Note: This draft describes which data the Needl platform actually processes on a technical level. Fill in the contact details below and have a lawyer review it before going live.
[Company name], [Address] -- contact for privacy inquiries: [privacy@example.com]
Account: email address, password (hashed, never stored in plain text), role (client or artist), email verification status.
Optional security features: TOTP secret for two-factor authentication and backup codes -- both are stored encrypted or hashed, never in plain text.
Tattoo ideas: reference images, links, notes, desired placement, and timeframe you upload. This content is hosted on an S3-compatible object storage service.
Booking requests and messages: message text within a booking thread is stored encrypted in the database. Also stored: proposed appointment times, prices, desired tattoo size, and booking status.
Artist profile: publicly visible information such as studio name, address, phone number, portfolio, prices, and availability -- entered by the artist themselves as public business information.
Notifications: your settings for which events reach you by email or push notification, plus a device token if you enable push notifications through a mobile app.
Technical data: session cookie for login, server logs.
Processing takes place to fulfill the usage agreement (Art. 6(1)(b) GDPR) -- i.e. to be able to provide your account, ideas, and bookings at all -- as well as, where separately consented to, on the basis of your consent (Art. 6(1)(a) GDPR), e.g. for optional notifications.
Data is shared with the following categories of service providers, to the extent necessary for the respective purpose: hosting and object storage providers (for images), email delivery service (for verification and notification emails), and the push notification service of the relevant operating system vendor (if you use a mobile app). A data processing agreement under Art. 28 GDPR is concluded with each, where required.
Account data is stored for as long as the account exists. After account deletion, personal data is deleted unless legal retention obligations require otherwise.
Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). Contact the address above to exercise these rights. You also have the right to lodge a complaint with the Austrian data protection authority.
Needl uses a technically necessary session cookie for login. No tracking or marketing cookies are used.