At a glance

This English version is provided for convenience; the French version is the authoritative one.

Your details are used only to review your project, arrange your appointment, write to you after your session and meet my legal obligations.
The skin photos you send me are used only to review and prepare your project, with your explicit consent, which you can withdraw at any time. They are never published.
The deposit is paid by bank transfer or by card. By card, you pay on the page of SumUp, my payment provider: your card details never pass through this site. Either way, I record only what is needed to track the payment: amount, date, reference and, for a transfer, the account holder’s name.
This site uses no cookies or trackers that require consent.
For any question, or to exercise your rights, write to me at contact@sergiodurotattoo.com.

Data controller

I use this site to receive and review your tattoo projects, then to arrange your appointments. The controller of the data you share here is:

Sergio Duro Godoy EI (Sergio Duro), sole trader (entrepreneur individuel) under the trade name Sergio Duro Tattoo;
postal address and place of work: Cœur de Vaurien studio, 10 rue Poincaré, 68100 Mulhouse, France;
email: contact@sergiodurotattoo.com.

Full legal details are in the legal notice.

Data I collect

I only collect what I need to review your project, arrange your appointment and meet my obligations.

Your project request: first name, last name, email address, phone number (optional), preferred language, type of tattoo, description of your idea, placement, size, black and grey or colour, whether it is your first tattoo, any cover-up, budget, availability, any other remarks and, if you wish, how you heard about my work. I also record the date of your consent and your confirmation that you are 18 or over.
Your photos: reference images and photos of the area to be tattooed, up to 8. Their metadata (GPS location, device model, date taken) is removed on upload.
Your booking: the proposal I send you (duration, number of sessions, estimated price), the slot you choose, the date and version of the booking terms you accepted, any request to start before the end of the withdrawal period, and any request to reschedule or withdraw.
Payment of the deposit (arrhes): for a bank transfer to my business bank account, I record only what appears on my statement: amount, date received, transfer reference and the name of the account holder who paid. The bank details of the paying account, which my bank shows me as it does for any incoming transfer, are not stored on this site: I use them only to refund you, if a refund is due. For a card payment, you enter your card details on SumUp’s payment page, never on this site, and I have no access to them: the site stores only the payment status (pending, paid, failed or expired), the amount, the date and the transaction identifiers SumUp sends back. In both cases I also record the receipt number and, where applicable, the amount and date of any refund. If I have to send you money by bank transfer although you paid by card (for instance twice the deposit), I will ask you by email for the details of the account to credit; they are not stored on this site either.
Our correspondence: the emails we exchange and my working notes on your project.
Technical data: security logs (IP address, date and time, page requested), used solely to protect the site against abuse. The visitor statistics contain no IP address and no identifier (see “Cookies and statistics”).

Fields marked as required in the form are needed to review your request: without them I cannot reply. The others are optional. Please do not include any medical information in the form.

Purposes and legal bases

Reviewing your request, replying and sending you a proposal — legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
Using photos of the area to be tattooed — legal basis: your explicit consent (Art. 9(2)(a) GDPR), as a photo of your skin may reveal health information.
Booking and managing your appointment (slot, payment and refund of the deposit, confirmation, reminder a few days before, rescheduling, withdrawal) — legal basis: performance of the contract (Art. 6(1)(b) GDPR).
Keeping my accounts and supporting documents — legal basis: legal obligation (Art. 6(1)(c) GDPR).
Keeping proof of your acceptance of the booking terms and of any withdrawal — legal basis: legitimate interest in being able to show that I have met my obligations and to defend my rights (Art. 6(1)(f) GDPR).
Securing the site and blocking spam — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Measuring site traffic without cookies, to see which pages are useful — legal basis: legitimate interest (Art. 6(1)(f) GDPR).
Writing to you after your session, to ask how the healing is going and, where relevant, to tell you about similar services — legal basis: legitimate interest (Art. 6(1)(f) GDPR), within the framework that article L34-5 of the French Postal and Electronic Communications Code sets for existing clients. Each of these emails includes an unsubscribe link.

