Privacy policy of skandik.ink

Updated: 1 November 2026

Introduction

This policy explains how we process and protect the personal data of users of skandik.ink (the Website). It fulfils the information obligations under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and supplements the terms for tattoo services at SKANDIK TATTOO STUDIO (the Terms).

Payments, including booking deposits and, where applicable, partial advance payments, are processed by Przelewy24 (PayPro S.A.). This policy also explains data processing associated with that service.

1. Data controller and contact

The controller is Anastazja Zhukova, trading as SKANDIK TATTOO STUDIO, tax identification number (NIP) 9291968394, Jana Sobieskiego 16, 65-071 Zielona Góra, Poland. For data protection enquiries and requests concerning your rights, contact north0905@gmail.com or +48 787 166 932. The controller has not appointed a data protection officer.

2. Processors and independent controllers

2.1. Processors

The controller uses trusted providers of IT, hosting, security, newsletter and booking services. Processing is based on data processing agreements under Article 28 GDPR. Providers may include booking software provider NETION Patryk Pisany and infrastructure or hosting providers. An up-to-date list is available on request at north0905@gmail.com.

2.2. PayPro S.A. (Przelewy24)

PayPro S.A. provides online payments as an independent controller for payment transactions. We share only necessary details, such as name, email, phone number, payment or deposit amount and order or transaction identifier. Details of PayPro's processing are set out in its own information notices and privacy policy.

3. Definitions

• User: anyone using the Website, including browsing, booking, paying, subscribing to a newsletter or using a contact form.
• Personal data: information identifying or capable of identifying an individual, collected through forms, bookings, payments, cookies or similar technologies.
• Processing: operations on data, including collection, recording, storage, use, disclosure and deletion, as defined in Article 4(2) GDPR.
• Deposit/advance payment: an amount paid online to reserve a date and, where applicable, begin design work under the Terms.
• Newsletter: free emails about studio services, news and promotions.
• Cookies: files or similar technologies stored or read on a device to operate the Website, produce statistics and, with consent, support marketing.

4. Who this policy covers

The policy covers all Website users, particularly people browsing pages, booking appointments, paying deposits or advances, using Przelewy24, subscribing to newsletters, submitting forms or contacting us by email.

5. Data categories, purposes and legal bases

We process only the necessary data, following the data minimisation principle in Article 5(1)(c) GDPR.

5.1. Bookings, deposits and payments

Data: name, email, phone number, order identifier, deposit/advance amount, appointment date and time and transaction/session identifiers. We do not store full payment card details; PayPro S.A. processes those details. Purpose: entering into and performing a tattoo service contract, including booking, payment and settlement. Legal bases: Article 6(1)(b) GDPR (contract or steps before a contract) and Article 6(1)(c) (legal obligations, including applicable tax and accounting duties).

5.2. Complaints, claims and disputed settlements

Data: identification details, booking history, correspondence and payment information. Purpose: handling complaints, correspondence, pursuing or defending claims and resolving disputed settlements. Legal basis: Article 6(1)(f) GDPR, the controller's legitimate interests.

5.3. Newsletter and email marketing

Data: email address. Purpose: sending marketing information about studio services, promotions and news. Legal basis: voluntary consent under Article 6(1)(a) GDPR and applicable electronic communications and direct marketing rules, particularly the Polish Electronic Communications Law.

5.4. Contact forms and email correspondence

Data: name, if supplied, email address, phone number, if supplied, and message content. Purpose: answering questions, providing estimates, arranging service details and organisational communication, such as rescheduling. Legal basis: Article 6(1)(f) GDPR, the legitimate interest in corresponding and handling enquiries.

5.5. Analytics, statistics and Website security logs

Data: IP address, server logs, device/browser identifiers and information from necessary cookies and, after consent, analytics/marketing cookies. Purpose: security, correct operation, statistical measurement, Website improvements and, with consent, marketing. Security and necessary operation rely on Article 6(1)(f) GDPR. Cookie-based analytics or marketing involving personal data rely on consent under Article 6(1)(a).

5.6. Images, video and portfolio

Data: images of the user and/or tattoo, voice recordings where present, and the date and place of the service where recorded. Purpose: documenting studio work and promotion in the Website, social media and advertising. Legal basis: voluntary consent under Article 6(1)(a) GDPR. Publishing an identifiable person's image also requires the appropriate separate permission. Refusing consent does not affect the service. Consent can be withdrawn at any time.

