Skip to main content

Privacy Policy

Last Updated: March 14, 2026

1. Introduction & Controller Identity

This Privacy Policy explains how Corelyx Tattoo Studio (“we”, “us”, or “our”) collects, uses, and protects your personal data when you visit this website (the “Site”) and when you contact us to request a consultation or other services. We are committed to handling personal information in a careful, practical, and transparent way.

Data Controller: Corelyx Tattoo Studio LLC, 77 Great Portland Street, Fitzrovia, London W1W 5PF, United Kingdom. You can contact us about privacy matters at [email protected].

If we materially change our approach to processing personal data, we will update this Privacy Policy and adjust the “Last Updated” date accordingly.

2. Personal Data We Collect

The information we collect depends on how you interact with the Site. In general, we collect data in three broad ways: (a) information you provide directly, (b) information collected automatically by your device and browser when you load pages, and (c) information set via cookies and similar identifiers when permitted by your preferences.

  • Identity and contact information: name, email address, phone number, and any preferred contact method you share.
  • Form content and messages: the text you submit in a consultation request, including design notes, preferred style, placement notes, scheduling preferences, and other project details.
  • Technical data: IP address, browser type and version, device identifiers, operating system, language settings, time zone, and basic diagnostic signals.
  • Usage data: pages viewed, time spent on pages, navigation paths, referral source, and interactions such as clicks that help us understand how the Site is used.
  • Cookies and identifiers: first-party cookies used for essential functions and consent storage, plus third-party identifiers for analytics and advertising when you consent (see Section 4).
  • Conversion events: information indicating that a form was submitted or a key action occurred, which is used for measurement and troubleshooting.

We do not intentionally collect special-category data (such as health information, religion, political views), financial account details, or government identification numbers through this Site. Please do not include such information in the message field. If you choose to provide it, we will treat it with heightened care and limit access, but it is not required for a consultation request.

3. Why We Process Personal Data & Legal Bases

Where applicable under the GDPR and UK GDPR, we rely on the legal bases below. Not every basis applies to every interaction; we choose the narrowest basis that fits the purpose.

  • Consultation requests and communications: we process your contact details and message content to respond, clarify details, and arrange appointments. Legal basis: Art. 6(1)(b) (steps prior to entering into a contract) and Art. 6(1)(a) (consent) where consent is collected through the form.
  • Analytics: if you consent, we use analytics to understand how the Site is used and to improve performance and content. Legal basis: Art. 6(1)(a) (consent).
  • Marketing and remarketing: if you consent, we may measure advertising performance and build audiences for ads. Legal basis: Art. 6(1)(a) (consent).
  • Security and fraud prevention: we process limited technical data to maintain the integrity of the Site, prevent abuse, and mitigate bots. Legal basis: Art. 6(1)(f) (legitimate interests).
  • Legal compliance: we may process limited data to comply with legal obligations and to respond to lawful requests. Legal basis: Art. 6(1)(c) (legal obligation).

Automated Decision-Making (Art. 22): We do not engage in automated decision-making or profiling that produces legal or similarly significant effects on individuals.

4. Cookies & Tracking

Cookies are small text files stored on your device. We also use similar technologies such as pixel tags. Our cookie categories match the options available in our cookie preferences panel.

Essential cookies (always active)

Essential cookies are required for the Site to function and for basic security. These do not require consent. Examples include cookies that keep a session stable and store your cookie preference choice. Typical retention is session-based up to 12 months for preference storage.

Analytics cookies (consent-based)

If you consent, analytics cookies help us understand traffic and page usage patterns so we can improve content and reduce friction in the consultation process. We may use Google Analytics 4 (GA4) with IP anonymization where supported. Example cookies include _ga and _ga_XXXXXXXXXX. Data retention is typically configured to 14 months.

Marketing cookies (consent-based)

If you consent, marketing cookies help measure ad performance and build relevant audiences. Examples may include Google Ads and Meta Pixel cookies such as _gcl_au, _fbp, and _fbc (when click identifiers are present). These tools may process cookie identifiers, page events, and conversion signals.

Beyond cookies, advertising and analytics tools can use event-based tracking (for example, page view and form submission events) and may use device-derived identifiers (e.g., from IP address and user-agent). We only activate consent-based tracking after you provide a choice through the cookie banner or cookie preferences modal.

5. Consent Management (EEA/UK)

Users in the EEA and the UK receive a consent notice under GDPR/UK GDPR. Analytics and marketing cookies activate only after explicit, informed, and freely given consent (Art. 6(1)(a)). Your consent choice is recorded in the cookie_consent browser cookie for up to 12 months.

You can withdraw consent at any time by using the “Manage cookie preferences” link in the footer, or by clearing cookies in your browser settings. Withdrawing consent does not affect the lawfulness of processing based on consent before it was withdrawn.