Where processing is based on my legitimate interest, you have the right to object (see “Your rights”).

No automated decisions: I read and review every request myself. Neither the acceptance of a project nor its price is decided by an algorithm.

Your data is not used for any other purpose.

A photo of the area to be tattooed shows your skin: it may reveal a scar, a skin condition or other information about your health. That is why the form asks for your explicit consent: “I agree that the information and photos I provide will be used solely to handle my tattoo request. As photos of skin may reveal health data, I can withdraw my consent at any time: they will then be deleted.”

Frame only the area to be tattooed, without your face, and do not add any medical information.
These photos are used only to review and prepare your project. They are never published.
You can withdraw your consent at any time by writing to contact@sergiodurotattoo.com: the photos are then deleted. Withdrawal does not affect any use made before it; without the photos, however, I may no longer be able to review or prepare your project.
A photo of your finished tattoo will appear on this site or on my social media only with your separate written consent, which you can also withdraw.

Recipients and service providers

I am the only person who uses your data: I do not sell it, rent it out or pass it on to anyone. To run the site, I rely on a few technical providers who process it on my behalf and on my instructions (processors within the meaning of Article 28 GDPR):

Cloudflare (Cloudflare, Inc., USA): website hosting, database, photo storage and routing of emails sent to contact@sergiodurotattoo.com. Your request data and photos are stored in the European Union.
Resend (USA): sending of automatic emails (acknowledgement, proposal, confirmation, reminder) and of the notification I receive for each new request (without your photos or the text of your project, which stay on the site).
Google (Gmail): the inbox where these notifications and your messages arrive, and from which I reply to you.

Banks. A deposit paid by bank transfer goes to my business bank account. Your bank and mine process the transfer data (account holder’s name, bank details, amount, reference) as separate controllers, to carry out the transfer and to meet their own legal obligations, in particular on fraud and money-laundering prevention. I pass no other data about you to my bank.

SumUp, for card payments. If you choose to pay by card, the payment is processed by SumUp Limited, an electronic money institution authorised by the Central Bank of Ireland (licence C195030), Block 8, Harcourt Centre, Charlotte Way, Dublin 2, D02 K580, Ireland. You enter your card details (number, expiry date, security code, cardholder’s name) directly on SumUp’s payment page. SumUp processes them, along with the transaction data, as a separate controller, to carry out and secure the payment, prevent fraud and meet its own legal obligations, in particular on money-laundering prevention: its privacy policy applies to this processing, and you can exercise your rights with SumUp at dpo@sumup.com. To create the payment, this site sends SumUp only the amount, the currency, a technical reference and a generic description, without your name or email address; in return, it receives the payment status and the transaction identifiers. Card refunds also go through SumUp.

Where the law requires it, some data may be disclosed to the competent authorities, such as the tax authorities.

Transfers outside the European Union

Cloudflare, Resend and Google are US companies or belong to US groups. Even when data is stored in the European Union, access from the United States cannot be ruled out, and emails sent by the site pass through Resend’s servers in the United States. These transfers are covered:

by the European Commission’s adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework, for certified companies;
by the standard contractual clauses adopted by the European Commission, included in these providers’ contracts.

SumUp states that it stores the data of its European business within the European Economic Area. It may, however, share it with companies in its group, with parties involved in processing the payment or with its own providers outside the European Economic Area, including in the United Kingdom, and undertakes to do so only with appropriate safeguards, in particular contractual ones. These transfers are SumUp’s responsibility and are described in its privacy policy.

If you write to me at contact@sergiodurotattoo.com, I will tell you which safeguards apply to each provider.