5.7. Special categories of data: health

Data: voluntarily supplied information about health, allergies, contraindications or medication. Purpose: assessing service safety and reducing complications. Legal basis: explicit consent under Article 9(2)(a) GDPR. Supplying this information is voluntary but may be necessary for a safety assessment; the controller may refuse the service on justified safety grounds.

5.8. Records and evidence

Data: identification details, booking and payment history, correspondence and complaint/claim information. Purpose: evidencing facts and service handling, defending claims and meeting applicable legal duties, such as accounting or tax obligations. Legal bases: Article 6(1)(f) and, where a legal duty applies, Article 6(1)(c) GDPR.

6. Sources of data

Data comes directly from the user through forms, bookings and correspondence, and from their device through cookies and logs. Some online payment data is generated or supplied by PayPro S.A. as part of payment processing.

7. Voluntary provision of data

Details required for a booking, deposit/advance payment or service are necessary to enter into and perform the contract; not providing them may prevent these activities. Newsletter data and analytics/marketing cookies are optional and require consent. Refusing consent does not prevent use of basic Website functions.

8. Recipients

Data may be shared only with authorised recipients, particularly hosting, maintenance and security providers; booking providers; email/newsletter providers; SMS notification providers, if used; accounting services where necessary (as processors or independent controllers depending on their role); and PayPro S.A. as an independent payment controller. Other disclosure takes place only where legally required, for example to public authorities, or with the user's consent.

9. Transfers outside the EEA

If a provider of cloud, email, analytics, advertising or social media services is based outside the European Economic Area, transfers may rely on a European Commission adequacy decision or Standard Contractual Clauses (SCC), with additional safeguards where necessary. Publishing content on social media may involve transfers to third countries under those platforms' rules and your publication consent.

10. Retention periods

• Bookings, services and settlements: for the time needed to perform and settle the contract.
• Claims and complaints: until resolution and for the period needed as evidence, generally until the applicable limitation period expires.
• A contract for a specific work, where applicable: claims may generally become time-barred two years after delivery or the date on which delivery was due, under the applicable civil law rules.
• Accounting/tax documents, where applicable: generally five years from the end of the tax year in which the tax obligation arose.
• Newsletter: until consent is withdrawn.
• Cookies: for their lifetime or until deleted or consent is withdrawn where required.
• Images/video: until consent is withdrawn. We then remove material from our channels within a reasonable time, but cannot control copies independently retained or distributed by others or platform archives.

11. Your rights

You have rights of access and a copy, correction, deletion where GDPR permits, restriction, data portability for consent/contract-based automated processing, objection to legitimate-interest processing including direct marketing, and withdrawal of consent without affecting the lawfulness of earlier processing.

Send requests to north0905@gmail.com. We respond without undue delay and no later than one month under Article 12 GDPR, with a possible extension of a further two months where GDPR permits. We may verify your identity for security. You may complain to the President of the Polish Personal Data Protection Office (UODO).

12. Recording and publishing images/video

With consent, recordings may show the tattoo and the relevant body area and, sometimes, identifying features such as a face. Materials may be published on the Website, studio social media and promotional materials. Consent is voluntary and does not affect the service. Withdraw it by emailing north0905@gmail.com.

13. Cookies and similar technologies

Under the Polish Electronic Communications Law, storing or accessing information on a user's device generally requires prior consent, except technologies needed for communication transmission or a service requested by the user.

• Necessary: security, navigation, forms, bookings and payments; these may operate without consent where necessary for the requested service.
• Functional: preferences such as language; used after consent where consent is required.
• Analytics: traffic statistics and measurement; used only with consent.
• Marketing: marketing support and advertising measurement; used only with consent.

On the first visit we display a cookie banner/consent panel. Consent can be changed or withdrawn through Cookie settings, where that panel is available, or browser settings. Disabling necessary cookies may impair the Website.

14. Automated decisions and profiling

We do not make decisions with legal or similarly significant effects solely by automated means. Cookie-based marketing/analytics tools may involve marketing profiling only with the user's consent under their cookie settings.

15. Data security

We use technical and organisational measures appropriate to risk, including HTTPS/SSL, access controls and authorisations, backups and incident monitoring, data minimisation, provider processing agreements and Przelewy24 payments. Payment card details are not stored by the Website and are processed by the payment provider.

16. Policy changes

This policy may be updated following changes in law, technology or services, including payment methods or analytics tools. New versions are published on the Website with their update date. Please review updates regularly.

17. Final provisions

Users should read this policy when using the Website or making bookings/payments. The Terms describe service rules, bookings and deposit settlements. Where this policy and the Terms differ on service provision rules, the Terms apply.