TATTOOS BY CHARLENE

🔐 POPIA Privacy Policy

This Privacy Policy explains how Tattoos By Charlene collects, uses, stores, protects and discloses personal information in accordance with applicable South African privacy law, including the Protection of Personal Information Act 4 of 2013 (POPIA).

1. Who We Are

Responsible Party: Tattoos By Charlene

Business: Tattoos By Charlene, Johannesburg, South Africa

Contact: admin@tattoosbycharlenejhb.co.za

For purposes of POPIA, Tattoos By Charlene is responsible for determining the purposes and means of processing personal information collected through our website, booking processes, consent forms, WhatsApp communications, studio services and related business activities.

2. What Personal Information We May Collect

Depending on the service or interaction, we may collect information such as:

• Name and surname
• Telephone / WhatsApp number
• Email address
• Physical or appointment address where required, including for house calls
• Age and date of birth where relevant to consent, identification or age requirements
• Identification or guardian information where legally or operationally required
• Booking details, appointment history, quotations, payment information and transaction records
• Tattoo or piercing preferences, placement information, reference images and design information
• Health, allergy, medication, skin, healing and other information voluntarily supplied for the safe performance of a tattoo or piercing
• Consent records, signed acknowledgements and communications relating to appointments or procedures
• Images or photographs that you voluntarily provide or that are created as part of the service, where applicable
• Website, device and technical information that may be collected through website technologies, analytics or payment providers

3. Health & Other Sensitive Information

Some information collected through tattoo and piercing consent processes may be sensitive or may include health information. We request this information only where reasonably necessary for consultation, consent, risk assessment, procedure planning, aftercare, record-keeping, legal compliance or the protection of the client and studio.

Please provide accurate information. Withholding relevant information may affect whether a procedure can safely or appropriately proceed.

We do not ask for sensitive information merely because it is interesting or convenient. Information collected must be relevant to the purpose for which it is requested.

4. Why We Process Your Information

We may process personal information to:

• Respond to enquiries and communicate with clients
• Provide quotations and prepare designs
• Create, manage and confirm appointments
• Process deposits, balances and other payments
• Complete compulsory tattoo and piercing consent procedures
• Assess suitability, risks, placement and client-provided health information where relevant
• Provide aftercare information and post-procedure support
• Provide house calls, event services and travel arrangements
• Manage customer accounts, records, loyalty/referral programmes and service history
• Meet legal, accounting, tax, security, fraud-prevention and record-keeping obligations
• Protect the safety, security and legitimate interests of clients, staff and the business
• Send direct marketing only where permitted by law and where the necessary consent or other lawful basis exists

5. Lawful Processing

We aim to process personal information in accordance with POPIA's lawful-processing requirements, including accountability, processing limitation, purpose specification, further-processing limitation, information quality, openness, security safeguards and data-subject participation.

We will not knowingly collect more personal information than is reasonably necessary for the stated purpose, and we will seek to maintain information that is accurate and relevant.

6. Consent

Where consent is required or relied upon, it will be requested in an appropriate manner. Marketing consent is separate from consent to receive a tattoo or piercing service.

A client's tattoo or piercing consent form is compulsory before the relevant procedure is performed. Consent to a procedure does not automatically mean consent to marketing, social-media publication or other unrelated processing.

You may withdraw consent where the law permits withdrawal, although withdrawal does not necessarily affect processing already carried out lawfully before withdrawal or processing required by law.

7. Sharing & Third Parties

We may use trusted service providers where necessary to operate the business, for example booking/form services, payment providers, website hosting, cloud or communication services, accounting services, security services and other operational suppliers.

Where third parties process personal information on our behalf, we aim to require appropriate confidentiality and security obligations and to use information only for authorised purposes.

We may disclose information where required or permitted by law, court order, regulatory requirement, fraud prevention, safety or to protect our rights and the rights of others.

8. Cross-Border Processing

Some service providers we use may store or process information outside South Africa. Where personal information is transferred outside South Africa, we will take reasonable steps to ensure the transfer and processing comply with POPIA and any other applicable law, including applicable requirements concerning recipients in other countries.

9. How We Protect Information

We take reasonable technical and organisational measures designed to protect personal information against loss, damage, unauthorised access, disclosure, alteration or destruction. Security measures may include controlled access, passwords, secure systems, confidentiality controls, physical security, limited access to client records and appropriate disposal procedures.

No system can be guaranteed completely secure. Clients should avoid sending unnecessary sensitive information through unsecured channels.

10. Retention

We retain personal information only for as long as reasonably necessary for the purpose for which it was collected, for ongoing client-service needs, legitimate business purposes, dispute handling, tax/accounting requirements, legal obligations or other lawful purposes.

Different records may have different retention periods. When information is no longer required and there is no lawful reason to retain it, we will take reasonable steps to securely delete, destroy or de-identify it.

11. Your Rights

Subject to applicable legal requirements and limitations, you may have rights to:

• Request access to your personal information
• Request correction or updating of inaccurate information
• Request deletion where the law permits
• Object to certain processing where permitted
• Withdraw consent where consent is the lawful basis, subject to applicable exceptions
• Request details about how your information is processed
• Lodge a complaint concerning the handling of your personal information

Requests may require reasonable verification of identity and may be subject to lawful exceptions or limitations.

12. Direct Marketing

We may communicate with clients about services, appointments, specials, products or events where permitted by applicable law. Marketing communications will be handled in accordance with applicable consent and opt-out requirements.

You may ask us to stop sending marketing communications. Service-related communications, booking confirmations and other essential operational messages are not the same as marketing communications.

13. Children & Minors

Where a service involves a minor, we may collect additional information necessary to confirm age, identity, guardian status and consent. Information relating to children is treated with additional care and processed only for appropriate lawful purposes.

14. Website Technologies

Our website may use cookies, analytics, security tools, payment technologies and similar technologies to operate the website, improve user experience, measure performance and protect the business. Third-party services may have their own privacy policies and terms.

15. Data Security Incidents

If we become aware of a security compromise affecting personal information, we will take reasonable steps to investigate, contain and address the incident and make any notifications required by applicable law.

16. Updates To This Policy

We may update this Privacy Policy from time to time to reflect changes in our services, technology, legal requirements or business practices. The latest version published on our website will apply from its stated effective date.

Last updated: 21 August 2026

17. Contact Us About Your Personal Information

For privacy questions, access/correction requests, concerns or complaints about personal information processing, contact us at:

admin@tattoosbycharlenejhb.co.za

Tattoos By Charlene • Johannesburg, South Africa

18. Information Regulator

You may also contact the Information Regulator of South Africa where appropriate. The Information Regulator is established under section 39 of POPIA and has powers relating to monitoring and enforcing compliance with POPIA.

Information Regulator South Africa
Tel: 010 023 5200
Email: enquiries@inforegulator.org.za

Official website: inforegulator.org.za