Skip to content
Sagma Tattoo Gallery
+48 884 794 741

Documents

Privacy policy

What data we collect, why, on what legal basis and how long we keep it — and what rights you have.

1. Controller

The controller of your personal data is Oleksii Zakharov, running a business under the name ZakharovTattoo Oleksii Zakharov, Aleja Wincentego Witosa 31/7, 00-710 Warszawa, Poland, NIP 5273091010, REGON 527303209 (the Controller or the Studio). The Sagma Tattoo Gallery studio receives clients at Aleja Wincentego Witosa 31/7, 00-710 Warszawa.

Contact on personal data matters: sagma.tattoo.gallery@gmail.com or by post to the Controller’s address.

This Policy covers the website sagmatattoogallery.com (the Website), the Client Account on the Website and the data provided to the Studio when booking and having a tattoo done.

2. What data we process

We process data that you provide yourself, in particular:

  • your name, email address, phone number and preferred contact language;
  • the content of your enquiry, the chosen style, body placement, preferred date and artist;
  • Client Account data: email address, password stored as a cryptographic hash, saved designs, favourite works and request history;
  • uploaded files: sketches, reference photos, photos of the body placement, tattoo try-on results and healing photos;
  • data from pre-visit forms: the health questionnaire, consent to the procedure and statements, consent to the use of your image, and your PESEL number if you provide it;
  • data related to gift cards and the “Refer a friend” programme: the name on the card, the referral code, who referred whom and what discount applies;
  • data needed for settlements and accounting documents;
  • messages in the online chat on the Website and the data you leave there (name, phone, email), as well as the Website language and the page from which you wrote.

We automatically record technical data in server logs: IP address, date and time, page address and browser type. Visit statistics are collected only with your consent — see section 10.

3. Purposes and legal bases

  • Answering an enquiry, booking a visit and contacting you about the date — steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR).
  • Performing the tattoo and documenting the service — performance of a contract (Article 6(1)(b) GDPR).
  • Running the Client Account: designs, try-on, favourite works and requests sent from the Account — performance of a contract for electronic services under the Terms (Article 6(1)(b) GDPR).
  • Replies in the online chat, including those given by the AI assistant — steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR); translating your messages for the manager and a short summary of the conversation — the Controller’s legitimate interest in a fast and accurate reply (Article 6(1)(f) GDPR).
  • The health questionnaire and photos that may reveal health information (e.g. photos of the skin during healing) — your explicit consent (Article 9(2)(a) GDPR).
  • Use of your image and tattoo photos in the Studio’s portfolio and social media — your consent (Article 6(1)(a) GDPR in connection with Article 81 of the Polish Copyright Act).
  • Gift cards and the “Refer a friend” programme — performance of a contract under the Terms (Article 6(1)(b) GDPR).
  • The newsletter and information about the Studio’s offer sent by email — your consent (Article 6(1)(a) GDPR), given in accordance with the Polish Electronic Communications Law.
  • Visit statistics and measuring the effectiveness of advertising — your consent (Article 6(1)(a) GDPR), see section 10.
  • Playing the Studio’s YouTube videos — your consent (Article 6(1)(a) GDPR), given by clicking the play button.
  • Displaying the Google Maps directions map — the Controller’s legitimate interest in showing the way to the Studio (Article 6(1)(f) GDPR).
  • Recording consents to cookies — demonstrating that consent was given, a legal obligation (Article 6(1)(c) in connection with Article 7(1) GDPR).
  • Accounting and taxes — a legal obligation (Article 6(1)(c) GDPR).
  • Security of the Website, server logs, the activity log in the Studio’s panels, displaying reviews from the Studio’s Google profile, and establishing, pursuing and defending claims — the Controller’s legitimate interest (Article 6(1)(f) GDPR).

4. Health data

The health questionnaire and photos of the skin sent during healing may contain health data (Article 9 GDPR). Therefore:

  • we process them only on the basis of your explicit consent, which you may withdraw at any time;
  • we store the questionnaire in encrypted form (AES-256-GCM), and the encryption key is not stored in the database;
  • the photos you send are not public: they can be seen by you and by authorised persons at the Studio after signing in;
  • the questionnaire can be accessed by the Studio owner, the manager and the artist conducting your session;
  • we delete the questionnaire automatically three years after it is completed.

Withdrawing consent does not affect the lawfulness of processing before the withdrawal. The Studio does not perform a tattoo without the health questionnaire.

5. Recipients of data

Data is received only by entities that help us run the Studio and the Website — under data processing agreements or as separate controllers:

  • authorised employees and associates of the Studio (manager, artists) — to the extent needed to handle your matter;
  • the provider of the server on which the Website, the database and their backups run (server in Germany);
  • Cloudflare — delivering traffic to the Website, protection against attacks and Cloudflare Turnstile during sign-in and registration (checking that a form is sent by a human, based on technical browser data);
  • the email delivery service provider — Account emails, notifications and the newsletter;
  • OpenRouter, Inc. (USA) and the language model provider that OpenRouter selects only from providers that do not store requests — replies of the AI assistant in the online chat, translating messages for the manager and summarising the conversation. Messages are not used to train models;
  • Google — the directions map (device IP address, without cookies), YouTube videos (after you click play), Google sign-in (if you use it), Google Analytics and Google Ads (with your consent), and reviews from the Studio’s Google Maps profile;
  • Meta Platforms Ireland Limited (Facebook, Instagram) — measuring the effectiveness of the Studio’s ads and ad personalisation (with your consent). As regards the collection and transmission of data by the Meta pixel, the Studio and Meta are joint controllers under the Meta Controller Addendum; Meta is responsible for further processing (facebook.com/privacy/policy);
  • entities providing accounting services to the Studio — as regards accounting documents;
  • entities authorised by law.

