Privacy

1. Controller

The controller responsible for data processing on this website is:

Stefanie Frankel
Lines.Munich
Voßstraße 9
81543 Munich, Germany
Email: steffi.tattoo@gmx.de

As a sole trader I am not required to appoint a data protection officer. For any privacy question, write to the email address above.

2. Principles

I process personal data only where necessary to run the website and handle your request (data minimisation, Art. 5(1)(c) GDPR). You can use the website without providing any personal data. Data about you only arises once you fill in the booking form.

3. Hosting and server logs

The website is operated by the following provider in a data centre in Germany:

Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany

A data processing agreement under Art. 28 GDPR is in place with the provider. When you open the site, your browser automatically sends technical data to the server: IP address, date and time, page requested, amount of data transferred, browser type and operating system. These server logs are used solely for the security and stability of the service (error analysis, defence against attacks) and are deleted automatically after 14 days at the latest. The legal basis is my legitimate interest in operating the website securely (Art. 6(1)(f) GDPR). The connection is TLS-encrypted.

4. Booking request (form)

When you request an appointment through the form, I collect:

– name, Instagram name, email address, phone number
– preferred city (Munich or Hamburg) and preferred slot or your date preferences
– motif, body placement, approximate size, description
– optionally up to three reference images
– time of the request and the language you used on the site

Purpose: I use this data exclusively to review your request, reply to you, arrange an appointment and prepare the tattoo. The legal basis is the performance of pre-contractual steps at your request (Art. 6(1)(b) GDPR). For the reference images you additionally give your consent when submitting (Art. 6(1)(a) GDPR); you can withdraw it at any time with effect for the future by writing to me.

Please only upload images you are entitled to upload, and no images of other people. Health information (e.g. skin conditions, allergies, pregnancy) does not belong in the form – we discuss that in person before the appointment.

Requests are stored in a database on this website's own server, not with third-party providers. No automated decision-making takes place. The form also contains an invisible field to block automated spam submissions; it does not collect any additional data about you.

I get back to you via Instagram. I only use your email address and phone number for questions about your request and to arrange the appointment (Art. 6(1)(b) GDPR).

5. Reference images

Uploaded reference images are automatically downscaled on receipt (maximum 1600 pixels on the longest edge) and stored without metadata (e.g. location). Only I can view them, through a password-protected area; they are never published or passed on.

Deletion: once a request is completed or declined, its reference images are deleted automatically after 90 days. If no appointment came about, I delete the request no later than twelve months after the last contact. If an appointment took place, I anonymize the request twelve months after the appointment; the details needed for jobs (e.g. invoicing data) I keep separately from this website for as long as statutory retention obligations require.

6. Contact by email, phone or Instagram

If you contact me directly by email or via Instagram, I process the data you send to deal with your enquiry (Art. 6(1)(b) GDPR; for general enquiries Art. 6(1)(f) GDPR). Messages via Instagram are additionally subject to the privacy policy of Meta Platforms Ireland Ltd., over which I have no control.

I reply to form requests via Instagram (direct message). I send my emails from my mailbox at GMX (1&1 Mail & Media GmbH, Brauerstraße 48, 76135 Karlsruhe, Germany).

7. Cookies

This website only sets strictly necessary cookies, which do not require consent (§ 25(2) no. 2 TDDDG):

– NEXT_LOCALE: remembers your language choice (German/English), lifetime 12 months.
– admin_session: used only for the operator's admin area; it is never set for visitors.

There are no tracking, analytics or marketing cookies – and therefore no cookie banner.

8. Fonts and external content

The fonts used (Archivo, JetBrains Mono) are served locally from this server. Loading the site does not connect to Google or any other font provider. Instagram content is not embedded; Instagram is only linked. Data is transferred to Meta only once you follow such a link.

9. Sharing of data

I do not pass your data on to third parties and never sell it. Only I and – as a processor – the hosting provider have access, to the extent required for technical operation. This website does not transfer data to countries outside the EU.

10. Data security

Traffic between your browser and this website is TLS-encrypted (see the padlock in the address bar). The admin area is password-protected. Backups are stored exclusively on servers within the EU and are overwritten after 14 days.

11. Your rights

Regarding your personal data you have the following rights towards me:

– access (Art. 15 GDPR)
– rectification (Art. 16 GDPR)
– erasure (Art. 17 GDPR)
– restriction of processing (Art. 18 GDPR)
– data portability (Art. 20 GDPR)
– objection to processing based on legitimate interests (Art. 21 GDPR)
– withdrawal of consent with effect for the future (Art. 7(3) GDPR)

Just write to steffi.tattoo@gmx.de. If you want your request and images deleted immediately, one sentence is enough.

12. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for me is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany, www.lda.bayern.de. You may also contact the authority where you live.

13. Changes

I update this policy when the site's technology or the legal situation changes. The version published here applies.

Last updated: September 2026