Privacy

1. Data controller

The data controller is Marco Cerza (VAT no. 01669260703), a tattoo artist working under the name LostBoy in Milan (Lombardy), Italy.

For any privacy question or to exercise your rights, you can write to lostboyttt@gmail.com.

2. What data is collected

• Browsing data. Like any website, the hosting service automatically logs some technical data (IP address, browser type, pages visited, date and time) needed for the site to work and stay secure.
• Data sent through the booking form. Name, contact details, a description of your tattoo idea, placement, any reference images and anything else you choose to include.
• Data in the consent form for minors. Personal details and IDs of the minor and the parents, and health information needed to carry out the tattoo safely. The form is downloaded from the site but handed over in person: the site does not collect it online.

3. Why it is processed and on what legal basis

• Replying to requests and arranging the appointment: steps taken at your request before entering into a contract (Art. 6.1.b GDPR).
• Carrying out the tattoo and meeting legal obligations, including tax: performance of a contract and legal obligation (Art. 6.1.b and 6.1.c).
• Processing health information: explicit consent, given by signing the form (Art. 9.2.a). You can withdraw it at any time, without affecting processing already carried out.
• Keeping the website working and secure: the controller’s legitimate interest (Art. 6.1.f).

Providing data in the form is optional, but without it your request cannot be answered and an appointment cannot be booked. Data is never sold or used for advertising or profiling.

4. How long it is kept

• Booking requests that don’t lead to an appointment: up to 12 months from the request.
• Client data and consent forms: for as long as needed to manage the relationship, and in any case no longer than the periods required by law (10 years for tax documents).
• Browsing data: for the period set by the hosting provider, usually a few days or weeks.

5. Who may receive the data

Data is handled personally by the controller and is not disclosed. Some external providers are used to run the website and process data on the controller’s behalf:

• Tally (Tally BV, Belgium): booking form. Tally’s privacy policy.
• Netlify (Netlify Inc., United States): website hosting. Netlify’s privacy policy.
• Google Fonts (Google, United States): provides one of the website’s typefaces, which means your IP address is sent to Google. Google’s privacy policy.

When data is transferred outside the European Union, this is done on the basis of the safeguards provided by the GDPR, such as the EU-US Data Privacy Framework or the standard contractual clauses approved by the European Commission.

The link to the Instagram profile leads to a Meta service: if you open it, Meta’s privacy policy applies.

6. Cookies

This website does not use profiling, marketing or analytics cookies. The booking form, provided by Tally, may use strictly necessary technical tools that do not require consent.

7. Minors

Requests concerning minors are only handled with the written consent of the parents or legal guardians, using the dedicated form.

8. Your rights

At any time you can ask to access your data, correct it, delete it, restrict its processing, object to its processing, receive it in a readable format (portability) and withdraw any consent you have given. Just write to lostboyttt@gmail.com.

If you believe your data is being handled unlawfully, you can lodge a complaint with the Italian data protection authority, the Garante per la protezione dei dati personali.

9. Changes

This notice may be updated. The date of the latest change is shown at the top of the page.