Privacy Policy

Tattoo Things Studio is a professional tattoo and body art studio located in Johor Bahru, Malaysia. We operate a website at tattoothings.com.my and accept bookings and enquiries through our website, WhatsApp, email, and social media.

For the purposes of the PDPA 2010, Tattoo Things Studio is the data controller responsible for your personal data.

• Address: No.16-01, Jalan Adda 7, Taman Adda Heights, 81100 Johor Bahru, Johor, Malaysia
• Email: tattoothings88@gmail.com
• Phone / WhatsApp: +60 18-3959 136

We may collect and process the following categories of personal data:

• Identity Data: your full name, as provided when making a booking or enquiry.
• Contact Data: phone number, WhatsApp number, and/or email address.
• Booking & Service Data: tattoo design preferences, body placement, appointment date and time, and any reference images you share.
• Health Data: known skin conditions or allergies, disclosed voluntarily by you for the safe provision of our services.
• Communication Data: messages and correspondence sent via WhatsApp, email, or social media.
• Technical Data: IP address, browser type, device type, and pages visited, collected automatically when you visit our website.

We use your personal data for the following purposes:

• To process and confirm your tattoo or piercing booking appointments.
• To communicate with you about your appointment, including confirmations, reminders, and aftercare advice.
• To respond to your enquiries, questions, and feedback.
• To provide a safe and professional service, including health considerations relevant to tattooing.
• To send you information about our services or promotions, but only where you have given consent or have an existing relationship with us.
• To improve our website using anonymised analytics data.
• To comply with our legal and regulatory obligations.

We will not use your data for any purpose incompatible with the above without your prior consent.

Under the PDPA 2010 (Malaysia), we process your personal data on the following grounds:

• Your consent: for marketing communications and processing sensitive data such as health-related information.
• Contract performance: to fulfil our obligations when you book an appointment or engage our services.
• Legitimate interests: to operate and improve our business, provided such interests are not overridden by your rights.
• Legal obligation: where processing is necessary to comply with applicable Malaysian laws and regulations.

We do not sell, rent, or trade your personal data to third parties. We may share your data only in the following limited circumstances:

• Service providers: trusted third-party platforms used to operate our business (e.g. WhatsApp, Google, Meta/Instagram), subject to their own privacy policies.
• Legal requirements: if required to disclose data by law, court order, or governmental authority in Malaysia.
• Business transfer: in the event of a merger or acquisition, your data may be transferred as part of that transaction, with notice provided to you.

Any third parties with whom we share data are required to treat it in accordance with applicable law.

We retain your personal data only for as long as necessary to fulfil the stated purposes or as required by law:

• Booking & client records: retained for up to 3 years after your last appointment.
• Marketing communications: retained until you withdraw consent or unsubscribe.
• Technical & website data: retained for a maximum of 12 months in anonymised form.

When personal data is no longer required, we will securely delete or anonymise it.

Under the PDPA 2010 (Malaysia), you have the following rights regarding your personal data:

• Right of Access: you may request a copy of the personal data we hold about you.
• Right to Correction: you may request that we correct inaccurate or incomplete data.
• Right to Withdraw Consent: you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to Limit Processing: you may request that we cease or limit the use of your data for direct marketing purposes.

Our website may use cookies \(small text files stored on your device\) to improve your browsing experience and understand how our site is used:

• Strictly necessary: essential for the website to function and cannot be disabled.
• Analytics: help us understand visitor behaviour in aggregate, anonymised form. No personally identifiable data is collected.
• Preference: remember your language or display settings across visits.

You can control cookies through your browser settings. By continuing to use our website, you consent to our use of cookies as described above.

Our website contains links to external sites, including our social media pages on Instagram, Facebook, and TikTok, and navigation services such as Waze and Google Maps. These third-party sites are governed by their own privacy policies.

We have no control over how they collect or process your data. We encourage you to review their privacy policies before interacting with them.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure:

• HTTPS encryption for all data transmitted via our website.
• Access to personal data is limited to staff members who require it to perform their duties.
• Third-party service providers are required to maintain adequate data security standards.

While we strive to protect your data, no method of internet transmission is completely secure. If you believe your data has been compromised, please contact us immediately.

Our services are intended for individuals aged 18 and above. Tattooing and body piercing are not performed on minors in accordance with Malaysian law. We do not knowingly collect personal data from individuals under 18.

If you are a parent or guardian and believe your child has provided us with personal data, please contact us at tattoothings88@gmail.com and we will delete the information promptly.

We may update this Privacy Policy from time to time to reflect changes in our practices, legal obligations, or operational requirements. When we do, we will revise the "Last Updated" date at the top of this page.

We encourage you to review this Policy periodically. Continued use of our website or services after any changes constitutes your acceptance of the revised Policy.