Privacy policy
LUGANO TATTOO ROYALE – luganotattooroyale.com
INFORMATION ON PERSONAL DATA PROCESSING
This Privacy Policy is provided in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”) and the Swiss Federal Act on Data Protection (nFADP/nLPD, in force since 1 September 2023). It explains how personal data is collected, used, and protected when you visit or interact with the website luganotattooroyale.com (the “Website”).
The Website serves as the official platform for the Lugano Tattoo Royale international tattoo convention, held in Lugano, Switzerland. Given the cross-border nature of this project — involving a Swiss organising entity and Italian technical infrastructure — both the GDPR and the nFADP apply to the processing activities described herein.
The Joint Data Controllers are committed to protecting your personal data and ensuring that it is processed in a lawful, fair, and transparent manner.
1. Data Controller
The Data Controller responsible for this Website and the Lugano Tattoo Royale convention is:
TATTOO ROYALE SAGL
Corso San Gottardo 20
6830 Chiasso – Switzerland
IDI Nr / VAT Nr: CHE-401.733.952
Email: info@luganotattooroyale.com
The Website’s technical infrastructure, including hosting servers, is located in Italy and managed by Macko Investment Srl (Via N. Lagravinese 50/E, 70043 Monopoli (BA) – P.IVA 07979690729), which acts as joint technical controller pursuant to Art. 26 GDPR solely in respect of the processing operations carried out through that infrastructure. For all practical purposes, users may address any request or inquiry to Tattoo Royale SAGL using the contact details above.
2. Types of Data Processed
2.1 Browsing Data
The IT systems and software procedures used to operate the Website automatically collect certain personal data as part of their normal functioning. This includes, for example, IP addresses, browser type, operating system, referring URL, and date and time of access.
These data are used to ensure the proper functioning and security of the Website and to obtain aggregated statistical information. They are retained only for a limited period unless required for the investigation of unlawful activities.
Legal basis: Art. 6(1)(f) GDPR – legitimate interest in ensuring the security and proper functioning of the Website.
2.2 Data Voluntarily Provided by the User
Users are not required to register to access the Website. However, personal data may be provided voluntarily, for example when filling out contact forms, subscribing to the newsletter, or sending direct communications.
Such data may include: name, email address, phone number, country of residence, Instagram username or handle, tattoo studio (if provided), and any other information the user includes in the message field.
3. Purpose and Legal Basis of Processing
3.1 Handling Contact Requests
To respond to inquiries submitted via contact forms or email. The provision of personal data for this purpose is optional but necessary to process and respond to the user’s request.
Legal basis: Art. 6(1)(b) GDPR – pre-contractual measures.
3.2 Newsletter and Marketing Communications
To send email newsletters and promotional communications relating exclusively to Lugano Tattoo Royale. Such communications are sent only with the user’s explicit consent, collected through a specific optional checkbox in the newsletter subscription form.
Personal data collected for newsletter purposes are not shared with third parties for their own marketing purposes. They may be processed by email service providers acting as data processors on behalf of the Joint Data Controllers.
Legal basis: Art. 6(1)(a) GDPR – consent.
3.3 Optional Marketing via Contact Form
Users who submit a contact request may optionally provide separate and specific consent, through dedicated checkboxes, to receive email communications from Lugano Tattoo Royale and/or from selected tattoo brands and event partners.
These consents are independent and optional, and are not required in order to submit or process the contact request. Personal data may be shared with selected partners only where the user has provided explicit consent.
Legal basis: Art. 6(1)(a) GDPR – consent.
3.4 Compliance with Legal Obligations
To fulfil obligations imposed by applicable laws and regulations, including Italian and Swiss data protection law.
Legal basis: Art. 6(1)(c) GDPR – legal obligation.
3.5 Protection of Legal Rights
Where necessary, personal data may be processed to establish, exercise, or defend legal claims.
Legal basis: Art. 6(1)(f) GDPR – legitimate interest.
4. Data Retention
Personal data are retained only for as long as necessary to fulfil the purposes for which they were collected and in accordance with applicable legal obligations:
• Data related to contact requests: retained for up to 12 months from the date of the last interaction.
• Data processed for marketing purposes: retained until consent is withdrawn and, in any case, no longer than 24 months from the last interaction with the user.
• Data processed to comply with legal obligations: retained for the period required by applicable law.
• Browsing data: retained for a limited period, typically no longer than 90 days, unless required for security investigations.
The Joint Data Controllers periodically review the data processed to assess whether they remain relevant and necessary.
