Privacy Policy

This website is deliberately lean: there is no customer area, no online shop and no database that your enquiry lands in. Whatever data does come up is listed below — in full, and in the order you come across it on the site.

01Controller

The controller for the processing of personal data on this website within the meaning of Regulation (EU) 2016/679 (GDPR) is:

Maria Egger — Mary's Tattoo Stick
Unterrainer Str. 4
39057 Eppan an der Weinstraße (BZ), Italy
Email: mariaegger1233@icloud.com
WhatsApp: +39 327 794 9442

No data protection officer has been appointed; there is no legal obligation to do so.

02Hosting and server log files

This website is hosted by Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. When a page is opened, Vercel’s servers process technically necessary connection data in log files:

• shortened or otherwise processed IP address of the requesting device
• date and time of the request
• address requested and volume of data transferred
• referrer (the page visited before) and browser/device identifier (user agent)

Without this data a website cannot be delivered at all. It is used to keep the site running securely and stably and to fend off attacks, is stored for a short time (as a rule a few days, at most 30 days) and is then deleted.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in the technically sound and secure operation of the website.

Transfer outside the EU: Vercel is a US company. The transfer is based on the European Commission’s Standard Contractual Clauses (Art. 46 GDPR) and, in so far as Vercel is certified under it, on the EU-US Data Privacy Framework (European Commission adequacy decision of 10 July 2023). A data processing agreement under Art. 28 GDPR is in place with Vercel. Privacy policy: vercel.com/legal/privacy-policy.

03Audience measurement (Vercel Web Analytics)

To see how often the pages are opened and how visitors find their way here, Vercel Web Analytics is used — the analytics service of the same provider that hosts the site (Vercel Inc., address as above).

Vercel Web Analytics works without cookies and without persistent identifiers: no profile is built, there is no tracking across sites or devices, and no data is passed on to advertising networks. Visits are counted using an anonymised hash value that changes every day and therefore cannot be linked to a person over time. What is recorded is aggregated information such as the page opened, referrer, country, device type and browser.

Legal basis: Art. 6(1)(f) GDPR — legitimate interest in data-minimising, cookieless audience measurement, in order to keep the website clear and useful. As no information is stored on or read from your device, no consent is required for this.

Transfer outside the EU: as under point 02 — Standard Contractual Clauses or the EU-US Data Privacy Framework, data processing agreement under Art. 28 GDPR.

You can object to this processing at any time (see point 09).

04Enquiry form

On the Enquiry page you can put together, step by step, what you have in mind: the piece, the placement, the rough size, your message, plus your name and contact details.

Until then your entries stay in your browser and nowhere else (local storage, so that an accidental reload doesn’t wipe your answers). You can delete them at any time in your browser settings.

Legal basis: Art. 6(1)(b) GDPR — steps taken at your request prior to entering into a contract.

The route via WhatsApp

As soon as you send the message it is transmitted through the WhatsApp service. The provider for users in the European Economic Area is WhatsApp Ireland Limited, Merrion Road, Ballsbridge, Dublin 4, Ireland (Meta group). WhatsApp’s terms and privacy policy apply to that transmission; contents are end-to-end encrypted, but connection data and metadata (e.g. phone number, time) are processed by WhatsApp as its own controller. Privacy policy: whatsapp.com/legal/privacy-policy-eea.

If you’d rather not use WhatsApp, send an email to mariaegger1233@icloud.com instead, or a message on Instagram.

What happens to your enquiry afterwards

Your message then sits in Maria Egger’s WhatsApp inbox and is used there for one thing only: to answer your enquiry, agree the appointment and sort out the details. It is not used for advertising and not passed on to third parties. Enquiries that don’t turn into an appointment are deleted once the matter is closed — after twelve months at the latest. Records relevant for tax purposes relating to appointments that actually took place are subject to the statutory retention periods (Art. 6(1)(c) GDPR).

05Contact via Instagram

This website links to the Instagram profile @tattoosbymarypoppinks. It is a plain link: no Instagram content is embedded, and simply opening this website transfers no data to Meta. Only once you click the link do the data protection terms of Meta Platforms Ireland Limited apply.

06Cookies and browser storage

This website sets no tracking or marketing cookies and embeds no advertising networks. That is why there is no cookie banner here — quite simply, no consent is needed.

The only storage used in the browser on your device is the technically necessary kind: the local caching of your form entries (point 04) and a marker for whether the opening animation has already been shown in this session. This information never leaves your device and can be deleted at any time in your browser settings.

07Fonts

The fonts used are served from our own server (self-hosted). No connection is made to Google Fonts or any other external font service; your IP address is not transmitted there.

08Data security

The website is delivered exclusively over encrypted HTTPS (TLS). That said, nobody can guarantee complete security for data transmitted over the internet.

09Your rights

As a data subject you have the following rights vis-à-vis the controller:

• Access (Art. 15 GDPR) — which data about you is processed
• Rectification (Art. 16 GDPR) — correction of inaccurate details
• Erasure (Art. 17 GDPR) — the “right to be forgotten”
• Restriction of processing (Art. 18 GDPR)
• Objection to processing based on legitimate interests (Art. 21 GDPR)
• Data portability (Art. 20 GDPR) — release of your data in a common format

For any of these an informal message to mariaegger1233@icloud.com or over WhatsApp is enough. There is no charge.

Right to lodge a complaint: regardless of the above, you can lodge a complaint with a supervisory authority at any time. The competent authority is the Italian data protection authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome, Italy.

10No automated decision-making

There is no automated decision-making and no profiling within the meaning of Art. 22 GDPR. Who gets an appointment is decided by Maria Egger personally.

11Minors

This website is aimed at people aged 16 and over. From 18 I tattoo you on your own; at 16 or 17 only with a parent present who signs the consent at the studio. Enquiries from under-16s are not dealt with.

12Changes to this policy

If the website changes — through new features, for instance — this policy is adapted accordingly. The version published here is the one that applies.

Last updated: August 2026