Privacy and cookies

Controller and contact

The data controller is Lexie Salome Aleksandra Łukasiak, who operates the Lexie Tattoo website. You can contact the controller about privacy and exercising your rights through the contact form on this website. The PRISM studio address is the tattooing location, not the controller’s correspondence address.

Forms and uploaded photos

When you send a message or enquire about an available design, I process the name, email address and message you provide. You may also voluntarily attach inspiration photos. This data is needed to reply, prepare a quote and arrange the session. Please do not send information or photos that are not needed to handle your enquiry.

Session enquiries are handled to take steps at your request before entering into a contract (Article 6(1)(b) GDPR). Other correspondence, including privacy enquiries, is handled on the basis of the legitimate interest in communicating (Article 6(1)(f) GDPR), or a legal obligation where it concerns exercising your rights (Article 6(1)(c) GDPR).

The forms use Google Forms, and photo uploads use Uploadcare. Messages and photo links are submitted to Google Forms; the photos themselves are stored by Uploadcare. These services also receive technical data needed to process the request. Providing data is voluntary, but without contact details I cannot reply to your enquiry.

Correspondence is retained for as long as needed to handle the enquiry and any resulting session, and then for any period required by law or necessary to establish, exercise or defend legal claims. Retention depends on the purpose of the correspondence and applicable limitation periods; correspondence is not retained for traffic analytics.

Analytics only with consent

Google Analytics 4 helps understand which pages are visited and how visitors reach the website. It may process cookie identifiers, browser and device information, visited pages and traffic sources. The legal basis is your consent (Article 6(1)(a) GDPR). We do not add message contents, email addresses or uploaded photos to analytics events.

Google Tag Manager manages measurement tags. We use basic Consent Mode: the GTM container and Analytics are not loaded before consent or when analytics is rejected. Consent covers analytics only. Advertising consent remains disabled.

Rejecting analytics does not limit browsing or submitting forms. You can change your choice using “Cookie settings” in the footer. Withdrawing consent disables measurement, removes accessible Analytics cookies and reloads the page. It does not affect the lawfulness of processing before withdrawal.

Cookies and browser storage

• lexie-consent — stores your analytics choice, notice version and decision date in localStorage. The choice is valid for 180 days; after that we ask again. This record is used to manage your settings, not to track traffic.
• lexie-language and lexie-theme — store your manually selected language and theme in localStorage. These settings remain until you change them or clear the website’s browser storage.
• _ga and _ga_H3EH3ETSMH — Google Analytics cookies, set after consent and used to distinguish users and sessions. Under Google’s default settings they expire after 2 years and may be renewed on subsequent visits. The period depends on the Google Analytics configuration.

Cookie expiry is separate from Analytics data retention. User and event data is retained according to the GA4 property settings; a standard property allows 2 or 14 months. Aggregated reports are subject to separate rules. Google’s documentation explains the details.

Providers and data transfers

The website is served by GitHub Pages. The hosting provider’s servers may process technical data, such as an IP address and request information, needed to deliver the website and maintain security. The uploader loads software from jsDelivr. The map displayed on this website is a local image; clicking a maps or Instagram link opens an external service.

Google, GitHub, Uploadcare and jsDelivr may process data outside the European Economic Area, including in the USA. Depending on the provider and service, adequacy decisions or standard contractual clauses apply. The providers’ documents explain their processing and safeguards.

• Google privacy
• Uploadcare privacy
• GitHub privacy
• jsDelivr privacy

Your rights

You can request access to, rectification, erasure or restriction of processing of your data. Where provided by law, you have the right to data portability and to object to processing based on legitimate interests. You can withdraw analytics consent at any time. You can also lodge a complaint with the President of Poland’s Personal Data Protection Office (UODO).

We do not make decisions producing legal effects concerning you solely on the basis of automated processing.