Privacy Policy

veda.ink is the trading name of Karina Viktorova, a self-employed tattoo artist (sole trader) based in Brighton, United Kingdom, who is the data controller for the personal data described in this policy.

Postal address: Flat 19, 30 South Street, Brighton BN41 2AQ, United Kingdom. For anything to do with your data, email Veda.inktattoo@gmail.com.

• Request form: your name, email address, phone number (optional), Instagram handle (optional), the description of the tattoo you have in mind, a reference link (optional) and any reference photos you attach (optional, up to six).
• Where you came from: if you arrive from an advert or a tagged link, the campaign parameters in that link (utm_*, gclid, fbclid) and the page you landed on are saved together with your request, so I can tell which adverts actually bring enquiries.
• Technical data: your IP address is held briefly to limit repeated submissions and uploads (spam protection), and appears in the short-lived server logs kept by the hosting provider.
• Cookies and analytics: only if you accept them in the cookie banner — see section 7.

Please do not include health information in the form (allergies, skin conditions, medication, pregnancy and the like). Anything of that kind is discussed at the consultation and recorded only with your explicit consent (UK GDPR Article 9(2)(a)).

This site and the tattooing service are for adults only — it is a criminal offence to tattoo anyone under 18 in the UK — and I do not knowingly collect data from under-18s.

• Replying to your request, consulting, quoting and booking — Article 6(1)(b): steps taken at your request before entering into a contract, and performing that contract.
• Sending you a confirmation that your request arrived — Article 6(1)(b).
• Keeping a record of enquiries and which adverts produced them — Article 6(1)(f), my legitimate interest in running and advertising a small business. You can object at any time (section 8).
• Preventing spam and abuse (hidden form fields, submission limits per connection, checks on uploaded files) — Article 6(1)(f).
• Analytics and advertising measurement cookies — Article 6(1)(a), your consent, and PECR regulation 6. You can withdraw it at any time via “Cookie preferences” in the footer.
• Meeting legal obligations such as tax, insurance and the consent and age records required for tattoo procedures — Article 6(1)(c).

No decisions about you are made by automated means, and your data is never sold.

Your data is handled by a small number of service providers that process it on my instructions under written data-processing terms:

• Vercel Inc. (USA) — website hosting, and the private file storage that holds reference photos. Photos are never publicly accessible.
• Neon Inc. — the database in which requests are stored, hosted on Amazon Web Services in London (United Kingdom).
• Resend Inc. (USA) — sends the notification and confirmation emails.
• Google (Google LLC / Google Ireland Ltd) — Gmail, used for email correspondence with you; Google Analytics 4 and Google Ads, only if you accept cookies.
• Meta Platforms Ireland Ltd — Meta Pixel, only if you accept cookies; and Instagram, if you choose to message me there.
• Telegram FZ-LLC — may be used to send me an instant alert that a new request has arrived.

Google and Meta also use the data collected through their advertising tools for their own purposes, as described in their respective privacy policies. Beyond these providers, your data is disclosed only where the law requires it.

Some of the providers above are based in the United States. Where data leaves the UK it is protected by the UK Extension to the EU-US Data Privacy Framework (the “UK-US data bridge”) for providers certified under it, and otherwise by the ICO’s International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.

• Requests that do not lead to a booking: deleted 12 months after the last update to the request.
• Requests from clients who booked: 6 years after the last update, because of UK limitation periods and tax and insurance record-keeping.
• Reference photos: deleted together with the request they belong to. Photos uploaded but never sent with a request are removed within 24 hours.
• Spam-protection records (IP-based submission counters): expire after 10 minutes and are purged within 24 hours.
• Emails: copies in my mailbox follow the same periods as the request; Resend keeps delivery logs according to its own retention policy.

Deletion runs automatically every night. You can ask for your data to be deleted sooner at any time — see section 8.

Always on — needed for the site to work, no consent required:

• cookie-consent (browser storage) — remembers whether you accepted or declined cookies, until you clear it or change your choice.
• lead_submitted (cookie, 10 minutes) — a random one-time marker set when you send a request, so the “thank you” page can record the request once. It contains nothing about you.
• admin_session (cookie) — only ever set for the site owner when logged into the admin area.

Only with your consent — analytics and advertising measurement:

• _ga, _ga_* — Google Analytics 4, up to 2 years. Which pages are visited and whether a request is sent.
• _gcl_au, _gcl_aw — Google Ads, 90 days. Links a request back to the Google advert that was clicked.
• _fbp, _fbc — Meta Pixel, 90 days. The same, for Meta (Facebook/Instagram) adverts.

Until you choose, the Google tags run in Google’s “consent denied” mode: they set no cookies and send only anonymous, cookieless signals that Google uses for aggregate conversion modelling. The Meta Pixel does not load at all until you accept. Declining never affects your ability to send a request. You can change your mind at any time via “Cookie preferences” in the footer — declining after an earlier acceptance removes the cookies above and switches the tags back to denied.

Under the UK GDPR you can ask me to:

• give you a copy of the personal data I hold about you (access);
• correct anything that is inaccurate (rectification);
• delete your data (erasure);
• stop or limit how it is used (restriction and objection);
• give you your data in a portable, machine-readable form (portability);
• withdraw consent to cookies at any time, without affecting what was done before you withdrew it.

To exercise any of these, email Veda.inktattoo@gmail.com. I will respond within one month and may ask you to confirm your identity first. There is no charge.

If you are unhappy with how your data has been handled, I would welcome the chance to put it right first — but you also have the right to complain to the UK supervisory authority, the Information Commissioner’s Office (ICO): ico.org.uk/make-a-complaint, helpline 0303 123 1113, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

The site is served over HTTPS only. Reference photos are stored in a private store that is not publicly reachable; uploads are limited in size and checked on the server to be genuine image files. Requests are visible only to the artist, through a password-protected admin area.

Any changes will be published on this page with a new “last updated” date. Significant changes affecting requests already received will be communicated by email where possible.