Privacy what I do with your data

The Kaiiza Tattoo website is run by Kajsa Charlotta Koskinen, as a sole proprietorship registered under Swiss business identification number CHE-238.087.387. The business is neither liable for VAT nor entered in the commercial register. Address: Grand Rue 10, 1844 Villeneuve, Vaud, Switzerland.

I am the one who decides what this site collects and what happens to it. In legal terms, I am the data controller.

For anything about this page or about your data, write to kaiiza.tattoo@gmail.com. It is the same address as for everything else: you reach me directly.

Amartato Studio is where I tattoo, nothing more. The studio does not run this site, does not receive project requests, and has access to neither your request nor our exchanges.

The description field asks about your desire, your ideas and your why, with no length limit. A tattoo project often starts with a story, and I would rather you told it the way it comes than squeezed it into boxes.

Which means you may well write, or show in the image you attach, things that legally count as sensitive data: a health condition, a scar, an operation, a pregnancy, a religious belief, a bereavement, something from your intimate life. You are under no obligation to, and nothing in the form asks you to.

If you do choose to write or show them, you expressly agree that I process them in order to understand your project, prepare the design and adapt the session. They are used for nothing else, they are passed to nobody beyond the technical providers described below, and they follow exactly the same retention periods as the rest of your request.

If you would rather not write any of that, just say you want to talk about it in person: we will go through it at the studio, with nothing written down.

I do not keep anything just in case. Each category has its own period, and I do the deleting myself, in Tally and in my mailbox.

A request that does not turn into a project: 30 days. After that I delete it from Tally and from my mailbox. If you write to me six months later, we start fresh, and that is perfectly fine.

A file that became a client file: 5 years after your last session. It lets me find what we did together, rework a piece, plan a follow-up, and answer if a question comes up later about a tattoo I did. Your response to the form, image included, is part of it: it stays in Tally for as long as the file does.

Emails and images sent by email: 90 days after the project closes. Whatever you sent me by email is deleted from my mailbox at that point.

After deletion, a technical delay. A response I delete can still stay for up to 90 days in Tally's bin and backups before it is erased for good. In Gmail, a deleted message stays in the bin for another 30 days unless I empty it.

Accounting records: the period set by law. They are not covered by the periods above, and keeping a client file for five years never automatically extends anything else.

Three tools measure what happens on this site, in addition to the form statistics kept by Tally. Only one runs for everyone, because it sets no cookie and keeps nothing that could be used to recognise you from one day to the next. The other two do not start before you have said yes: until you answer the banner, they are not loaded, no measurement cookie is set, and no measurement request goes out to Google or to Microsoft.

Cookie-free audience measurement. Ahrefs Web Analytics counts visits, page views and where visitors come from. It sets no cookie and writes nothing to your browser. To count without tracking, it combines your IP address and browser details with a random value renewed every day, then discards the IP address: the next day, nothing links your new visit to the previous one. It receives the page address and title, the page you came from, your language, your screen size, your browser and your device, and a location no more precise than the city. It also records the outbound links you click, contact links included (email, phone). Ahrefs does not state a retention period for these statistics.

A single consent covers the other two. Google Tag Manager is the container that loads them, and your answer applies to the whole: accepting means accepting both; refusing means having neither.

Audience measurement. Google Analytics 4 counts visits, their sources, the pages viewed, clicks on the main links and project requests successfully submitted. The measurement data is kept for fourteen months. No advertising feature is switched on: no Google signals, no remarketing, no user ID, no ad personalisation.

Experience analysis. Microsoft Clarity records heatmaps and browsing sessions, which lets me see where the site gets in the way. Masking is set to “Strict” to hide page content in those recordings. The project request pages are excluded entirely. At Microsoft, recordings are kept for 30 days, except those I mark and a random sample, which are kept for up to 9 months, like heatmaps.

Refusing is as easy as accepting. Both buttons sit side by side, at the same level, from the very first screen. Your choice is kept for thirteen months, after which you are asked again. You can change it whenever you like. Withdrawing your consent blocks new data from being sent to Google Analytics and Clarity, deletes the measurement cookies it can access on kaiiza.ch and the tab memory used by Clarity, then reloads the page. Any Google or Microsoft cookies stored on their own domains still need to be cleared through your browser settings.

What these tools will never see. The project request form is out of their reach: it loads from Tally, and none of these tools can read what you type or what you select in it. Page addresses passed to Google Analytics are cleaned, without anything after the question mark or the hash, so that no identifier or token can slip in. Only predefined source or campaign labels may be sent separately. Your email address, your phone number and the content of your answers are never sent to them.

The site works perfectly without. Refusing degrades nothing: browsing, the form and the submission all behave exactly the same. The cookie-by-cookie detail is on its own page.

Photos of your tattoo. I photograph the pieces I do, because that is my portfolio and my way of showing my work. Nothing is published on this site, on Instagram or anywhere else without my having asked for your agreement. Saying no changes nothing about your session, nor about how much I want to do it, and you owe me no reason. If you change your mind later, write to me: I take the photo down from the channels I control.

Testimonials. Same rule. I do not publish what you wrote to me without your agreement, and a testimonial is as easy to withdraw as it was to give.

The review request. After your session, I may send you an email, a single one, suggesting you leave a Google review. You are never obliged to, there is no follow-up, and if you would rather not receive it, just tell me. What you then write at Google is published under Google's terms, not mine.

The Swiss Federal Act on Data Protection (FADP) gives you several rights over what I hold about you.

To know. You can ask me whether I process data about you and which data, and get a copy of it.

To correct. If something is wrong or incomplete, you can ask me to put it right.

To delete. You can ask for your request and our exchanges to be erased. I do it, except for what a legal obligation requires me to keep, in particular the accounting records of an invoiced session.

To take it with you. You can ask me to hand over the data you gave me in a common format, or to pass it on to someone else.

To refuse. You can object to a processing operation, the review request included, and withdraw at any time an agreement you had given, whether that is the publication of a photo or the measurement tools. Withdrawal applies going forward and does not call into question what happened before.

How to do it. An email to kaiiza.tattoo@gmail.com is enough, with no form and no particular wording. I reply within 30 days and free of charge. If I have a genuine doubt about your identity, I may ask you for something that confirms it, and I will never ask for more than strictly necessary.

If my answer does not satisfy you, you can contact the Federal Data Protection and Information Commissioner (FDPIC) in Bern.

Finally, if the European General Data Protection Regulation applies to your situation, you additionally have the rights it provides, including restriction of processing, and you can lodge a complaint with the data protection authority of your country of residence. My business is aimed at the Swiss market, but I would rather you knew where to go than be sent off into a technicality about territorial scope.