Privacy

DRAFT, needs legal review. This is a plain-language working draft. A lawyer must check it before launch, and every item marked [TODO: confirm] must be filled in. Delete this box afterwards.

This page explains what happens to the details you send me through the contact form on this website.

Who is responsible (controller)

The controller of your personal data is [TODO: confirm: full legal name or company name, company ID, address], that is LaPapula (Michaela Krátká) as an individual, unless it is someone else.

Contact for privacy questions: [TODO: confirm: privacy contact email].

What we collect

Through the contact form we process:

  • your name,
  • your email address,
  • the topic of your message (tattoo inquiry, painting or commission, something else),
  • the text of your message,
  • optionally, for tattoos: placement on the body and approximate size.

The form is protected from spam by Cloudflare Turnstile and other technical measures (a limit on submissions per IP address, a check on how quickly the form was sent). This involves technical data such as your IP address and browser details. [TODO: confirm: exact technical data and how long it is kept]

The site has no advertising or tracking cookies. Your language choice may be stored in your browser (a cookie or local storage) so we can send you to the right language next time. [TODO: confirm: whether a cookie or local storage is used, and whether a cookie banner is needed]

Why we use it

Only so we can read your message and reply to it, and, if it comes to that, arrange a tattoo or a commission. We don’t use your details for advertising, we don’t add you to a newsletter, and we don’t sell them.

  • Sending the form requires your consent (the checkbox). The legal basis is Article 6(1)(a) GDPR.
  • If your message is about entering into a contract (for example arranging a tattoo or commission), a further basis is steps taken at your request before a contract (Article 6(1)(b) GDPR).
  • Protecting the form from spam is our legitimate interest (Article 6(1)(f) GDPR).

[TODO: confirm: legal bases to be confirmed by a lawyer]

How long we keep it

We don’t store your message on the website’s server. It is only sent by email. It then stays in the recipient’s mailbox for [TODO: confirm: retention period, for example 12 months after the last contact] and is deleted after that. If the conversation leads to a commission or a contract, we keep the data for as long as the law requires (for example for accounting and tax).

Who receives it

  • An email delivery provider ([TODO: confirm: service name, for example Resend or Postmark]), which delivers your message to LaPapula’s inbox.
  • Cloudflare, Inc. (Cloudflare Turnstile and website hosting [TODO: confirm: whether the site is hosted on Cloudflare Pages]), which provides spam protection and runs the site.
  • [TODO: confirm: any other recipients, such as the email mailbox provider]

These providers process data on our instructions and may not use it for their own purposes. If any of them is outside the EU/EEA (for example in the USA), the transfer is covered by safeguards required by the GDPR. [TODO: confirm: transfer mechanism, for example standard contractual clauses or the EU-US Data Privacy Framework]

Your rights

You have the right to:

  • know what data we hold about you and get a copy,
  • ask us to correct inaccurate data,
  • ask us to delete your data,
  • ask us to restrict processing,
  • object to processing based on legitimate interest,
  • data portability, where it applies to you,
  • withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing before you withdrew it.

Just write to [TODO: confirm: privacy contact email].

If you think we are handling your data badly, you can complain to the supervisory authority: the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Prague 7, www.uoou.gov.cz. [TODO: confirm: check the authority’s address before launch]

Do you have to give us this data?

You give us the form details voluntarily. But without a name, email, topic, message and consent the message can’t be sent, because we couldn’t reply to you.

Changes

This text may change. The current version is always this page. Last updated: [TODO: confirm: date].