We do not sell personal data.

6. Transfers outside the EEA

The Website and the database run on a server in the European Union. Some providers (Google, Meta, Cloudflare, OpenRouter) may also process data in the United States. This takes place on the basis of the European Commission’s adequacy decision (EU-US Data Privacy Framework) — for entities covered by it — or standard contractual clauses approved by the European Commission. You can obtain information about the safeguards applied by writing to the address in section 1.

7. How long we keep data

  • The Client Account, saved designs and favourite works — until you delete the Account; designs and files can also be deleted individually.
  • Enquiries and requests — 24 months after the last contact on the matter, unless they have become part of the service documentation.
  • Online chat conversations — 12 months after the last message, then deleted automatically; earlier — at your request or together with the Account.
  • The health questionnaire — 3 years after completion, then deleted automatically.
  • Signed consents, statements and service documentation — until the limitation periods for claims expire; after the Account is deleted, they are no longer linked to it.
  • Accounting documents — 5 years from the end of the year in which the tax payment deadline expired.
  • Newsletter consent — until withdrawn. After you unsubscribe, we keep only your email address on a suppression list so that we do not email you again.
  • Visit statistics on our server — 12 months; data in Google Analytics — 14 months.
  • Records of cookie consents — 24 months.
  • Server logs — up to 12 months.
  • Data needed to establish, pursue or defend claims — until the limitation periods expire.

8. Your rights

You have the right to:

  • access your data and receive a copy;
  • rectify your data;
  • erase your data — in cases provided for by law;
  • restrict processing;
  • data portability;
  • object to processing based on legitimate interest;
  • withdraw consent at any time — without affecting the lawfulness of processing before the withdrawal;
  • lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).

You can exercise some of these rights yourself in the Client Account: change your data, withdraw newsletter consent and delete the Account. Send other requests to sagma.tattoo.gallery@gmail.com or by post to the Controller’s address. We reply within one month.

9. Whether you must provide data

Providing data is voluntary. Without the data necessary to answer an enquiry or perform the service, we will not be able to handle your request or enter into a contract. The Studio does not perform a tattoo without the health questionnaire.

10. Cookies, statistics and advertising

The full list of cookies, with retention periods and purposes, is available on the Cookies page. In brief:

  • necessary — sign-in, language, consent settings, chat and security — do not require consent;
  • functional — playing YouTube videos — after you click the play button;
  • analytics — our own visitor counter and Google Analytics — only with your consent;
  • marketing — measuring the effectiveness of the Studio’s ads in Google Ads and on Facebook and Instagram (Meta pixel) and ad personalisation — only with your consent.

If you consent to marketing cookies, the data from your enquiry (email address and phone number) may be shared with Google in encrypted form to measure Google Ads conversions.

If you consent to marketing cookies, information about your enquiry (the fact that it was sent, the page address, IP address and browser data, as well as your email address and phone number in encrypted form) may be shared with Meta from our server to measure the effectiveness of ads.

The Google Maps directions map is displayed without consent: it does not store data on your device, and Google receives the device’s IP address.

Our visitor counter does not use cookies and does not store IP addresses. It records the page visited, the country determined from the IP address at the time of the visit, the device type, browser and operating system, the domain of the referring website, campaign tags (UTM) and the time spent on the page. To count unique daily visits, we use a hash that cannot be linked to visits on other days and from which the IP address cannot be recovered.

You can change your consent at any time using the icon in the bottom-left corner of the Website or on the Cookies page. We treat a Global Privacy Control signal from your browser as a refusal of analytics and marketing cookies.

11. Reviews

The Website displays reviews from the Studio’s Google Maps profile together with the author’s name and photo, as they are publicly visible on Google. The Studio does not verify whether the authors of reviews have used its services. If you would like us to stop displaying your review on the Website, please contact us.

12. Profiling and automated decisions

When the manager is unavailable, the AI assistant replies in the online chat; its replies are labelled in the chat. It answers questions only on the basis of information from the Website and passes the conversation to the manager — all arrangements and decisions are made by a human. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. If you consent to marketing, Google and Meta may tailor the Studio’s ads shown to you based on your visits to the Website.

13. Security

We apply technical and organisational measures appropriate to the risk: an encrypted connection (HTTPS), passwords stored only as hashes, encryption of health questionnaires, client photos available only after signing in, two-step sign-in to the Studio’s panels, restricted access to data, an activity log in the panels and regular backups. We adapt these measures to the state of the art.

14. Changes to this Policy

We may change this Policy, for example as a result of changes in the law or in the way the Website works. Every change is published on the Website together with its date.

Last updated: 27 October 2026.