PRIVACY POLICY
Last updated: August 2026
At Killyan Tattoo Studio, we are committed to protecting the privacy and personal data of our clients and website users.
This Privacy Policy explains what personal data we may collect, how and why we use it, the legal basis for processing it, and your rights under the General Data Protection Regulation (GDPR) and applicable Spanish data protection legislation.
1. Data Controller
Data Controller: Ionut Raul Buftea
NIF/NIE: X9264534L
Trading name: Killyan Tattoo Studio
Address: Usandizaga Kalea 19, 20002 Donostia-San Sebastián, Gipuzkoa, Spain
Email: salondetatuajes@gmail.com
Telephone: 943 389 317
Website: salondetatuajeskillyan.com
2. What Personal Data We May Process
Depending on your relationship with us, we may process the following information:
Identification data, such as your first and last name.
Contact details, such as your telephone number and email address.
Information relating to appointments, enquiries and requested services.
Information required for invoicing, where applicable.
Photographs or images of tattoos, piercings or work carried out, where permission has been given for their use.
Information voluntarily provided through telephone, email, WhatsApp, social media or other contact methods.
Technical information related to your use of our website, where applicable, in accordance with our Cookie Policy.
For certain services, it may be necessary to ask about allergies, medical conditions, medication, skin conditions or other circumstances that may affect the safe performance of a tattoo or piercing.
Health-related information is considered a special category of personal data and receives enhanced protection. Where such information needs to be processed, explicit consent will be requested and the information will only be used for the purpose for which it was collected.
3. Why We Use Your Personal Data
Personal data may be processed for the following purposes:
Appointments and enquiries
To respond to requests for information and manage appointments for tattoos, piercings, tattoo courses or other services offered by the studio.
Provision of services
To properly manage the service requested and maintain the necessary communication with the client.
Administration and invoicing
To comply with our administrative, accounting, tax and legal obligations.
Service safety
Where necessary, to assess information provided by the client in order to ensure that a service can be carried out safely and appropriately.
Tattoo courses
To manage enquiries, bookings, registrations and participation in training courses offered by Killyan Tattoo Studio.
Photographs and portfolio
Where the client has expressly authorised it, we may use photographs of completed work in our portfolio, website, social media or promotional materials.
Marketing communications
We will only send promotional communications, news or offers where there is a lawful basis to do so and, where required, where you have previously given your consent.
4. Legal Basis for Processing
The legal basis for processing your information depends on the purpose for which it is used.
For appointments, quotations, bookings and the provision of services, processing is based on taking pre-contractual measures at the request of the individual and on the performance of a contractual relationship.
For tax, accounting, administrative and other legal obligations, processing is based on compliance with applicable law.
Where photographs are used for promotional purposes or certain marketing communications are sent, processing will be based on the individual’s consent when required.
Where health-related information or other special categories of personal data are processed, explicit consent will be requested where this is the applicable legal basis.
5. How Long We Keep Your Data
Personal data will only be retained for as long as necessary to fulfil the purpose for which it was collected.
Afterwards, information may be securely retained or blocked for the periods required to comply with possible legal, tax, administrative or contractual responsibilities.
Information processed solely on the basis of consent will no longer be used when consent is withdrawn, without affecting the lawfulness of processing carried out before its withdrawal.
Photographs authorised for use in our portfolio or promotional materials may be kept for as long as the authorisation remains valid or until the individual requests their removal, where legally applicable.
6. Sharing Personal Data with Third Parties
As a general rule, we do not sell personal data or transfer it to third parties for their own purposes.
Certain service providers may have access to information where necessary for the operation of our business, including:
Website hosting and IT maintenance providers.
Email and communication service providers.
Appointment or messaging services.
Accounting and tax advisers.
Banks and payment service providers.
Legal professionals, where necessary.
Public authorities, courts and other official bodies where required by law.
These providers may only access information necessary to provide their services and must comply with applicable data protection requirements.
7. WhatsApp, Social Media and External Services
If you contact us through WhatsApp, Instagram, Facebook or other external platforms, those companies may also process certain personal data in accordance with their own privacy policies.
Some providers may process information from countries outside the European Economic Area. Where applicable, international data transfers must be carried out using the safeguards and mechanisms required under the GDPR.
8. Photographs of Tattoos and Piercings
We may ask for permission to photograph the result of certain tattoos, piercings or other services.
Photographs in which a person can be identified will only be published on our website, social media, portfolio or promotional materials where there is a lawful basis for doing so.
Permission for promotional use is separate from the provision of the service and may be withdrawn in relation to future use, where legally applicable.
9. Minors
Personal data relating to minors will be processed with particular care and in accordance with applicable legislation.
Under Spanish data protection legislation, where processing is based on consent, children under the age of 14 generally require consent from their parents or legal guardians. From the age of 14, minors may generally provide consent for the processing of their personal data themselves, except where specific legislation requires the involvement of their legal representatives.
These data protection rules are separate from any specific legal requirements that may apply to tattoos, piercings or other services provided to minors.
10. Your Data Protection Rights
You may exercise the rights recognised under applicable data protection legislation, including:
Right of access: to find out what personal data we hold about you.
Right to rectification: to request correction of inaccurate or incomplete information.
Right to erasure: to request deletion of your personal data where legally applicable.
Right to object: to object to certain types of processing.
Right to restriction of processing: to request that the use of your personal data be temporarily restricted in certain circumstances.
Right to data portability: to receive certain personal data in a structured format and transmit it to another data controller where applicable.
Right to withdraw consent: to withdraw previously given consent at any time.
To exercise any of these rights, please contact:
Please state which right you wish to exercise and provide any information reasonably necessary to verify your identity when required.
You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos – AEPD) if you believe that your personal data has been processed in breach of applicable data protection legislation.
11. Data Security
We implement appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, alteration or disclosure.
However, no system connected to the Internet can guarantee absolute security.
12. Automated Decision-Making
We do not use personal data to make decisions based solely on automated processing that produce legal effects or similarly significantly affect users.
13. Cookies
Our website may use cookies and similar technologies.
Information about the cookies used, their purpose, duration and how to configure or reject them is available in our Cookie Policy.
14. Changes to This Privacy Policy
We may update this Privacy Policy to reflect changes in legislation, technology or the services offered by Killyan Tattoo Studio.
Where significant changes are made, the date of the latest update will be shown on this page.