Privacy policy

Who is responsible

Timeless AS is the data controller for personal data processed through timelesstattoo.pro and in our contact with customers. This policy explains what data we process, why, how long we keep it, and what your rights are.

Timeless AS
Org. no. 925 925 691
Hegdehaugsveien 23, 0352 Oslo, Norway
Email: post@timelesstattoo.pro
Phone: +47 950 72 138

When you send us a request

When you use the booking and request forms on the website, we process the information you provide:

• Name, email address and phone number
• A description of the tattoo you want, such as motif, size, placement and colours, and whether it is a cover-up
• Photos you choose to upload, such as reference images or photos of an existing tattoo

We use this to reply to you, find the right artist, give a price estimate and book an appointment. The legal basis is that the processing is necessary to take steps at your request before entering into an agreement (GDPR Article 6(1)(b)).

The form is sent to us by email. Photos you upload are stored only temporarily while the email is sent, and are automatically deleted from storage as soon as it has been sent. After that, the photos exist only as attachments to the email we receive.

Please avoid sharing health information or other sensitive data in the form. If you have questions about health and tattooing, we would rather discuss them with you directly.

When you contact us in other ways

If you message us through the contact form, by email, by phone or on social media, we process your name, contact details and what you write to us in order to reply. The legal basis is our legitimate interest in answering enquiries (Article 6(1)(f)), or that the enquiry concerns an agreement with you (Article 6(1)(b)).

When you are a customer

Once you have booked an appointment, we process information about the appointment, our contact with you and your payment. The legal basis is our agreement with you (Article 6(1)(b)) and the Norwegian Accounting Act (Article 6(1)(c)).

Information collected in connection with the tattoo itself, such as the consent and health declaration you fill in before your appointment, is handled digitally by Linework (linework.com). You will receive separate information there about how that data is processed.

Cookies and statistics

We use Cookiebot to ask for your consent before using cookies that are not strictly necessary. Our cookie declaration lists the cookies we use, and you can change or withdraw your consent there at any time.

We use Google Analytics to understand how the website is used, such as which pages are visited, whether a form was sent (not its content), and clicks on phone, email and gift card links. Google Analytics only uses cookies if you have consented to statistics (Article 6(1)(a)). Without consent, only anonymous, cookieless signals are sent. We do not use this data to identify you, and we do not use advertising tracking on the website.

The map on the contact page is loaded from Google Maps. When the map is shown, Google receives your IP address, among other things.

When you visit the website, our hosting provider records technical information such as IP address, browser type and time in server logs. This is necessary to deliver the website and protect it against abuse (legitimate interest, Article 6(1)(f)).

Gift cards and links to other services

Gift cards are sold through an external gift card service. When you buy a gift card there, that provider's terms and privacy policy apply. The same goes for Instagram, Facebook and other services we link to.

Who we share data with

We do not sell personal data. We use the following providers (data processors), who may only process the data on our instructions:

• Supabase: receives and forwards the forms and temporarily stores uploaded photos
• Resend: sends the forms to us by email
• Netlify: hosts the website
• Google: statistics (Google Analytics) and maps (Google Maps)
• Cybot (Cookiebot): manages cookie consent
• Linework: digital consent and health declarations
• Our email provider, which stores the emails we receive
• Our accountant, for bookkeeping and payments

We may also disclose data when required to do so by law.

Transfers outside the EU/EEA

Some of our providers are US companies, and data may be processed in the United States. Such transfers are based on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses, so your data is protected at a level equivalent to that in the EU/EEA.

How long we keep data

• Requests and photos from the forms: until the enquiry is closed, and no later than 12 months after our last contact if you do not become a customer
• Customer and appointment information: for as long as the customer relationship lasts and the data is needed
• Accounting records: 5 years, as required by the Norwegian Accounting Act
• Statistics in Google Analytics: 14 months
• Server logs: a short period, as kept by our hosting provider for security purposes

Your rights

You have the right to access the data we hold about you and to have it corrected or deleted. You can also ask us to restrict processing, object to processing based on legitimate interest, and receive data you have given us in a portable format. Where you have given consent, you can withdraw it at any time.

Contact us at post@timelesstattoo.pro and we will reply within 30 days. If you believe we are processing your data unlawfully, you can complain to the Norwegian Data Protection Authority (Datatilsynet). We would appreciate the chance to resolve it with you first.

Age limit

We only tattoo people aged 18 or over, and the website and forms are not directed at children.

Security

The website and forms use an encrypted connection (HTTPS). Access to personal data is limited to those who need it, and photos from the forms are automatically deleted from storage once they have been sent to us.

Changes

We update this policy when we change how we process personal data. The date at the bottom shows when it was last changed.