Privacy Policy

1. Controller

Giovanni Maurizio De Rose – Mantis Tattoo Studio - Giovanni De Rose
Via Besso 24, 6900 Lugano, Switzerland
UID CHE-444.966.306

Email: info@giovanniderose.com · WhatsApp: +41 76 452 26 11

For any data protection question, you can reach us at these contacts.

2. When you visit the website

Technical server data

The website is hosted by Aruba S.p.A. (Italy). On every visit the server automatically logs technical data: IP address, date and time, requested page, referring site, browser and operating system. This data keeps the site running and protects it from abuse; we do not use it to identify you. The provider keeps it for a limited period and then deletes it. Legal basis (GDPR): legitimate interest in operating the site securely (Art. 6(1)(f)).

Fonts

Fonts are hosted on our own server: visiting the site does not connect you to Google Fonts or other external services.

Google Analytics (only with your consent)

If you click “Accept” in the banner, we use Google Analytics 4 by Google Ireland Ltd and Google LLC (USA) to learn how many people visit the site, which pages they read, on what type of device, from which approximate region, and how many click the WhatsApp button. Google Analytics uses cookies (see the Cookie Policy) and a pseudonymous identifier; according to Google, Analytics 4 does not log or store IP addresses. Google Signals and ad personalisation are turned off. Data stays in Google Analytics for at most 14 months.

Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via “Cookie settings” at the bottom of every page. If you reject, Google Analytics is not loaded. Google’s privacy policy →

Google Maps (only on request)

The map in the Contact section is not loaded automatically. Only if you click “Show map” does your browser connect to Google, which receives your IP address and may set cookies under its own policy.

External links

Links to WhatsApp, Instagram and Google Maps take you to third-party services, which process data under their own policies.

3. When you contact us

You can contact us via WhatsApp, Instagram direct message, email or phone. We process the data you send us: name, phone number or profile, message content and images you share (for example references or a photo of a tattoo to cover). We use it only to reply, prepare a quote and book the appointment.

WhatsApp and Instagram are Meta services (WhatsApp Ireland Ltd, Meta Platforms Ireland Ltd), which may also transfer data to the USA. Emails are handled on Aruba S.p.A. servers in Italy. We keep conversations as long as needed to handle the request and any resulting relationship, and regularly delete those no longer needed.

Legal basis: pre-contractual steps at your request (Art. 6(1)(b) GDPR). Please do not send us health information by message: we collect it at the studio with the medical questionnaire.

4. When you get tattooed

Client data

First and last name, date of birth, contact details, date and description of the work, amount paid. We use it to carry out the work and the touch-up, and to meet legal obligations. Legal basis: contract and legal obligations (Art. 6(1)(b) and (c) GDPR).

ID document

Before the work we visually check an ID document to verify your identity and that you are of age. We do not make copies or photos of it.

Medical questionnaire (health data)

Before each session we ask you to complete and sign a form with information about your health (for example allergies, medication, skin or blood conditions, pregnancy). This is sensitive personal data (Art. 5 let. c FADP) and special category data (Art. 9 GDPR). We use it only to assess whether the tattoo can be done safely and to document that you received the necessary information. Without it we cannot tattoo you.

The form is on paper, kept at the studio in a locked archive and accessible only to Giovanni De Rose and the artist doing the work. We keep it for 10 years after the last session, the limitation period for contractual claims (Art. 127 CO), then destroy it securely. Legal basis: your explicit consent, given by signing the form (Art. 9(2)(a) GDPR), and performance of the contract.

Photos of the work

We photograph tattoos to document the work. We publish photos on the website and our Instagram profiles only with your consent, given by signing the relevant box on the form. Consent is optional and does not affect the service. You can withdraw it at any time: we will then remove the photos from the site and our profiles, but we cannot control copies already shared by others. We do not show your face or other identifying features unless you ask us to.

Payments and accounting

We keep accounting records (receipts, invoices) for 10 years, as required by Art. 958f of the Swiss Code of Obligations. If you pay by card or a payment app, the transaction is handled by that provider.

5. Who receives the data

• Aruba S.p.A. (Italy): website hosting and email.
• Google (Ireland, USA): only with your consent (Analytics) or at your request (Maps).
• Meta (Ireland, USA): if you choose to contact us via WhatsApp or Instagram.
• Artists working with the studio: only for the clients they look after, bound by confidentiality.
• Advisers (for example our accountant) and authorities, where required by law.

We do not sell data or share it with third parties for advertising.

6. Transfers abroad

Data may be processed in the European Union (Italy, Ireland), which Switzerland recognises as providing adequate protection, and in the United States. Google LLC and Meta Platforms Inc. are certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework, which the Swiss Federal Council and the European Commission recognise as an adequate safeguard.

7. Your rights

You can ask us at any time:

• whether and what data we process about you (access);
• to correct it, delete it or restrict its processing;
• to receive the data you gave us in a common electronic format (portability);
• to object to processing based on legitimate interest;
• to withdraw a consent, without affecting the lawfulness of earlier processing.

Write to info@giovanniderose.com or via WhatsApp. We normally reply within 30 days and may ask you to prove your identity. Statutory retention obligations remain unaffected.

You can also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) or, if you are in the EU, with the supervisory authority of your country.

8. Security

We protect data with appropriate measures: HTTPS-only website, paper forms in a locked archive, access to devices and accounts limited and password-protected. We make no decisions based solely on automated processing and do no profiling.

9. Changes

We may update this policy. The version in force is always the one published here, with the date shown at the top.