This is a translation provided for convenience. Only the French version is legally binding.
Protection of personal data
Christophe Musset
– President of SAS TATTOO ON MOVE®
15 quai Jean Jaurès – BP 90024 – 84800 L'Isle-sur-la-Sorgue (France)
RCS Avignon 931 188 049
Performance of a contract
(art. 6.1 b GDPR): managing orders, deliveries, invoicing and customer service.
Consent
(art. 6.1 a GDPR): newsletter, commercial marketing, placing analytics and advertising cookies.
Legal obligation
(art. 6.1 c GDPR): keeping proof of identity and signed consents, to comply with the Public Health Code.
Explicit consent
(art. 9.2 a GDPR): collecting the health information needed for the safety of the service. See the section
“Health data” below.
Legitimate interest
(art. 6.1 f GDPR): fraud prevention, statistical analysis, improving the website.
Before any service, we ask you questions about your state of health (allergies, current treatments,
pregnancy, medical history). These are
sensitive data within the meaning of Article 9 of the GDPR
, processed on the basis of your
explicit consent
(article 9.2 a), collected when you sign, for the sole purpose of ensuring your safety and that of the
service.
No retention
: your answers are not recorded on any medium, either by us or by a technical service provider.
Minimal transmission
: only the points of caution you have flagged are passed on to the professional carrying out your
service, to the exclusion of any other answer.
Automatic deletion
: this transmission is erased once the service has been paid for, and at the latest at 2 am on the day after
the appointment.
No commercial use
: this information is never used for marketing and is not passed on to any third party, except at the request
of an authority.
Withdrawal of consent
: possible at any time, on the understanding that it will prevent us from carrying out the service.
Services for a minor require the written consent of the legal guardian, together with proof
of identity. On this occasion we collect the data of the minor and of their legal guardian, for the
sole purpose of justifying this consent.
These documents are subject to the same rules as consent forms: encrypted, kept for 3 years, then deleted. The legal
guardian exercises the minor's rights.
Your data may be shared with:
IT service providers (hosting, Akeeba Backup backups).
Payment platforms (PayPal, banks).
Carriers for delivery.
Google (Analytics, Tag Manager).
Judicial or administrative authorities if required.
Some of our service providers are based outside the European Union, notably Google (Analytics, Tag Manager) in the
United States. These transfers are covered by the
EU–US Data Privacy Framework
and, where applicable, by the
standard contractual clauses
adopted by the European Commission.
Analytics and advertising cookies are only placed after you have given your consent, which you can withdraw at any
time.
No tracker is placed on the forms signed at the shop.
Health questionnaire: no retention.
The answers are not recorded on any medium. Only the points of caution are passed on to the professional
carrying out the service, and this transmission is deleted once the service has been paid for, and at the latest at
2 am on the day after the appointment.
Liability waivers and parental consents: 3 years, in encrypted form.
Client files: 3 years.
Orders & invoices: 5 years (French Commercial Code).
Analytics/advertising cookies: 13 months (in line with the CNIL).
Restricted access: only authorised staff have access.
Liability waivers and parental consents
: end-to-end encrypted as soon as they are sent, then kept in encrypted form on a dedicated medium held by the
data controller, in France. They are neither transmitted nor stored in clear text on the website's server.
Daily backup and archiving of the website by Akeeba Backup, with an access log.
