the website stores IP addresses only in an encrypted, non-reversible form (hash).
Photos of the skin and health information: these are not required. If you choose to send photos of the body area or to mention scars, skin conditions or other health information, they are used only to assess whether and how the tattoo can be done, on the basis of your explicit consent, which you give by sending them and can withdraw at any time.
03Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to your request, assessing the project, sending you questions, a quote and availability, arranging the consultation and appointment | Pre-contractual steps taken at your request (Art. 6(1)(b) GDPR) |
| Sending you the automatic confirmation email with your request code | Pre-contractual steps (Art. 6(1)(b) GDPR) |
| Assessing photos of the skin or health information you choose to share | Explicit consent (Art. 9(2)(a) GDPR) |
| Meeting tax and legal obligations if you become a client | Legal obligation (Art. 6(1)(c) GDPR) |
| Protecting the website and the form from spam and abuse | Legitimate interest (Art. 6(1)(f) GDPR) |
We do not use your data for newsletters, advertising or profiling, and we do not make automated decisions about you.
04How it is protected
- Requests are stored on the website’s server and can be seen only by Andrea, through a password-protected panel.
- Uploaded images cannot be reached publicly from the web.
- Communication with the website takes place over an encrypted connection (HTTPS).
- The website does not use third-party tools: fonts, video and images are hosted directly on the website.
05Who can process the data
The data is processed by Andrea Massimini. The website’s hosting and email provider, [FORNITORE HOSTING ED EMAIL, es. Aruba S.p.A.], appointed as data processor, may access it only as far as needed to provide the technical service. If you get tattooed during a guest spot, the data strictly needed for the appointment (name, date, project) may be shared with the host studio (Pachamama in Florence, VACUO Studio in Osnabrück), which processes it as an independent controller to manage the session.
The data is not made public and is not transferred outside the European Union.
06How long we keep it
- Requests that do not lead to an appointment: no longer than 24 months from the last contact, after which they are deleted together with the images.
- Clients: for as long as needed to handle the work and any touch-ups, and tax documents for the period required by law (10 years).
- Technical logs: for the period set by the hosting provider for security purposes.
You can ask at any time for your request to be deleted earlier.
07Providing your data and minors
The fields marked with * in the form are needed to reply to you; the others are optional. The service is for adults only: please do not send a request if you are under 18.
08Your rights
At any time you can ask to access your data, correct it, delete it, restrict its processing, receive it in a readable format (portability) and object to processing based on legitimate interest. You can withdraw the consent given for health information, without affecting processing already carried out.
To exercise your rights, write to book@andreamassiminitattoo.com, including if possible your request code (e.g. AM-26-0001). We reply within 30 days.
If you believe the processing breaches the GDPR, you can lodge a complaint with the Italian Data Protection Authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
09Cookies and external links
The website uses a single technical cookie, with no profiling or statistics: details are in the cookie policy. Links to Instagram, TikTok and Facebook lead to external websites, which apply their own privacy notices.
Last updated: 9 November 2026
}