5. Methods of Processing and Security Measures
Personal data are processed using electronic and, where necessary, manual tools, in accordance with the principles of lawfulness, fairness, and transparency.
Appropriate technical and organisational measures are adopted to ensure a level of security appropriate to the risk, including protection against unauthorised access, loss, or unlawful processing. Hosting infrastructure is located in Italy.
However, it is not possible to guarantee that such measures completely eliminate any risk of unauthorized access or data disclosure.
To report malfunctions or abuse, or to send suggestions, please contact: info@luganotattooroyale.com
6. Data Recipients
Personal data may be processed by authorised personnel of the Joint Data Controllers and, where necessary, shared with third parties, including:
• IT service providers and hosting providers (servers located in Italy);
• Email service providers and marketing platforms;
• Security service providers (including Google reCAPTCHA);
• Legal and administrative consultants;
• Selected tattoo brands and event partners (only where the user has provided explicit consent).
Such parties act as data processors or independent controllers, depending on the circumstances and the nature of the processing.
7. Transfers of Data Outside the European Economic Area (EEA) and Switzerland
Personal data may be transferred to countries outside the European Economic Area (EEA) and outside Switzerland, in particular in connection with the use of services provided by companies such as Google LLC, which may process data in the United States or other third countries.
In such cases, the Joint Data Controllers ensure that such transfers are carried out in compliance with the GDPR (Chapter V) and the nFADP, in particular through:
• Adequacy decisions issued by the European Commission;
• Standard Contractual Clauses (SCCs) approved by the European Commission;
• Equivalent safeguards recognised under Swiss law.
Note: Switzerland, while not an EEA member, has been recognised by the European Commission as providing an adequate level of data protection. Data flows between Switzerland and the EEA are therefore permitted without additional safeguards.
8. Cookies, Tracking Technologies, and Third-Party Services
The Website uses cookies and similar tracking technologies to ensure its proper functioning and to improve the user experience. Cookies may also be used, subject to the user’s consent where required, to collect statistical information and to enable additional functionalities.
For detailed information on the use of cookies, the specific technologies deployed, and how to manage or withdraw consent, users are invited to consult the Cookie Policy available on the Website.
8.1 Google Analytics 4
The Website uses Google Analytics 4 (“GA4”), a web analytics service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). GA4 collects browsing data — such as pages visited, session duration, device type, and approximate geolocation — and generates aggregated statistical reports on Website usage. IP addresses are anonymised before any data is stored.
Legal basis: Art. 6(1)(a) GDPR – consent. GA4 is activated only after the user grants consent via the cookie banner.
Data transfer: Covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses (SCCs — Decision 2021/914/EU).
Opt-out: Withdraw consent via the cookie preferences panel at any time, or install the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout).
Privacy policy: policies.google.com/privacy
8.2 Google Fonts
The Website uses Google Fonts for typography. Font files are loaded by your browser directly from Google’s servers (fonts.googleapis.com / fonts.gstatic.com). This means that your IP address is transmitted to Google LLC when you visit the Website, as part of the font loading process. This processing is carried out by Google LLC as an independent data controller.
Legal basis: Art. 6(1)(f) GDPR / Art. 6(1) nFADP – legitimate interest in providing consistent typographic rendering across devices.
Data transfer: Covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses (SCCs — Decision 2021/914/EU).
Privacy policy: policies.google.com/privacy
8.3 Google reCAPTCHA
Certain forms on the Website may be protected by Google reCAPTCHA, a service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). reCAPTCHA analyses user behaviour on the Website to distinguish between human users and automated bots, using cookies and other tracking technologies.
The data collected by reCAPTCHA (including IP address, browser information, mouse movements, and interaction patterns) is transmitted to and processed by Google LLC. This data may be transferred to the United States or other third countries outside the EEA and Switzerland, under Standard Contractual Clauses approved by the European Commission.
Google LLC processes this data as an independent data controller for its own purposes, in accordance with Google’s Privacy Policy (policies.google.com/privacy) and Terms of Service (policies.google.com/terms).
Legal basis: Art. 6(1)(f) GDPR – legitimate interest of the Joint Data Controllers in ensuring the security of the Website and its forms against spam and abuse.
Users who prefer not to have their data processed by Google reCAPTCHA may contact us directly at info@luganotattooroyale.com as an alternative means of communication.
