Privacy Policy
1. Controller
Laura Molter Mohnstr. 30 01127 Dresden Germany Email: laurea.ink@gmail.com
2. Data collected and purposes
When you fill out the contact and inquiry form on this website, I collect the following data: first and last name, email address, optional phone number, the details about the desired tattoo (body location, size, description), the preferred timeframe, any uploaded reference images, the voluntary information on how you found me, and the language you selected (German/English) for further communication. The purpose of the processing is to handle your tattoo inquiry and communicate with you regarding a potential appointment. Note on special categories of data: Your details about the desired motif, the body location, and any uploaded reference images may allow conclusions to be drawn about special categories of personal data within the meaning of Art. 9 GDPR (in particular health data, and possibly indications of religious or philosophical beliefs). I treat such details as especially sensitive (see section 3).
3. Legal basis
Your general inquiry data is processed on the basis of Art. 6(1)(b) GDPR (contract initiation or performance), to the extent that your inquiry is aimed at concluding a tattoo contract. Otherwise, I base processing on Art. 6(1)(f) GDPR (legitimate interest in responding to inquiries). Where your details contain special categories of personal data within the meaning of Art. 9(1) GDPR (e.g. health-related information that may arise from the motif, body location, or reference images), I process these solely on the basis of your explicit consent pursuant to Art. 9(2)(a) GDPR. You give this consent separately when submitting the form, via a dedicated checkbox. You may withdraw it at any time with effect for the future (Art. 7(3) GDPR); the lawfulness of processing carried out before withdrawal remains unaffected.
4. Retention period
Inquiry data and uploaded reference images are automatically deleted no later than 180 days after the last contact, provided no contractual relationship has arisen. Data from confirmed bookings is retained in accordance with statutory retention obligations (in particular §§ 147 AO, 257 HGB).
5. Recipients and processors
Your data is not generally passed on to third parties. I use the following service providers to operate this website, with whom data processing agreements pursuant to Art. 28 GDPR have been concluded or who provide sufficient guarantees within the meaning of the GDPR: • Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (hosting infrastructure, servers in Germany) • Brevo GmbH (formerly Sendinblue), Köpenicker Str. 126, 10179 Berlin, Germany (email delivery for customer inquiries; servers in the EU; DPA included in their terms) • Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Gmail SMTP for notifications to me; a transfer to the US is possible. The legal basis for this is the European Commission's adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework, under which Google LLC is certified; the certification can be viewed at www.dataprivacyframework.gov)
6. Hosting and technical infrastructure
This website is hosted on the infrastructure of Hetzner Online GmbH (Germany). When you access the website, the hosting provider stores technical access data (IP address, time, page accessed, browser type) in server-side log files for up to 14 days. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in ensuring secure operation). No cookies are set on this website. To store your language choice (German/English) I use a technically necessary entry in your browser's local storage (localStorage, key “laurea_lang”). It contains no personal data and serves solely the language setting you selected; no consent is required for this under § 25(2) no. 2 TDDDG.
7. Web analytics (Umami)
To analyse website usage statistically, I use Umami, a self-hosted, privacy-friendly analytics software. Umami runs exclusively on my own server infrastructure at Hetzner Online GmbH in Germany; no data is transferred to third parties or to third countries. Umami does not set cookies and does not use cross-device recognition. Only aggregated data that cannot be linked to an identifiable person is collected: pages accessed, date and time of access, the referring page (referrer), the approximate country-level location, and the browser, operating system and device type used. The IP address is used only to derive this information and is not stored; no full IP addresses are retained. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in privacy-friendly, anonymous audience measurement to improve my services). Objection: You can object to this collection by enabling the “Do Not Track” (DNT) feature in your browser — Umami respects this signal and suppresses data collection.
8. Instagram gallery (Meta Graph API)
My gallery displays posts from the public Instagram profile @laurea.ink. The images are retrieved server-side via the official Meta Graph API and cached on my server in Germany. When you view the gallery, no data is transmitted from your browser directly to Meta — all images are loaded exclusively from my server. For the API retrieval itself (in the background, without user involvement), Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland, processes the profile's access credentials. Meta may transfer data to the US; any such transfer is based on the European Commission's adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework, under which Meta is certified (viewable at www.dataprivacyframework.gov). The legal basis for the API retrieval is Art. 6(1)(f) GDPR (legitimate interest in displaying my own portfolio). Note: This website does not use an embedded Instagram widget and does not transmit user data to Meta when a page is loaded.
9. Your rights
Under the GDPR you have the following rights against me as controller: • Access (Art. 15 GDPR): You may request information about the data stored about you. • Rectification (Art. 16 GDPR): You may request correction of inaccurate data. • Erasure (Art. 17 GDPR): You may request deletion of your data under certain conditions. • Restriction of processing (Art. 18 GDPR) • Data portability (Art. 20 GDPR) • Objection (Art. 21 GDPR): You may object to processing based on Art. 6(1)(f) GDPR. • Withdrawal of consent (Art. 7(3) GDPR) To exercise your rights, please contact me by email at laurea.ink@gmail.com.
10. Right to lodge a complaint
You have the right to lodge a complaint with the competent data protection supervisory authority. The competent authority for the Free State of Saxony (registered seat: Dresden) is: Sächsische Datenschutz- und Transparenzbeauftragte (Saxon Data Protection and Transparency Commissioner) Maternistraße 17 01067 Dresden, Germany Postal address: Postfach 11 01 32, 01330 Dresden Phone: +49 351 85471-101 Email: post@sdtb.sachsen.de Website: www.datenschutz.sachsen.de
11. Obligation to provide your data
Providing your data is neither legally nor contractually required. However, without the data marked as mandatory in the form (first and last name, email address, the details about the desired tattoo, and the preferred timeframe) I cannot process your inquiry. Providing a phone number, uploading reference images, and stating how you found me are optional and not strictly necessary for processing.