Who is responsible
The controller responsible for data processing on this website is:
Havana GmbH
Tucholskystraße 15
10117 Berlin
Email: info@dadatattoo.com
Phone: +49 152 34810000
Further details are available in our legal notice.
Overview
This website is built to collect as little data as possible: fonts are loaded from our own server, maps and videos are only loaded after you click, and third-party analytics or marketing services only run if you expressly agree. Below we explain which data is processed when you visit the website or contact us, why, and for how long.
Hosting and server log files
This website is hosted by an external hosting provider who operates the servers on our behalf. We have concluded a data processing agreement with the provider in accordance with Art. 28 GDPR.
When you open a page, your browser automatically transmits technical information that the server records in log files: IP address, date and time of the request, the page requested, the referring page, the browser and operating system. We need this data to deliver the website and to detect and defend against attacks. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure and stable website). The log files are deleted automatically as soon as they are no longer needed for this purpose.
Encryption
The connection to this website is encrypted (TLS). You can recognise this by the “https://” in your browser’s address bar.
Cookies and local storage
We only set one technically necessary cookie: dada_onay stores your choice in the cookie notice or for external content (for example “always load external media”) for 180 days. Legal basis: Section 25(2) no. 2 TDDDG and Art. 6(1)(f) GDPR.
If you close the language notice, a note is stored in your browser’s session storage so that the notice does not reappear during the visit; it is deleted when you close the tab.
Records of your consent
When you make a choice in the cookie notice or for external content, we store a record as proof of consent (Art. 7(1) GDPR): a random identifier, date and time, the version of the notice, the selected categories and the language — without your IP address. We delete these records after three years. Legal basis: Art. 6(1)(c) GDPR in conjunction with Art. 7(1) GDPR.
Visitor statistics without cookies
To see which pages are read, we count page views on our own server. Nothing is stored on your device and no cookie is set. We record the page path (without query string), the referring website’s domain or a campaign source, the language of the page and the date. To count unique visitors per day, a hash value is formed from IP address, browser and a key that changes daily; it cannot be linked across days and is deleted at the end of the day, leaving only totals. If your browser sends “Do Not Track” or “Global Privacy Control”, nothing is counted. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in improving our website).
Requests via our forms
If you send us an appointment request, a question or a voucher request, we process the data you enter: name, email address and/or phone number, your preferred way of contact, your message and, depending on the form, the service, style, preferred date, reference images, voucher amount and recipient. We use this data only to handle your request and to prepare an appointment or voucher. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) and, for general questions, Art. 6(1)(f) GDPR.
Reference images are re-saved on our server, which removes embedded metadata such as location data, and they are not publicly accessible. We receive your request by email via our own mail server; if you provide an email address, you will receive a confirmation.
To prevent spam, a short-lived hash value of your IP address is used to limit the number of requests; your IP address itself is not stored with the request, and the hash values are deleted within one day. We delete requests and uploaded images automatically 6 months after receipt, unless statutory retention obligations apply.
Review request
If you tick the corresponding box in the appointment form, we will send you a one-time email after your appointment asking for a review. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time, for example by replying to our email.
Contact by email, phone or WhatsApp
If you contact us by email or phone, we process your details to answer your enquiry (Art. 6(1)(b) or (f) GDPR).
If you write to us via WhatsApp — including via the “Send via WhatsApp” buttons on this website — WhatsApp Ireland Limited (Meta) processes your message and metadata under its own terms; data may be transferred to the USA. We only use WhatsApp if you choose this channel. Legal basis: Art. 6(1)(b) or (f) GDPR.
Google Maps
We show a Google Maps map on some pages. It is only loaded when you click “Load map” (or have chosen to always load external media). Only then does your browser connect to Google, transmitting in particular your IP address and information about the page visited. Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google is certified under the EU-U.S. Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time by deleting the cookie “dada_onay” in your browser; the map or video is then only loaded again after a new click.
Videos (YouTube and Vimeo)
Videos from YouTube (Google Ireland Limited, Ireland) or Vimeo (Vimeo.com, Inc., USA) are only loaded when you click on them. We use YouTube’s privacy-enhanced mode (youtube-nocookie.com) and Vimeo with “do not track”. After the click, your IP address and usage data are transmitted to the respective provider; transfers to the USA may occur, and both providers are certified under the EU-U.S. Data Privacy Framework. Preview images are stored on our own server. Legal basis: your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG), which you can withdraw at any time by deleting the cookie “dada_onay” in your browser; the map or video is then only loaded again after a new click.
Fonts
The fonts used on this website are stored on our own server. No connection to Google Fonts or other font services is made.
Links to social networks
We only link to our profiles on social networks. No data is transmitted to these networks until you click on a link; after that, the privacy policy of the respective network applies.
Your rights
You have the right to access your data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3) GDPR).
Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).
To exercise your rights, an informal message to the contact details above is sufficient. You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Berlin Commissioner for Data Protection and Freedom of Information (Berliner Beauftragte für Datenschutz und Informationsfreiheit).
Further information
You are not obliged to provide us with personal data. Without contact details, however, we cannot answer a request. We do not use automated decision-making or profiling. We will update this privacy policy if our website or the legal situation changes.