PRIVACY POLICY

1. Controller

Sarah Drotleff & Christian Kainz GbR (“SAKRIS®”)
Ringstraße 21, 89192 Rammingen, Germany
Studio: Bäckergasse 23, 86150 Augsburg
Phone: +49 176 5999 48 11
Email: contact@sakris.space

We are not required to appoint a data protection officer. For any data protection questions, you can reach us using the contact details above.

2. Hosting and provision of the website

This website is provided via the Lovable platform (Lovable Cloud). Pages are delivered and server-side functions are executed via a globally distributed infrastructure based on Cloudflare Workers. Each visit involves the processing of technically necessary data, in particular IP address, date and time, the page requested, referrer URL, and browser and operating system information. We need this data to deliver the website, to ensure its stability and security, and to analyse errors.

The legal basis is our legitimate interest in a secure and functional website (Art. 6(1)(f) GDPR). Information on your device is accessed only to the extent strictly necessary for the service you have requested (Section 25(2) no. 2 TDDDG).

If a technical error occurs while the website loads, an error report (e.g. error message, affected page, browser information) may be sent to the platform provider so that the error can be fixed (Art. 6(1)(f) GDPR).

Our service providers may also process data outside the European Union or the European Economic Area, in particular in the USA. Such transfers take place only in accordance with Art. 44 et seq. GDPR, for example on the basis of an adequacy decision of the European Commission (e.g. the EU-U.S. Data Privacy Framework, where the recipient is certified) or EU Standard Contractual Clauses.

3. Cookies and consent management (CookieYes)

We use the consent management solution CookieYes to obtain, store and document your choices regarding cookies and similar technologies. This involves processing your choice, a timestamp and technical data such as IP address and browser information; your choice is stored in a cookie on your device. The script is loaded from CookieYes servers.

The legal basis is the fulfilment of our legal obligation to obtain consent and to be able to demonstrate it (Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR) and Section 25(2) no. 2 TDDDG for storing your choice.

You can change or withdraw your choice at any time via the “Cookie settings” link in the website footer. Withdrawal takes effect for the future.

In addition, after you have successfully sent an enquiry, the website stores a random identifier in your browser’s session storage (sessionStorage). It is used solely to show you the correct thank-you page and is deleted when you close the tab (Section 25(2) no. 2 TDDDG).

4. Analytics and advertising services

We currently do not use any analytics or advertising services on this website; no tracking for analytics or advertising purposes takes place. Should we use such services in the future (e.g. Google Ads conversion tracking), this will happen only after your prior consent via the cookie settings. We will update this privacy policy accordingly beforehand.

5. Protection against spam and abuse (Cloudflare Turnstile)

To protect our forms against automated requests (spam, bots), we use Cloudflare Turnstile, a service of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Turnstile is loaded only on pages with an enquiry form. In particular, your IP address and browser and device information are transmitted to Cloudflare and analysed there to check whether the request comes from a human. Our server verifies the result with Cloudflare.

The legal basis is our legitimate interest in the security of our website and in protection against abuse (Art. 6(1)(f) GDPR); access to information on your device is strictly necessary for this purpose (Section 25(2) no. 2 TDDDG). A transfer to the USA is possible; see section 2 on third-country transfers.

In addition, we store a pseudonymised check value (hash) with each enquiry, derived from technical characteristics of your request, in order to limit repeated mass submissions (Art. 6(1)(f) GDPR).

6. Free consultation (Mindful Tattooing™ enquiry)

If you request a consultation via the homepage or the “Free consultation” page, we process the following information:

• Details of your tattoo: type, idea or description, placement and size
• reference images you choose to upload (up to five images)
• first and last name, email address and phone number
• date of birth, to check that you are of legal age
• time of the enquiry and technical processing status

We use this data to process your enquiry, to contact you and to prepare a consultation or appointment. The legal basis is the performance of pre-contractual measures at your request (Art. 6(1)(b) GDPR). Checking your age also serves our legitimate interest in tattooing adults only (Art. 6(1)(f) GDPR).

