Privacy Policy

Positive Vibrations Tattoo Studio (“we”, “us”, “our”) is a tattoo and nail studio located at Avenida Tomás Cabreira, Vila San Jose, Praia da Rocha, 8500-802, Portugal. We are committed to protecting your privacy and personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and the Portuguese Lei n.º 58/2019.

This Privacy Policy explains how we collect, use, store, and protect your personal data when you visit our website or use our booking and enquiry services.

Positive Vibrations Tattoo Studio is the data controller responsible for your personal data. For any privacy-related questions or requests, contact us at info@positivevibrations.com.

We collect the following categories of personal data:

• Booking data: your name, email address, phone number, chosen artist, appointment date and time, and details about the service you request (e.g. design description, body area, references).
• Waiver data: your full name, email, date of birth, phone number, medical conditions, and digital signature, required for tattoo, piercing, and nail services.
• Contact enquiries: your name, email, and message submitted via our contact form.
• Review data: your name and review text if you submit a testimonial.
• Gift certificate data: sender and recipient names and emails, and the certificate amount.
• Payment data: we use Stripe to process deposits and payments. We do not store your full card details — only a payment identifier and, where relevant, the card brand and last four digits returned by Stripe.
• Technical data: IP address, browser type, and pages visited, collected for site security and aggregate analytics.

We process your personal data under the following legal bases (Art. 6 GDPR):

• Consent (Art. 6(1)(a)): for analytics and advertising cookies, marketing communications, and testimonials.
• Contract (Art. 6(1)(b)): to process your booking, waiver, and payment for services you request.
• Legal obligation (Art. 6(1)(c)): to retain waiver and accounting records as required by Portuguese law.
• Legitimate interests (Art. 6(1)(f)): for site security, fraud prevention, and improving our services.

We use your personal data to confirm and manage appointments, process payments, fulfil legal and health obligations relating to tattooing, respond to your enquiries, send booking confirmations and receipts, improve our website, and comply with legal requirements.

We use three types of cookies. Essential cookies are necessary for the website to function (e.g. remembering your login session) and cannot be disabled. Analytics cookies help us understand how visitors use the site so we can improve it — these are only set after you give consent via the cookie banner. With that consent we also look up your approximate location (country and city) from your IP address using ipwho.is, over an encrypted connection. Visit records store a shortened IP address.

Advertising cookies: some pages (such as our blog) may show ads served by Google AdSense. Google and its partners may use cookies to show ads based on your visits to this and other websites. In the EU/EEA and UK, personalised ads are only shown if you consent through Google’s consent message; otherwise non-personalised ads may be shown. You can manage personalised advertising at adssettings.google.com and learn how Google uses data at policies.google.com/technologies/partner-sites.

You can withdraw your cookie consent at any time by clearing your browser storage for this site, which will re-show the consent banner. You may also configure your browser to block cookies; essential functionality may be limited in that case.

We do not sell your personal data. We share data only with trusted processors that help us operate: Stripe (payment processing), Google (calendar synchronisation, advertising via AdSense and, with your consent, analytics), Cloudflare (the Turnstile security check on our booking and contact forms, which helps tell people from bots), and our hosting and email delivery providers. Each processor is bound by a data processing agreement and only processes data on our instructions.

We retain booking and waiver records for the duration required by Portuguese law for health and accounting purposes. Contact enquiries are retained for up to 24 months. Analytics data is retained in aggregate form for up to 26 months. You may request early deletion where the law permits.

As a data subject in the European Union, you have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate or incomplete data (Art. 16).
• Erasure (“right to be forgotten”) (Art. 17).
• Restrict or object to processing (Arts. 18 & 21).
• Data portability (Art. 20).
• Withdraw consent at any time, without affecting processing carried out before withdrawal (Art. 7(3)).
• Lodge a complaint with the Portuguese Data Protection Authority (CNPD — www.cnpd.pt).

To exercise any of these rights, email us at info@positivevibrations.com. We will respond within one month.

We implement appropriate technical and organisational measures to protect your personal data, including encrypted transmission (HTTPS), access controls, and secure storage. Payment data is handled exclusively by Stripe, which is certified to PCI-DSS Level 1.

Some of our processors operate outside the EU/EEA (e.g. Google in the United States). We only transfer data to such processors under the EU–US Data Privacy Framework or appropriate Standard Contractual Clauses, and only the minimum data necessary for the service.

Our services are intended for adults. We do not knowingly collect personal data from anyone under 18. We require a parent or legal guardian to sign the waiver for any minor permitted to receive a service.

We may update this Privacy Policy from time to time. The “last updated” date at the top of this page reflects the most recent revision. We encourage you to review it periodically.