Privacy Policy

Last updated: August 3, 2026

NOIR ATELIER ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how your personal information is collected, used, and disclosed by NOIR ATELIER in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws of the Republic of Cyprus.

1. Information We Collect

When you use our Booking Manager or contact us, we may collect the following personal data:

• Contact Information: Name, email address, phone number, and Instagram handle (optional).
• Booking Details: Desired tattoo placement, size, concept descriptions, and reference images.
• Appointment Data: Preferred dates, scheduled sessions, and appointment history.
• Financial Information: Payment status, deposit information, and billing details (processed securely via Stripe).
• Technical Data: IP address, browser type, and interaction data via our hosting and security providers.

2. How We Use Your Information

We process your personal data on the following legal bases (GDPR Art. 6):

• Performance of a Contract: To process your booking requests, schedule appointments, and provide our tattoo services.
• Legitimate Interests: To ensure the security of our website, prevent fraud, and optimize the user experience.
• Legal Obligation: To comply with tax, accounting, and other legal requirements in Cyprus.
• Consent: When you voluntarily provide optional information (like Instagram handles) or reference images.

3. Third-Party Service Providers

To provide our services, we share necessary data with trusted third-party processors, all of which are bound by strict data processing agreements:

• Vercel & Postgres: We use Vercel Inc. and its PostgreSQL infrastructure to host our website and securely store booking data.
• Cloudflare: We use Cloudflare Inc. for Content Delivery Network (CDN) services and website security (e.g., DDoS protection).
• Stripe: We use Stripe for secure payment processing. We do not store full credit card details on our servers; they are directly processed by Stripe in compliance with PCI-DSS standards.
• Google Maps: We embed Google Maps (Google Ireland Limited) to show our studio location. Using this feature may transmit your IP address to Google.

4. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes outlined in this Privacy Policy, including for the purposes of satisfying any legal, accounting, or reporting requirements under Cyprus law.

5. Your Data Protection Rights

Under the GDPR, you have the following rights regarding your personal data:

• Right of Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request correction of inaccurate or incomplete data.
• Right to Erasure ("Right to be Forgotten"): You can request deletion of your data, subject to legal obligations.
• Right to Restriction: You can request a restriction on how we process your data.
• Right to Data Portability: You can request to receive your data in a structured, machine-readable format.

To exercise any of these rights, please contact us using the information below.

6. International Data Transfers

Some of our third-party service providers (e.g., Stripe, Vercel) may process data outside the European Economic Area (EEA). We ensure that any such transfers are subject to appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs).

7. Jurisdiction and Governing Law

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of Cyprus, without regard to its conflict of law provisions.

For our Deposit, Rescheduling & Cancellation terms, please refer to our Deposit & Rescheduling Policy.

8. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

NOIR ATELIER
Ermou 120, 6021 Larnaca, Cyprus
Email: contact@noir.cy