2nd Face Tattoo & Body Piercing · Bucharest
Privacy Policy.
How we collect, use, retain, and protect personal data of visitors and clients.
Answer First
What you need to know about your data?
2NDFACE ART GALLERY SRL processes data necessary for requests, bookings, tattoo and piercing services, orders, payments, invoicing, site security, and legal compliance. We do not sell personal data. We use only necessary information, retain it for justified periods, and allow you to exercise your rights under GDPR.
Contents
Quick navigation.
Who is the data controller?
The personal data controller is 2NDFACE ART GALLERY SRL, which manages the website www.2ndface.info and the 2nd Face Tattoo & Body Piercing salon.
For questions regarding personal data, exercising rights or this policy, you can contact us at [email protected], by phone at 0724 669 330 or through the Contact page.
To whom and when does the policy apply?
The policy applies to website visitors, people who contact us, request an estimate, make an appointment, purchase a product, voucher or deposit, and clients who benefit from tattoo, piercing or related services.
The document explains how we collect, use, store and protect data, as well as the rights of the data subjects.
Principles of processing
We process data legally, fairly and transparently, for determined and legitimate purposes. We collect only adequate, relevant and limited data necessary for the purpose.
We ensure that data is accurate and up to date, not kept longer than necessary, and protected by appropriate technical and organisational measures.
What categories of data may we collect?
We may process identification and contact data such as name, surname, phone number, email address and, when necessary for age verification, identity document information.
For appointments and estimates, we may collect the desired service, preferred date, body area, approximate size, project description, reference images and communication history.
Health data and procedures
Before a tattoo or piercing procedure, we may request strictly necessary information regarding allergies, treatments, conditions, pregnancy, breastfeeding, coagulation issues, previous reactions or other relevant situations for safety assessment.
This information may represent special categories of data. When collected, we process it in a limited way, with additional confidentiality measures and, where applicable, based on the explicit consent of the data subject.
From what sources do we obtain data?
Primarily, we obtain data directly from you: via form, phone, WhatsApp, email, online store, appointment or documents completed in the studio.
We may receive data from a parent or legal guardian for procedures permitted to minors, from the payment processor regarding transaction confirmation, or from platforms through which you choose to contact us.
Why do we process data?
We use data to respond to requests, prepare estimates, check availability and confirm appointments.
We use it to provide services, verify age conditions, complete necessary documents, choose the procedure and provide care recommendations.
What are the legal bases?
Processing may be necessary for entering into or performing a contract, including for appointment, order, deposit, voucher and service provision.
We may process data to fulfil legal obligations, especially financial-accounting, tax, consumer protection and responding to authority requests.
Appointments, forms and WhatsApp
When you contact us for an appointment, we use data to identify the request, communicate availability and confirm conditions.
Messages sent via WhatsApp or other platforms are also processed by the platform provider, according to their policies. Avoid sending more extensive medical information than necessary via messages.
Online store, payments and invoicing
For online purchases, we process data necessary for the order, payment confirmation, invoicing, communication and execution of the purchased product or service.
Full card details are entered in the payment provider's environment. The studio may receive transaction confirmation, identifier and payment status, but should not receive the full card number or security code.
Photos, portfolio and social media
We may take photos of the work to document the result, project continuity and the studio's portfolio.
Publishing an image in which the person can be identified or which contains personal elements is done only if there is an appropriate legal basis, usually consent.
Cookies and analytics
The site uses strictly necessary cookies for operation, security and saving preferences. These cannot be disabled from the site systems if they are indispensable for the requested service.
Analytics, measurement, advertising or external integration cookies are activated only under applicable conditions and according to the choice expressed in the cookie banner.
To whom can we disclose data?
Data may be accessed by authorised studio staff and collaborators, only within the role and necessity limits.
We may use providers for hosting, WordPress maintenance, security, email, communications, payment processing, invoicing, accounting, web analytics, backup and technical support.
Transfers outside the European Economic Area
Certain technology, communications, analytics or cloud service providers may process data outside the European Economic Area.
In these cases, we ensure the existence of an adequacy decision, standard contractual clauses or other guarantees recognised by data protection legislation.
How long do we keep data?
We keep data only as long as necessary for the purpose for which it was collected and legal obligations.
Requests and communications without a contract may be kept for a reasonable period for response and continuity of discussion. Contractual data and accounting documents are kept according to legal terms.
How do we protect data?
We apply technical and organisational measures proportional to the nature of the data and risks: access control, passwords, updates, backups, antimalware protection, connection encryption and limiting access to authorised persons.
No transmission or storage can be guaranteed completely risk-free. In case of an incident, we assess effects and fulfil notification obligations to authorities and data subjects when required by law.
Data of minors
We do not tattoo persons under 18 years old. For piercing, age limits and rules published by the studio apply.
When the participation of a parent or guardian is required, we may process the adult's and minor's data to verify identity, legal relationship, consent, and fulfilment of procedure conditions.
What are your rights?
You can request confirmation of processing and access to data, correction of inaccurate information, deletion of data under legal conditions, and restriction of processing.
You can object to processing based on legitimate interest and request data portability when legal conditions are met.
How do you exercise your rights?
Send your request to [email protected] or via the Contact page and describe the right you wish to exercise.
To protect data, we may request reasonable additional information to confirm identity. We will not ask for more data than necessary for verification.
Complaints and supervisory authority
If you have concerns, we encourage you to contact us first to clarify the situation.
You have the right to file a complaint with the National Supervisory Authority for Personal Data Processing – ANSPDCP and to address competent courts.
Policy changes
We may update the policy to reflect legislative, technical, operational changes, or changes regarding services and providers.
The updated version is published on this page with the revision date. If a change significantly affects processing, we will provide additional information when necessary.
Contact for data protection
Operator: 2NDFACE ART GALLERY SRL
Salon: 2nd Face Tattoo & Body Piercing
E-mail: [email protected]
Phone: 0724 669 330
Work address: B-dul I.C. Brătianu 29–33, COCOR Store, basement, Sector 3, Bucharest.
GDPR FAQ
Frequently asked questions.
What data do you collect when I make an appointment?
Name, contact details, requested service, preferred date, and information necessary to prepare the procedure.
Do you sell my personal data?
No. We do not sell personal data. We only share it with necessary providers and recipients, in accordance with the law.
Can I request data deletion?
Yes, under GDPR conditions. Some data cannot be deleted immediately if there are legal retention obligations or the need to defend rights.
How do I withdraw consent for a photo?
Send a request to the data protection email address. Withdrawal takes effect for the future.
Are card details stored by the studio?
Complete card details are managed by the payment processor. The studio receives transaction information and status, not the full card code.
Where can I file a GDPR complaint?
You can file a complaint with ANSPDCP and address competent courts.
