Privacy Policy

The data controller is RAVEN, LDA, company number 515387622, registered at Rua 6 de Novembro, no. 17A, Paços de Ferreira, Portugal ("RAVEN").

Privacy contact: [email protected]

It applies to the website, the triage form and the client account. It does not cover processing that each artist carries out independently outside the RAVEN ecosystem (artists are independent professionals — see §8). Cookies are covered by the Cookie Policy (a separate document, with a consent banner).

• Identification and contact: name, email, phone.
• Account and authentication: account identifier, access method (passwordless / SSO), account status.
• Triage and project: your brief, idea, body area, preferences, references and indicative budget.
• Gender (optional, self-described): only if you choose to provide it (see §4).
• Health data (special category — Art. 9 GDPR): safety contraindications you state in the triage (see §5).
• Communication: messages and contact history with us.
• Technical data: access logs, device and cookie data (see Cookie Policy).

In the triage we ask for a minimal set of health information that serves only the safety of the procedure — to identify contraindications (e.g. pigment allergies, skin conditions in the area, clotting disorders, pregnancy). We process it on the basis of your explicit consent (Art. 9(2)(a)), collected through a separate, dedicated consent box (not pre-ticked). We apply:

• Minimisation: only what is needed for contraindications — we do not collect medical history.
• Restricted access: only those who need it (RAVEN, in the triage, and the executing artist, if the project proceeds).
• Short retention and no mixing with other data.

You can withdraw this consent at any time, without affecting the lawfulness of prior processing. The triage is not a medical assessment and does not replace consulting a health professional.

We do not make solely automated decisions with significant effects on you. Curation and triage are decided by people.

We use cookies for operation, security, preferences and — only with your consent — measurement. The detail is in the Cookie Policy, with a prior-consent banner for non-essential cookies.

• Executing artist: if the project proceeds, they receive what is needed to perform it safely (including the relevant contraindications). The artist is an independent professional; as to that data they may be an independent controller or, where there are joint purposes, a joint controller (Art. 26 GDPR).
• Providers acting on our behalf (processors, under Art. 28 GDPR contracts): platform hosting, email service and, if applicable, measurement/analytics (only with cookie consent). [final list to be confirmed with implementation.]
• Authorities, where legally required.

We do not sell your personal data.

Some providers may process data outside the European Economic Area. Where they do, we ensure appropriate safeguards (an adequacy decision or the European Commission's Standard Contractual Clauses).

• General rule: only as long as needed for each purpose; then we delete or anonymise it.
• Automatic clean-up: rejected requests/accounts are removed ~7 days after the decision; approved but inactive ~30 days after last activity, with prior notice. Technical integrity logs are kept in anonymised form.
• Legal obligations: where a legal retention duty applies, we comply for the applicable period.

You have the right to access, rectify, erase, restrict, object, to data portability and to withdraw consent at any time (without retroactive effect). To exercise them, contact us (§1); we respond within the legal time limits. An erasure request does not override data we are legally obliged to keep or that is needed for the defence of legal claims.

You may also lodge a complaint with the supervisory authority — the Portuguese Data Protection Authority, CNPD, Av. D. Carlos I, no. 134, 1.º, 1200-651 Lisbon · [email protected] · www.cnpd.pt.

We apply appropriate technical and organisational measures (least-privilege access, access control, event logging, providers with safeguards; health data has reinforced protection). In the event of a data breach with risk, we comply with the legal notification duties.

RAVEN does not address minors under 18 and does not accept tattoo projects on minors. We do not knowingly collect minors' data for this purpose.

The site may link to third-party pages (e.g. artist profiles, social media). Those pages have their own policies, for which RAVEN is not responsible.

We may update this policy; the version in force applies, identified by version and date. We communicate material changes.