6. Sharing With Advertising & Service Partners

We do not sell personal data. We share limited data with service providers only as needed to operate the Site, maintain security, and measure performance (when consent applies). Depending on your consent preferences and how the Site is configured, these partners may include:

We do not permit these providers to use Site data for their own independent commercial purposes beyond providing services to us, although providers may process information under their own terms as independent controllers for certain features. Where applicable, we configure services to reduce data exposure (for example, limiting retention and enabling IP anonymization options when available).

7. International Transfers

Some service providers may process data outside the EEA/UK, including in the United States. Where required, we rely on appropriate safeguards such as:

  • EU–US Data Privacy Framework (primary, where applicable), including the UK Extension and Swiss–US DPF where relevant.
  • Standard Contractual Clauses (EU 2021/914) as a fallback mechanism.
  • UK International Data Transfer Agreement (IDTA) as a fallback mechanism.

We also apply additional organizational and technical measures where appropriate, such as minimizing the data shared and restricting access on a need-to-know basis.

8. Data Retention

We keep personal data only for as long as needed for the purposes described in this Privacy Policy, unless a longer period is required by law. Typical retention periods are:

  • Consultation requests and form submissions: up to 2 years from last interaction, unless a longer period is needed for ongoing service discussions.
  • Email correspondence: for the duration of the relationship, plus up to 1 additional year for continuity and dispute handling.
  • Server security logs: typically up to 90 days.
  • Analytics data: typically up to 14 months (configuration-dependent).
  • Marketing cookies: per cookie lifetime (for example, 90 days for certain identifiers).
  • Cookie consent record: up to 3 years for audit and compliance purposes.
  • Legal and tax records: as required by applicable law (often 6–10 years for invoices and related documents).

9. Your Rights (GDPR & UK GDPR)

Subject to applicable law, you may have the right to request access to your personal data, correct inaccurate data, request erasure, restrict processing, request portability, object to processing, and withdraw consent (where processing is based on consent). Relevant GDPR provisions include Articles 15–21 and 7(3).

To exercise your rights, email [email protected]. We typically respond within 30 days. For complex requests, the response time may be extended by up to 60 additional days where permitted by law. We may request reasonable verification to confirm identity before acting on a request.

You also have the right to lodge a complaint with a supervisory authority. For general EU guidance see https://edpb.europa.eu. UK users can contact the ICO: https://ico.org.uk.

10. Children

This Site is not directed at individuals under 16. We do not knowingly collect personal data from minors. If we learn that we have collected personal data from a child under 16 without verifiable parental consent, we will delete it promptly.

11. Do Not Track

This website does not respond to “Do Not Track” (DNT) browser signals. Third-party providers may have their own approaches to DNT and similar signals under their policies.

12. Data Deletion Requests

To request deletion of personal data submitted through the Site, email [email protected] with the subject line “Data Deletion Request”. We will confirm the scope of the request and may ask for identity verification. We aim to complete deletion within 30 days, unless retention is required by law or needed to establish, exercise, or defend legal claims.

13. Business Transfers

In a merger, acquisition, asset sale, financing, or insolvency, personal data may be transferred to a successor entity. If such a transfer materially changes how personal data is used, we will provide notice on the Site.

14. California (CCPA / CPRA)

If you are a California resident, you may have rights to know, delete, and correct personal information, and to opt out of the “sale” or “sharing” of personal information as those terms are defined by California law. We do not sell personal information for money. We may share personal information for cross-context behavioral advertising if you consent to marketing cookies.

Categories of personal information that may be collected in the past 12 months include:

  • Identifiers (name, email, IP address, cookie IDs) shared with service providers and, with consent, advertising partners.
  • Internet or network activity (page views, interactions) used for analytics and, with consent, advertising measurement.
  • Inferences (interests or preferences derived from interactions) used for advertising audiences when enabled by consent.

You can opt out of sharing for targeted advertising by adjusting cookie preferences via the footer link “Manage cookie preferences”. To submit a California privacy request, email [email protected] with the subject line “California Privacy Request”. We will verify your request as required by law. Authorized agents must provide written permission to act on your behalf.

We will not discriminate against you for exercising your privacy rights.

15. Virginia (VCDPA)

Virginia residents may have rights to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising. We do not sell personal data and we do not engage in profiling that produces legal or similarly significant effects.

To submit a Virginia privacy request, email [email protected] with the subject line “Virginia Privacy Request”. If we decline to take action, you may appeal by emailing with the subject line “Appeal of Refusal — Privacy Request”. We respond to appeals within 60 days as required by law.

16. Nevada

Nevada residents may submit a verified opt-out request by emailing [email protected] with the subject line “Nevada Do Not Sell Request”. We do not currently sell personal information under Nevada Revised Statutes Chapter 603A.

17. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in how the Site operates, legal requirements, or service provider configurations. Material changes may be announced through a notice on the Site at least 14 days before taking effect where appropriate. The “Last Updated” date at the top of this page indicates when this Privacy Policy was last revised.

18. Contact

For privacy questions or requests, contact:

Corelyx Tattoo Studio LLC
77 Great Portland Street
Fitzrovia, London W1W 5PF, United Kingdom
Email: [email protected]
Phone: +44 20 7946 1842