8.4 YouTube
Some pages of the Website embed videos hosted on YouTube, a service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). YouTube is used in two different configurations on this Website:
Background videos: decorative or ambient videos used as visual backgrounds are loaded via privacy-enhanced mode (youtube-nocookie.com). This configuration is designed to minimise data collection. However, YouTube may still set certain session cookies (such as __Secure-ROLLOUT_TOKEN, __Secure-YNID, VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA, YSC) regardless of user consent, as these are set directly by YouTube’s infrastructure and are outside the control of this Website.
Embedded videos: interactive video players embedded within page content are blocked by the cookie consent banner and are activated only after the user has granted explicit consent.
Legal basis: Art. 6(1)(a) GDPR – consent. For embedded videos, cookies are set only after consent is granted via the cookie banner. For background videos in privacy-enhanced mode, data processing is carried out by YouTube as an independent controller and is outside the control of this Website.
Data transfer: Covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
Privacy policy: policies.google.com/privacy
8.5 Google Maps
The Website embeds interactive maps provided by Google Maps, a service of Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). When a map is displayed, the user’s browser connects to Google’s servers and may transmit the user’s IP address, location data (if the user has granted browser geolocation permission), and device information. Maps are blocked by the cookie consent banner and are activated only after the user has granted explicit consent.Legal basis: Art. 6(1)(a) GDPR – consent.
Data transfer: Covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
Privacy policy: policies.google.com/privacy
8.6 Cookie Consent Management – Complianz
Cookie consent on this Website is managed through Complianz, a cookie consent management platform provided by Complianz B.V. (Kalmarweg 14-5, 9723 JG Groningen, Netherlands).
Complianz stores the user’s consent preferences locally via functional cookies (see Cookie Policy for details) in order to remember the choices made via the cookie banner and to ensure that only authorised scripts and third-party services are activated. No personally identifiable data collected through the consent process is shared with third parties.
Legal basis: Art. 6(1)(c) GDPR – legal obligation (implementation of cookie consent requirements under the ePrivacy Directive and applicable national law); Art. 6(1)(f) GDPR – legitimate interest in maintaining records of consent.
Privacy policy: complianz.io/privacy-statement
9. Rights of the Data Subject
In accordance with the GDPR and the nFADP, users have the right at any time to:
• Access their personal data (Art. 15 GDPR / Art. 25 nFADP);
• Request rectification of inaccurate data (Art. 16 GDPR / Art. 32 nFADP);
• Request erasure of their data (‘right to be forgotten’) (Art. 17 GDPR);
• Request restriction of processing (Art. 18 GDPR);
• Object to processing, including for direct marketing purposes (Art. 21 GDPR);
• Withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal (Art. 7(3) GDPR);
• Receive their data in a structured, commonly used format (data portability) (Art. 20 GDPR);
• Lodge a complaint with a competent supervisory authority.
Supervisory Authorities:
• For data subjects in the EU/EEA: the Italian Data Protection Authority (Garante per la protezione dei dati personali – www.garanteprivacy.it) or the supervisory authority of their habitual residence or place of work;
• For data subjects in Switzerland: the Federal Data Protection and Information Commissioner (FDPIC / PFPDT – www.edoeb.admin.ch).
Requests to exercise any of the above rights can be submitted to: info@luganotattooroyale.com
No automated decision-making processes, including profiling pursuant to Article 22 GDPR, are carried out.
10. Third-Party Websites
The Website may contain links to external websites not managed or controlled by the Joint Data Controllers, including social media platforms such as Instagram, video platforms such as YouTube, and mapping services such as Google Maps.
When users click on such links, they leave the Website and are subject to the privacy policies and terms of use of the respective third-party websites. The Joint Data Controllers are not responsible for the content, security, or privacy practices of such external websites.
11. Minors
The Website is not intended for individuals under the age of 18 (or under the applicable age of majority in the user’s jurisdiction), and the Joint Data Controllers do not knowingly collect personal data from minors. If such data are inadvertently collected, they will be promptly deleted upon notification.
12. Applicable Law
This Privacy Policy is governed by and construed in accordance with:
• Regulation (EU) 2016/679 (GDPR), applicable in respect of the processing activities carried out through the Italian technical infrastructure and in relation to data subjects located in the EU/EEA;
• The Swiss Federal Act on Data Protection (nFADP/nLPD, SR 235.1, in force since 1 September 2023), applicable in respect of the processing activities connected to the Swiss organising entity and in relation to data subjects located in Switzerland.
In the event of any conflict between the two frameworks, the more protective standard shall apply.
13. Changes to this Privacy Policy
The Joint Data Controllers reserve the right to update this Privacy Policy at any time to reflect changes in applicable law, processing activities, or organisational structure. Users are encouraged to review this page periodically. The date of the last update is indicated at the top of this document.