Data Protection & Handling Policy

1. GDPR Compliance

TATT00 complies fully with the General Data Protection Regulation (GDPR) and treats all personal data with the highest level of protection and care.

2. Data Controller & Processor

Data Controller: TATT00 Studio, 123 Ink Street, Your City, ST 12345
Contact: privacy@tatt00.com
Data Protection Officer: Available upon request

3. Lawful Basis for Processing

We process personal data based on:

• Consent: For marketing communications and non-essential cookies
• Contract Performance: For booking and service delivery
• Legal Obligation: For health and safety records, tax compliance
• Legitimate Interests: For website improvement and fraud prevention

4. Types of Data We Collect

• Identity data (name, date of birth)
• Contact data (email, phone, address)
• Appointment data (dates, times, services, design details)
• Health data (allergies, skin conditions) - collected with explicit consent
• Payment data - processed securely, never stored in full
• Technical data (IP address, browser type, pages visited)
• Marketing data (preferences, communication history)

5. Data Retention

6. Data Security Measures

We implement comprehensive security measures:

• 256-bit SSL/TLS encryption for all data transmission
• Secure password hashing and storage
• Regular security audits and penetration testing
• Access controls limiting data to authorized personnel only
• Secure data backup with encryption
• Incident response plan for data breaches
• Staff training on data protection and privacy

7. Third-Party Processors

We use the following third-party processors with Data Processing Agreements in place:

• Booking System: [Processor Name] - GDPR compliant
• Payment Gateway: [Processor Name] - PCI-DSS certified
• Email Service: [Processor Name] - GDPR compliant
• Analytics: [Processor Name] - Data anonymization enabled
• Cloud Storage: [Processor Name] - GDPR compliant

8. International Data Transfers

If your data is transferred outside your jurisdiction, we ensure appropriate safeguards such as Standard Contractual Clauses, Binding Corporate Rules, or adequacy decisions.

9. Your Data Rights

Under GDPR, you have the following rights:

• Right to Access: Obtain a copy of your personal data
• Right to Rectification: Correct inaccurate data
• Right to Erasure: Request deletion ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data
• Right to Data Portability: Receive data in a machine-readable format
• Right to Object: Opt-out of certain processing activities
• Rights related to Automated Decision Making: Not be subject to fully automated decisions

10. How to Exercise Your Rights

To exercise any of your rights, please contact us with a written request including:

• Your full name and contact information
• A clear description of your request
• Any relevant appointment or reference numbers
• A copy of your ID for verification purposes

Contact: privacy@tatt00.com or mail to 123 Ink Street, Your City, ST 12345

11. Data Breach Notification

In the event of a data breach affecting your personal data, we will notify you and relevant authorities within 72 hours as required by law.

12. Consent Management

You can manage your consent preferences at any time by:

• Updating settings in your account portal
• Clicking "unsubscribe" in marketing emails
• Emailing privacy@tatt00.com
• Calling (123) 456-7890

13. Children's Privacy

TATT00 does not knowingly collect personal data from children under 13. If we become aware that such data has been collected, we will delete it immediately. For minors under 18, parental consent is required.

14. Complaints & Oversight

If you believe we have violated your data protection rights, you may file a complaint with:

• Your Local Data Protection Authority (DPA or equivalent)
• TATT00's Data Protection Officer at privacy@tatt00.com

15. Policy Changes

We may update this policy periodically. We will notify you of significant changes via email or by prominently displaying the notice on our website.