Privacy Policy

The person responsible for the personal data collected through this website is Tomasz "Tomek" Turlej, trading as Tomek Turlej Tattoo, tattooing from Studio XIII Gallery, Edinburgh. This isn't a large studio system — enquiries come to me directly. I handle data in line with UK GDPR and the Data Protection Act 2018.

What I collect

• Enquiry details from the booking form or the chat widget — your name, how to reach you (email, phone, or Instagram handle), your tattoo idea, placement, size, style, budget, cover-up details, and any dates you mention.
• Reference photos or videos you attach through the chat widget, stored so I can see what you mean.
• Chat messages if you use the AI assistant — it's answered by Cloudflare's Workers AI, not a person, until you leave contact details or the conversation is handed to me. I only ever see the transcript once that happens.
• Technical data such as your IP address, used briefly by Cloudflare's bot-check (Turnstile) to confirm you're a real visitor, not a spam bot. I don't see or store this myself.
• I do not use advertising trackers, analytics cookies, or sell your data to anyone.

Why I collect it

• To reply to your enquiry, discuss your idea, and arrange a consultation or booking.
• To keep a record of what was agreed — design, price, dates — for the length of a project and reasonable business records after.
• To protect the booking form and chat from spam and abuse.

The legal basis is your consent, given when you send an enquiry, and my legitimate interest in running and protecting a small tattoo business.

How it's stored

• Enquiries are stored in a database on Cloudflare's infrastructure and shown to me in a password-protected private diary — nobody else sees it.
• Attached photos and videos are stored privately; the links aren't public or searchable.
• A new enquiry is also emailed straight to me so I don't miss it.
• I keep enquiry data for as long as it's useful for the project and reasonable records afterwards, then delete it.

Who it's shared with

• I don't sell or share your data for marketing, and nobody but me reads your enquiry.
• The website, database, file storage, email, bot-protection and AI chat all run on Cloudflare's infrastructure, which processes data only to provide those services.

Cookies

This site sets one small cookie when you use the chat widget, purely to remember that Cloudflare's bot-check already confirmed you're a real visitor, so you're not asked again on every message. It carries no personal information, expires automatically after 30 minutes, and is strictly necessary for the chat to work — it doesn't track you elsewhere and no consent banner is needed for it. No advertising or analytics cookies are used.

Age

Tattooing requires clients to be 18 or over, and the booking form asks you to confirm this. This site doesn't knowingly collect data from anyone under 18.

Your rights

• You can ask what data I hold about you, and ask me to correct or delete it.
• You can withdraw consent to being contacted at any time.
• To ask about any of this, message @tomekktattoo on Instagram or email [email protected].
• You also have the right to complain to the UK's Information Commissioner's Office at ico.org.uk.

Changes

If how I handle data changes, I'll update this page and the date at the top.