The enquiry is stored in a database that is not publicly accessible; uploaded images are kept in a private storage area. We receive an email notification at contact@sakris.space; images can be accessed there only via time-limited, protected links that expire after seven days. You receive an email confirming receipt. To send emails, we use the email service of the Lovable platform (sender domain notify.mail.sakris.space).

We cannot process your enquiry without the mandatory information. The enquiry is non-binding and does not yet create a contract.

7. Health data and other sensitive information

Information about your health (e.g. allergies, skin conditions, scars, medication, pregnancy) belongs to the special categories of personal data (Art. 9 GDPR). We do not need such information for the online enquiry. Please therefore do not send it via the forms.

We discuss health-related information that is necessary for a safe tattoo or mindfulness session in person before the appointment. Where we record it, we obtain your explicit consent separately (Art. 9(2)(a) GDPR). Confirming this privacy policy in the form does not constitute such consent.

If you nevertheless voluntarily provide such information in free-text fields or images (e.g. for a scar cover-up), we use it solely to process your enquiry, address the topic in the consultation and delete any information that is not needed.

8. Other enquiries: Mindfulness, Mobile Tattooing & Events, The Space

For enquiries via our other forms, we process:

• Mindfulness: the selected offer, name, email, phone number, an optional message and – for a voucher – whether it is a gift and the name of the recipient
• Mobile Tattooing & Events: type of event, name, email, phone number, date or period, location, number of guests, package or duration and an optional message
• Hiring The Space: name, email, phone number, practice or type of use, package, requested dates (one-off or recurring), number of people and optional notes

The purpose is to process your enquiry and prepare an offer or contract (Art. 6(1)(b) GDPR). Storage, email notification to us, confirmation of receipt to you and spam protection take place as described in sections 5 and 6.

If you provide the name of a gift recipient, please make sure you are entitled to do so. We use this name only to issue the voucher.

9. Contact by email or phone

If you contact us by email or phone, we process your information to deal with your request (Art. 6(1)(b) GDPR for contract-related requests, otherwise Art. 6(1)(f) GDPR).

10. External links, Instagram and Google Maps

Our website contains simple links to our Instagram profiles and to Google Maps. These are not embedded content: no data is transferred to these providers merely by visiting our website. Only when you click a link are you forwarded to the respective provider (Meta Platforms Ireland Ltd. or Google Ireland Ltd.), which then processes data under its own responsibility. Please refer to these providers’ privacy notices.

11. Fonts and media

Fonts, images and videos are delivered from our own website infrastructure. We do not embed Google Fonts, YouTube or Vimeo videos or map services.

12. Recipients and service providers

Your data is received only by the partners of SAKRIS® and by technical service providers we use to provide the website and process enquiries:

• Lovable (website platform, database, file storage, email delivery)
• Cloudflare (infrastructure for delivering the website, Turnstile spam protection)
• CookieYes (consent management)
• our email provider for the contact@sakris.space mailbox

Data is passed on to other third parties only if you have consented or we are legally obliged to do so. We do not sell personal data.

13. Retention period

We store personal data only for as long as necessary for the respective purpose:

• Enquiries that do not lead to a contract are deleted once they have been fully processed and no further communication is expected.
• If a contract is concluded, we store the data for the duration of the contract and beyond that where statutory retention obligations apply (in particular under commercial and tax law, up to ten years) or where this is necessary to assert or defend legal claims.
• Reference images are deleted once they are no longer needed for consultation and design.
• Your cookie choice is stored in accordance with the settings of the consent management tool until you change or delete it.

Stored enquiries are currently not deleted automatically; deletion is carried out by us.

14. Your rights

Subject to the statutory requirements, you have the right of access (Art. 15 GDPR), rectification (Art. 16 GDPR), erasure (Art. 17 GDPR), restriction of processing (Art. 18 GDPR), data portability (Art. 20 GDPR) and the right to withdraw any consent given at any time with effect for the future (Art. 7(3) GDPR).

Right to object: Where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Simply contact us at contact@sakris.space. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR).

15. Automated decisions and changes

No automated decision-making, including profiling (Art. 22 GDPR), takes place. We will update this privacy policy if the website, our service providers or the legal situation change. The version published here applies.

This English version is provided for convenience. In the event of any discrepancy, the German version shall prevail.