Privacy notice
Last updated 23 October 2026
The short version. We only collect what we need to reply to your enquiry and tattoo you safely. We don't sell your data, we don't use it for marketing, and this website sets no cookies and runs no analytics. You can ask to see or delete your data at any time by emailing lukeszns@gmail.com.
Who we are
Black Cat Tattoo Studio ("we", "us") is a private tattoo studio run by Girv, inside 191 Hair and Beauty, 191 Union Street, Lurgan, Craigavon BT66 8EQ, Northern Ireland. We are the data controller for the personal information described in this notice, which explains how we handle it under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For anything about your data, contact us at lukeszns@gmail.com or write to the address above.
What we collect
When you send an enquiry through this website
- Your name, phone number and email address
- Details of the tattoo you want: style, size, placement and your description of the idea
- A reference photo, if you choose to attach one. Please avoid sending photos that show your face or other people unless they're needed.
- Your confirmation that you're 18 or over
When you message or email us
Whatever you choose to send us, plus your email address or social media username.
When you book and get tattooed
- Proof of age. We look at your photo ID to confirm you're 18 or over, as the law requires. We record that we checked it but don't keep a copy.
- Your consent form. This includes health information that affects whether it's safe to tattoo you — for example allergies, skin conditions, medication, pregnancy, or conditions that affect healing or blood clotting. Health information is "special category" data and gets extra protection.
- Booking and payment records such as appointment dates, deposits and amounts paid. We don't store card details; card payments, if offered, are handled by the payment provider.
- Photos of your tattoo. We only post photos of your tattoo on our website or social media if you've said yes, and we'll take them down if you change your mind.
When you visit this website
The website is hosted on GitHub Pages. Like any web host, GitHub records technical information such as your IP address and browser type in its server logs to keep the service running and secure. We don't receive or use these logs. We don't use analytics, advertising tags, tracking pixels or cookies — see the cookie policy.
Why we use it and our lawful basis
| What we do | Information used | Lawful basis |
|---|---|---|
| Reply to your enquiry, quote and design your tattoo | Enquiry details, messages, reference photo | Steps you've asked us to take before entering a contract (Article 6(1)(b)) |
| Book, take deposits and carry out your tattoo | Contact details, booking and payment records | Performing our contract with you (Article 6(1)(b)) |
| Check you're 18 or over | ID check record, age confirmation | Legal obligation — the Tattooing of Minors (Northern Ireland) Order 1979 (Article 6(1)(c)) |
| Make sure it's safe to tattoo you and look after you while you heal | Consent form, including health information | Your explicit consent (Article 9(2)(a)), alongside our contract with you. Health and hygiene record-keeping may also be required by our council registration. |
| Keep tax and accounting records | Payment records | Legal obligation (Article 6(1)(c)) |
| Deal with complaints, claims or insurance queries | Booking records and consent form | Our legitimate interest in defending legal claims (Article 6(1)(f)), and Article 9(2)(f) for health data |
| Share photos of your tattoo in our portfolio | Photos of the tattoo (not your face unless you agree) | Your consent (Article 6(1)(a)) — you can withdraw it at any time |
| Stop spam reaching the enquiry inbox | Form submission data | Our legitimate interest in keeping our inbox usable (Article 6(1)(f)) |
We never use your information for marketing, profiling or automated decision-making, and we never sell it.
Who we share it with
We only share information with services that help us run the studio, and only what they need:
| Who | Why | Where |
|---|---|---|
| FormSubmit | Delivers the website enquiry form, including any photo, to our inbox | May process data outside the UK |
| Google (Gmail) | Our email inbox | UK, EU and USA |
| GitHub (Microsoft) | Hosts this website | USA |
| Google Maps | Only if you click Show Google map on our website | USA |
| Meta (Instagram, Facebook) and TikTok | Only if you choose to message us there | USA and elsewhere |
| Payment providers and our accountant | Taking deposits and payments, and keeping accounts | UK |
We may also have to share information with Armagh City, Banbridge and Craigavon Borough Council (for example during a hygiene inspection), the police, HMRC, our insurer or legal advisers, or where the law requires it.
International transfers
Some of the services above are based outside the UK, mainly in the USA. Where that happens, transfers are protected by UK adequacy regulations (including the UK Extension to the EU–US Data Privacy Framework, where the provider is certified) or by the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses. You can ask us for more detail.
How long we keep it
| Information | How long |
|---|---|
| Enquiries that don't lead to a booking | Up to 12 months after our last contact, then deleted |
| Consent forms, health information and booking records | 6 years after your last appointment, so we can deal with any complaint, insurance or legal claim |
| Payment and accounting records | As long as tax law requires — currently at least 5 years after the relevant Self Assessment deadline |
| Proof-of-age check | A note that ID was checked is kept with your consent form. We don't keep copies of ID. |
| Portfolio photos | Until you ask us to remove them |
Your rights
Under UK data protection law you have the right to:
- Access — get a copy of the information we hold about you
- Rectification — have anything inaccurate corrected
- Erasure — ask us to delete your information, unless we have to keep it by law
- Restriction — ask us to limit how we use it
- Objection — object to uses based on our legitimate interests
- Portability — receive information you gave us in a commonly used format
- Withdraw consent — for example to portfolio photos, at any time. This doesn't affect anything we did before you withdrew it.
To use any of these rights, email lukeszns@gmail.com. It's free, and we'll reply within one month. We may ask you to confirm your identity first.
Complaints
If you're unhappy with how we've handled your information, please tell us first at lukeszns@gmail.com and we'll do our best to put it right.
You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator: ico.org.uk/make-a-complaint or helpline 0303 123 1113.
How we protect it
- The website is served only over HTTPS and loads no third-party scripts, trackers or fonts.
- The enquiry form sends straight to our inbox over an encrypted connection — nothing is stored on the website itself.
- Our email and devices are protected with strong passwords and two-factor authentication.
- Paper consent forms are kept in a locked place at the studio, and disposed of securely when no longer needed.
More detail is on our security page.
Under 18s
We don't tattoo anyone under 18 and don't knowingly collect information from them. If we find we've received an enquiry from someone under 18, we'll reply to let them know and delete it.
Changes to this notice
We'll update this page if the way we handle information changes. The date at the top shows when it last changed.