How long I keep your data

Requests that do not lead to an appointment: photos deleted 3 months after the request is closed; other data deleted 12 months after our last exchange.
Client data (contact details, project, appointments, correspondence): 3 years after the last appointment.
Photos of your project: 12 months after the last session, unless you give separate written consent for the portfolio.
Accounting records (receipts, records of payments received, by transfer or by card, and of refunds): 10 years, as required by article L123-22 of the French Commercial Code. SumUp keeps its own transaction records for the periods set out in its privacy policy.
Proof of acceptance of the booking terms and withdrawal acknowledgements: 5 years.
Security logs: 6 to 12 months.
Anonymous visitor statistics: 25 months at most.
Technical database backups (stored in the European Union): erased after 35 days, so deleted data disappears from them within that time.

When the period ends, the data is deleted or anonymised: automatically for data stored by the site, and on the same schedule for emails kept in my inbox. If you withdraw your consent for the photos, they are deleted straight away.

Security

Private storage: your photos are never publicly accessible, and only I can view them.
Encryption: all communication with the site is encrypted (HTTPS).
Restricted access: the admin area is reserved for me and protected by access control that verifies my identity.
Personal links: the booking link I send you is yours alone and valid for 14 days only.
Automatic deletion: data stored by the site is erased at the end of the periods listed above, with no manual step.

No system is infallible. If a data breach is likely to put your rights at risk, I will notify the CNIL (the French data protection authority) and, if the risk is high, the people concerned, as the GDPR requires.

Your rights

You have the following rights over your data:

access: find out what data I hold about you and obtain a copy;
rectification: have inaccurate or incomplete data corrected;
erasure: have your data deleted;
restriction: ask for the use of your data to be temporarily suspended;
objection: object, on grounds relating to your particular situation, to processing based on my legitimate interest and, at any time, to the emails sent after your session;
portability: receive the data you gave me in a common, machine-readable format;
withdrawal of consent: withdraw your consent for the photos at any time;
post-mortem instructions: decide what happens to your data after your death, as French law allows.

To exercise them, write to me at contact@sergiodurotattoo.com, stating your request. If I have reasonable doubts about your identity, I may ask you for additional information. I will reply within one month; for complex requests, this may be extended by two months, and I will let you know.

Some data cannot be erased while the law requires me to keep it, such as accounting records.

If you believe your rights have not been respected, you can lodge a complaint with the CNIL (www.cnil.fr/fr/plaintes, in French) or with the data protection authority of your country of residence in the European Union.

Cookies and statistics

This site uses no cookies or trackers that require your consent. That is why there is no banner asking for it.

Cookieless statistics: to see which pages are read and where visits come from (Instagram, Google…), the site keeps aggregated daily counts. No cookie is set, nothing is stored in your browser (except your choice not to be counted, if you make it below), no IP address is kept and no identifier can recognise you from one visit to the next.
Do Not Track and Global Privacy Control: if your browser sends either signal, your visit is not counted at all.
Opting out: you can also choose not to be counted with the button below. Your choice is remembered in this browser, and it is the only thing the site ever stores there.Your visits are currently counted, anonymously.
Spam protection: the form is protected by a check that runs in your browser (a brief automatic calculation known as “proof of work”) and by a hidden field meant for bots. No cookies or third-party services are involved.
No embedded third-party content: the site uses the fonts already installed on your device and loads none from a third-party service; the portfolio photos are hosted on this site; directions to the studio open through a simple link to Google Maps, and Instagram is reached only through links. These services receive no information about your visit unless you click those links.
Payment: no payment service is built into the pages of this site. For a transfer, you pay from your own bank; for a card payment, you are taken to SumUp’s payment page (checkout.sumup.com), where SumUp may use its own cookies, under its own responsibility (see its privacy policy).

Minors

The request form and online booking are reserved for people aged 18 or over, which you confirm by ticking the box provided. I do not knowingly collect data about minors: if I learn that a request was sent by someone under 18, I delete it. A parent with a question about this can write to me at contact@sergiodurotattoo.com.

Changes to this policy

This policy may change, for example if I switch providers or the law evolves. The date of the latest update is shown at the top of this page. If a significant change affects data already collected, I will let you know by email.

Version in force since 13 October 2026.