Privacy policy

Last updated: 10 November 2026

Who is responsible

Efthimis Vrettos, One Sin Tattoo, Athens, Greece. Email: vrettosefthimios@gmail.com. Write to this address for any question about your data.

What I collect and why

Booking requests

When you send the booking form or email me, I receive your name, email, phone or WhatsApp number (optional), where you live, your tattoo idea, the type of piece, your preferred dates, references, and any photos you send. I use this only to answer you, plan your design and book your sessions. Legal basis: steps before a contract, Art. 6(1)(b) GDPR. Messages arrive in my Gmail inbox, provided by Google.

Guest spot waitlist

If you leave your city and email, I use them only to tell you when I'm tattooing near you. Legal basis: your consent, Art. 6(1)(a) GDPR. Reply "remove me" at any time and I'll delete them.

If you subscribe, your email is stored with Mailchimp (Intuit Inc., USA) to send you news about new dates and guest spots. Legal basis: your consent. Every newsletter has an unsubscribe link. Transfers to the USA are covered by the EU–US Data Privacy Framework and the EU's standard contractual clauses.

Google Analytics

Only if you click "Accept" in the cookie banner, Google Analytics (Google Ireland Ltd.) sets cookies (_ga, _ga_…, stored for up to 2 years) to measure which pages are visited, which ads bring visitors, and roughly where visitors come from (country or city) and on what device. I can't identify you from this. Google may process the data in the USA under the EU–US Data Privacy Framework. If you decline, no analytics cookies are set and Google only receives anonymous visit signals without identifiers. You can change your choice any time with "Cookie settings" at the bottom of every page. Legal basis: your consent, Art. 6(1)(a) GDPR.

Your cookie choice

Your Accept or Decline choice is saved in your own browser (local storage) so the banner doesn't appear on every visit. It isn't sent to me.

Hosting

My web host processes technical data needed to deliver the site and keep it secure (IP address, date and time, page requested, browser type). Legal basis: legitimate interest in a working, secure website, Art. 6(1)(f) GDPR.

Fonts and external links

The fonts on this site are stored on my own server, so no data goes to Google Fonts. Links to Instagram, TikTok, Facebook and my Big Cartel shop only send data to those services when you click them; their own privacy policies apply there.

How long I keep it

Booking emails: as long as needed for your sessions and aftercare, and longer only where Greek tax law requires it for invoices. Waitlist and newsletter: until you unsubscribe or ask me to delete you. Analytics: for the retention period set in Google Analytics (2 or 14 months).

I never sell your data or use it for anything other than what's described here.

Your rights

You can ask me for a copy of your data, ask me to correct or delete it, restrict or object to its use, receive it in a portable format, and withdraw any consent at any time. Just email vrettosefthimios@gmail.com. You can also complain to the Hellenic Data Protection Authority (www.dpa.gr) or the data protection authority in your own country.