Privacy and cookie policy
In short: booking details are used only for consultation and booking, and visitor analytics starts only after you consent.
Version dated 22 August 2026.
1. Controller and contact
The data controller is Mikołaj Goncharuk, operating under the Karma Tattoo name.
For data matters, email kontakt@karmatattoo.ink or message @karmatattoo on Telegram. Sessions take place at Sagma Tattoo Gallery, Kolejowa 45A/U22, 01-210 Warsaw; this is a workplace and does not imply ownership of the studio.
2. Data we process
The booking form contains the selected date and time, tattoo direction, placement and size, project description, name, messenger contact or phone number, and an optional email address.
The server may process technical connection data needed for security. For rate limiting, the IP address is immediately converted into a non-reversible HMAC hash and the rate-limit record is deleted after 2 days.
After voluntary consent, Yandex Metrica and tags managed by Google Tag Manager may record anonymous visit steps and first-touch source data: entry path, referring domain, UTM campaign parameters and a click identifier. This limited browser record lasts up to 90 days. Form contents and contact or booking details are not sent to analytics.
3. Purposes and legal bases
- replying, consultation and booking arrangements — steps before a contract, GDPR Art. 6(1)(b);
- site security, abuse prevention and legal claims — legitimate interests, Art. 6(1)(f);
- legal duties if they arise — Art. 6(1)(c);
- visitor analytics — consent only, Art. 6(1)(a) and Polish Electronic Communications Law Art. 399.
4. Recipients and external services
Data may be processed only as needed by Namecheap hosting, Yandex Metrica, Google Tag Manager, the website's technical administrator and, if you choose that channel, Telegram.
Google Tag Manager loads only after analytics consent and is used to manage measurement tags. Google Analytics 4 is not currently active because no measurement ID is configured.
Some providers may process data outside the EEA using safeguards described in their contracts and policies, including Standard Contractual Clauses where required.
5. Retention
- booking requests in the site database — up to 365 days after the last change;
- abuse-prevention data — 2 days;
- browser analytics choice — 180 days;
- messages — only as long as needed for consultation, agreed work or legal claims;
- legally required records — for the applicable statutory period.
6. Your rights
You may request access, correction, deletion, restriction, portability where applicable, or object to processing. Withdraw analytics consent at any time through “Privacy settings” in the footer; withdrawal does not affect earlier lawful processing.
You may complain to the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw. Form data is voluntary, but without contact details we cannot reply or book a date. We do not use automated decision-making or profiling.
7. Cookies and browser storage
Essential mechanisms work without consent. Analytics scripts and cookies start only after “Accept analytics”. After consent, limited first-visit source data is kept in browser storage for up to 90 days; booking details are never included. Refusing does not limit booking, portfolio or contact features.
Storage used
| Name | Purpose | Duration | Category |
|---|---|---|---|
| karma_booking | Form and admin session security | browser session | essential |
| karma_analytics_consent_v1 | Remember privacy choice | 180 days | essential / localStorage |
| karma_analytics_attribution_v1 | First visit source and entry path for analytics | 90 days after consent | analytics / localStorage |
| _ym_* and similar | Yandex Metrica visit statistics | per Yandex settings | analytics, after consent |
| _ga, _ga_* | Google Analytics 4, only after future activation | per Google settings | analytics, after consent |