Privacy Policy
1. Who We Are
Beach Street Arts Tattoo Temple ("we", "us", "our") is a professional tattoo studio located at 54/4 Suthat Soi 2, Tambon Talat Yai, Mueang Phuket 83000, Thailand.
Contact: WhatsApp +66 64 943 1369 | [email protected]
We are committed to protecting your personal data. This policy explains how we collect, use, store, and share your information when you visit our website (beachstreetarts.com) or contact us to book a tattoo session.
2. Data We Collect
We collect the following categories of personal data when you submit the booking form:
| Data Type | Why We Collect It | Legal Basis |
|---|---|---|
| Full name | To identify and address you in communication | Contractual necessity / Consent |
| Email address | To reply to your booking inquiry | Contractual necessity / Consent |
| Phone / WhatsApp number (optional) | To contact you directly on WhatsApp about your booking | Consent |
| Preferred appointment date | To schedule your tattoo session | Contractual necessity |
| Tattoo style and concept description | To prepare and quote for your design | Contractual necessity |
| IP address | Security logging, fraud prevention, and rate limiting | Legitimate interests |
| Country (via Cloudflare) | Understanding our visitor geography; fraud prevention | Legitimate interests |
| Browser / User-Agent string | Technical debugging and bot detection | Legitimate interests |
We do not collect payment card details, passport information, health records, or any special category data through this website.
3. How We Use Your Data
- Respond to your tattoo booking inquiry and schedule your session
- Send you a WhatsApp or email confirmation of your appointment details
- Discuss your tattoo design concept and provide a price quote
- Prevent spam and fraudulent form submissions (security)
- Internal business analytics (non-identifiable, aggregate only)
We do not use your data for unsolicited marketing or advertising. We will only contact you about your specific booking inquiry unless you explicitly request otherwise.
4. Third-Party Services We Use
Your booking form data may pass through the following third-party processors:
| Service | Purpose | Data Shared | Privacy Policy |
|---|---|---|---|
| FormSubmit.co | Email delivery of booking form to our Gmail inbox | Name, email, phone, style, date, concept description | formsubmit.co/privacy |
| Cloudflare | CDN, DDoS protection, IP anonymisation, real-IP restoration | IP address, request metadata (no personal form fields) | cloudflare.com/privacypolicy |
| Google Fonts | Typography loading | IP address (standard web request) | policies.google.com/privacy |
| Google Maps | Embedded map for studio location | IP address when map loads (standard iframe request) | policies.google.com/privacy |
| Google Ads | Measuring whether our ads lead to bookings (conversion tracking) | IP address, browser/device info, pages visited, and whether you tapped WhatsApp/phone or sent the booking form. No form contents (name, email, concept) are sent. | policies.google.com/privacy |
| Telegram (optional) | Internal booking notification to studio staff | Name, email, style, date, concept (if webhook is configured) | telegram.org/privacy |
We do not sell, rent, or trade your personal data to any third party for commercial purposes.
5. How Long We Keep Your Data
- Booking records (name, email, concept): Retained for up to 2 years in our encrypted database, then deleted. This covers the period you might need to contact us for a touch-up or follow-up session.
- IP address logs: Retained for 90 days for security purposes, then purged.
- Email correspondence: Subject to Gmail retention settings; you may request deletion at any time.
6. Your Rights
Depending on your country of residence, you may have the following rights regarding your personal data:
- Right of access — Request a copy of the data we hold about you
- Right to rectification — Ask us to correct inaccurate or incomplete data
- Right to erasure ("right to be forgotten") — Request deletion of your data
- Right to restrict processing — Ask us to pause processing of your data
- Right to data portability — Receive your data in a machine-readable format
- Right to withdraw consent — At any time, for consent-based processing
- Right to object — Object to processing based on legitimate interests
These rights apply under:
- EU General Data Protection Regulation (GDPR)
- Thailand Personal Data Protection Act B.E. 2562 (PDPA)
- Other applicable local privacy laws
To exercise any of these rights, please contact us on WhatsApp or email [email protected]. We will respond within 30 days.
7. Data Security
We take the security of your data seriously. Our technical measures include:
- Booking data stored in an encrypted SQLite database with file permissions restricted to the server process only
- HTTPS encryption for all data in transit (via Let's Encrypt TLS)
- Rate limiting on all form submissions to prevent spam and abuse
- Honeypot fields to automatically discard bot submissions
- Input validation and sanitisation on both client and server side
- IP-based anti-spam protection via Cloudflare
No system is 100% secure. In the unlikely event of a data breach that affects your rights, we will notify you and the relevant supervisory authority within 72 hours as required by law.
8. Cookies & Tracking
We use the Google Ads tag (gtag.js) to measure whether people who arrive from our ads go on to contact us — a tap on WhatsApp or our phone number, or a sent booking form. Google may set cookies for this. We do not use Google Analytics, and we never send your booking form contents to Google.
For visitors from the EU/EEA, the UK and Switzerland, advertising cookies are off by default (Google Consent Mode). You can also block or delete cookies in your browser settings, or opt out of personalised ads at adssettings.google.com.
Third-party services embedded on our pages (Google Fonts, Google Maps) may set their own cookies when you load those resources. Please refer to their respective privacy policies (listed above) for details.
9. International Data Transfers
Beach Street Arts is based in Thailand. When you submit a booking form, your data may be temporarily processed by FormSubmit.co (US-based) and Cloudflare (US-based, with global edge nodes) as described in Section 4. Both services have appropriate safeguards in place for international data transfers (Standard Contractual Clauses where applicable).
10. Children's Privacy
Tattooing is a service for adults (18+ or with legal guardian consent per local regulations). We do not knowingly collect personal data from individuals under 18 years of age. If you believe a minor has submitted data through our website, please contact us immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Material changes will be communicated to clients who have provided their email address.
12. Contact & Data Requests
For any privacy-related questions, data access requests, or deletion requests, please contact us:
- WhatsApp: +66 64 943 1369
- Email: [email protected]
- Address: 54/4 Suthat Soi 2, Tambon Talat Yai, Mueang Phuket 83000, Thailand