Privacy policy

01Who processes your data

The data controller is the studio, whose details are listed at the top of this page. For any question or request about your data, email us or ask at the studio.

The studio has not appointed a data protection officer, as the law does not require one for this kind of business. Requests are handled directly by the studio's management.

02What data we process

• When you book online: first and last name, phone number, the chosen day and time, an optional comment and the page language. Each booking gets a short code we use to find it at the studio.
• At the studio, before a procedure: we may ask you to fill in a consent form that includes information about your health (for example allergies, pregnancy or medication) and to show an identity document to confirm your age.
• Photos: we take and publish photos of your piercing only with your consent.
• Technical data: when you open the site, the hosting provider automatically records your IP address, browser type and the time of the request. We use this only to keep the site secure and working.

Please do not put health information in the booking comment. We collect it at the studio, with your written consent.

03Why we process it, and on what basis

• Planning your visit: we contact you by phone or messenger to receive, confirm, change or cancel a booking. Basis: concluding and performing the service contract at your request.
• Performing the procedure safely: we process health data only with your written consent, or for a minor, the written consent of a parent or legal representative.
• Confirming your age: to provide the service lawfully.
• Protecting the site and booking system from abuse: the studio's legitimate interest in a secure, working website.
• Legal obligations: for example accounting records or a lawful request from a public authority.
• Publishing photos in our gallery or on Instagram: only with your consent, which you can withdraw at any time.

We do not send marketing messages, sell data, or use it for profiling or automated decisions.

04Do you have to provide your data

For an online booking, your first name, last name and phone number are required: without them we cannot contact you or confirm the booking. The comment is optional. If you prefer not to book online, message us on Instagram or visit the studio.

05Who receives your data

Only authorised studio staff can access your data. The site runs on service providers that process data only on our instructions and under contract:

• Vercel Inc.: website hosting, servers in Frankfurt (Germany).
• Neon: the bookings database, servers in Frankfurt (Germany).

If you message us on Instagram, the conversation is stored in Meta's systems under Meta's terms. We disclose data to public authorities only where the law requires it.

06Transfers abroad

Website data is stored in data centres in Germany, in the European Union. Germany provides adequate safeguards for personal data, and transfers are made in line with the law.

07How long we keep data

• Online bookings (including cancelled ones): 2 years from the visit date, after which they are deleted automatically. This matches the period in which a consumer can raise a claim about a service.
• Consent forms and health information: no longer than 2 years after the procedure, unless the law requires longer.
• Photos: until you withdraw consent.
• Technical logs: briefly, no longer than 30 days.
• Accounting records: for the period set by Georgian law.

08Security

The site works only over an encrypted connection (HTTPS). Only studio staff with personal accounts can access bookings, passwords are stored hashed, and access to the database is restricted.

In the event of a data breach we notify the State Audit Office of Georgia within 72 hours, as the law requires, and we tell you without delay if it is likely to cause you significant harm.

09Your rights

Under the law you have the right to:

• know whether the studio processes your data, for what purpose and on what basis;
• access your data and receive a copy;
• have inaccurate or incomplete data corrected and updated;
• have processing stopped, or your data erased or destroyed;
• have your data blocked;
• receive the data you provided in a structured electronic format, or have it sent to another controller where technically possible;
• withdraw consent at any time without giving a reason. Withdrawal does not affect processing carried out before it.

We handle requests free of charge and reply within 10 working days. In exceptional cases this may be extended by up to 10 more working days, and we will tell you in advance. We may ask you to confirm your identity so that your data is not disclosed to someone else.

10Minors

Processing the data of a person under 16 requires the consent of a parent or legal representative, so a visit for someone under 16 must be booked by their parent or legal representative. We process health data of anyone under 18 only with the written consent of a parent or legal representative.

11Cookies and tracking

The public site uses no cookies, analytics, advertising or tracking tools. Fonts and images load from our own server, so no information about your visit is passed to third parties.

The only cookie is used in the studio's admin panel to keep staff signed in. It is strictly necessary and does not apply to visitors. Following the Instagram link takes you to Meta's site, where its own terms apply.

12Complaints

If you believe your rights have been breached, please contact us first and we will try to resolve it quickly. You also have the right to complain to the State Audit Office of Georgia, which has supervised personal data protection since 2 March 2026, or to go to court.

13Changes

When we update this policy we change the date on this page. Significant changes will be shown prominently on the site.