Privacy Policy

The controller within the meaning of the General Data Protection Regulation (GDPR) is Alexander Weisler (Leer Berlin), Uhlandstr. 125, 10717 Berlin, Germany, email: info@scarysite.de.

This website runs on our own server with our hosting provider netcup in Germany. The web server in front of it automatically logs technical connection data that is generated whenever a website is accessed — this can include, among other things, the page requested, the date and time of access, and the IP address of the accessing device.

These logs are used exclusively to keep the website running securely and reliably (for example, for troubleshooting and preventing abuse) and are not combined with other data sources. They are not kept indefinitely but rotated by file size: once a log file reaches a certain size, a new one is started and the oldest one is automatically deleted. The legal basis is our legitimate interest in operating a functional and secure website (Art. 6(1)(f) GDPR).

To protect against automated abuse (for example, mass submissions through the inquiry form or the admin login), we additionally count, for a short period, how many requests come from the same IP address. This counting happens exclusively in our server's working memory, is never stored permanently, and is lost on every system restart. The legal basis is likewise our legitimate interest in preventing abuse (Art. 6(1)(f) GDPR).

When you submit a tattoo inquiry through our form, we process the information you enter in order to handle your inquiry and get in touch with you. This includes: your name, your email address, optionally a WhatsApp number and an Instagram handle, your confirmation that you are at least 18 years old, as well as details about your tattoo project (idea, placement, size, desired timeframe, whether it's your first tattoo, an optional free-text field, an optional budget note) and your preferred location (Berlin, guest spot, or flexible).

The legal basis is Art. 6(1)(b) GDPR — the processing takes place at your request, as a pre-contractual step towards a possible tattoo booking. Your information is stored in our own PostgreSQL database, run exclusively on our own server, not in an external or shared service.

For every inquiry, we store a deletion date 730 days after it was received. An automated technical process that independently deletes or anonymizes inquiry data once this period has passed is not yet in place — until it is, deletion is carried out manually by us based on this stored date. This does not apply where statutory retention obligations require otherwise — for example, if an inquiry has turned into a booking with tax-relevant payment records.

You may voluntarily attach up to five reference images to your inquiry. Uploaded images are automatically resized both in your browser before sending and again on our server afterwards, and stripped of metadata such as camera or location information (EXIF data) in the process.

The images are stored as files on our server — not in the database and not publicly accessible — and are retrieved exclusively through a password-protected area of our internal inquiry dashboard. The legal basis is the same as for your inquiry as a whole (Art. 6(1)(b) GDPR). Reference images are deleted together with the associated inquiry.

In the inquiry form, you can additionally and independently of your actual inquiry agree, via a checkbox that is never pre-selected, to occasionally receive emails about open tattoo slots, new work, and guest spots. This consent is legally separate from your tattoo inquiry and has no effect whatsoever on whether or how your inquiry is handled.

The legal basis is your consent (Art. 6(1)(a) GDPR). Together with your decision, we also store which exact wording of this checkbox you agreed to, so that we can verify, if needed, exactly what you consented to. You can withdraw this consent at any time, informally, by emailing info@scarysite.de.

This website sets one technically necessary cookie to remember your language choice (German/English) for one year. In addition, your browser stores locally (localStorage) an inquiry draft you have started but not yet submitted, so you can continue it later, as well as your own decision regarding the marketing consent described in section 8.

None of this data is transmitted to us or to any third party unless and until you submit your inquiry — it stays exclusively in your browser until you delete it yourself (for example, via your browser settings) or submit your inquiry. This storage is necessary to provide the functionality you request and, under § 25(2) no. 2 of the German Telecommunications-Telemedia Data Protection Act (TTDSG), does not require separate consent.

If you reach our site via a link carrying campaign parameters (e.g. utm_source, utm_medium, utm_campaign), we store these parameters, together with the first page you visited and, where available, the referring page, locally in your browser — and, if you submit an inquiry, together with that inquiry in our database. This lets us understand which channel an inquiry came through.

This data is processed exclusively in our own database and is not transmitted to advertising platforms or any other third party. The legal basis is our legitimate interest in understanding which channels lead to genuine inquiries (Art. 6(1)(f) GDPR).

If the link you arrive through additionally carries a click identifier appended by Meta advertising (the "fbclid" parameter), we treat it deliberately differently from the other campaign data in section 7: it is initially held only transiently in your browser's memory and is automatically discarded when the page reloads or the tab is closed, without ever having been stored.

Only if you explicitly choose "Allow marketing" in the consent banner shown on your first visit is this identifier — like the other campaign data — also stored locally and, if you submit an inquiry, saved together with it. If you decline, or make no decision at all, it is never stored permanently. The legal basis is exclusively your consent given through the consent banner (Art. 6(1)(a) GDPR).

You can reopen the consent banner at any time via the "Cookie settings" link in the site footer and change your decision. There is no pre-selected option; "Necessary only" and "Allow marketing" are presented as equal choices.

We have technically prepared for the use of the Meta Pixel and the server-side Meta Conversions API, but have not activated it at this time: no Pixel ID and no access token are configured, no script from Meta is loaded, and no data is transmitted to Meta whatsoever — regardless of what you choose in the consent banner.

Should we activate this feature in the future, it would run exclusively after prior consent given through the consent banner described in section 8 (Art. 6(1)(a) GDPR), and we will update this privacy policy accordingly beforehand.

To send emails — the confirmation you receive and the internal notification we receive about your inquiry — we use the email service provider Brevo. Emails are sent from booking@mail.scarysite.de; replies to the confirmation email reach us at info@scarysite.de.

To run our server, we use the hosting provider netcup. Both providers process data on our behalf as data processors within the meaning of Art. 28 GDPR and may only use it according to our instructions and for the purposes described here.

Under the GDPR, you have the right to: access the data we hold about you (Art. 15 GDPR), have inaccurate data corrected (Art. 16 GDPR), have it deleted (Art. 17 GDPR), restrict its processing (Art. 18 GDPR), receive it in a portable format (Art. 20 GDPR), and object to processing based on our legitimate interest (Art. 21 GDPR). You may withdraw any consent you have given at any time, with effect for the future.

For any of these requests, please contact us informally at info@scarysite.de. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state of your habitual residence, place of work, or the place of the alleged infringement.