TATTOO LIE – WWW.TATTOOLIFE.COM
Last updated: May 2026
This Privacy Policy is provided in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation – “GDPR”) and explains how personal data is collected, used, and protected when you visit or interact with the website www.tattoolife.com (the “Website”).
The Website is owned and managed by Mediafriends S.r.l. and is intended to provide provide news, interviews, visual inspirations and editorial content on the international art of tattooing, and to promote Tattoo Life magazine and related publications such us books and digital ebooks.
The Data Controller is committed to protecting your personal data and ensuring that it is processed in a lawful, fair, and transparent manner.
1. Data Controller
The Data Controller responsible for this Website is:
C.so Lodi 18
20135 Milano (MI) – Italy
VAT / C.F.: IT12877390158
R.E.A.: 1594429 – C.C.I.A.A. MI-199024/1999
Operative Office: V.le Papiniano 49, 20123 Milano – Italy
Email: info@tattoolife.com
2. Types of Data Processed
2.1 Browsing Data
The IT systems and software procedures used to operate the Website automatically collect certain personal data as part of their normal functioning. This includes, for example, IP addresses, browser type, operating system, referring URL, and date and time of access.
These data are used to ensure the proper functioning and security of the Website and to obtain aggregated statistical information. They are retained only for a limited period unless required for the investigation of unlawful activities.
Legal basis: Art. 6(1)(f) GDPR – legitimate interest in ensuring the security and proper functioning of the Website.
2.2 Data Voluntarily Provided by the User
Users are not required to register to access the Website. However, personal data may be provided voluntarily, for example when filling out contact forms, subscribing to the newsletter in the footer, or sending direct communications.
Such data may include: name, email address, phone number, country of residence, Instagram username or handle, tattoo studio (if provided), and any other information the user includes in the message and subject field.
3. Purpose and Legal Basis of Processing
3.1 Handling Contact Requests
To respond to inquiries submitted via contact forms or email. The provision of personal data for this purpose is optional but necessary to process and respond to the user’s request.
Legal basis: Art. 6(1)(b) GDPR – pre-contractual measures.
3.2 Newsletter and Marketing Communications
To send email newsletters and promotional communications relating to this Website, Tattoo Life magazine, books, ebooks and related editorial products. Such communications are sent only with the user’s explicit consent, collected through a specific optional checkbox.
Legal basis: Art. 6(1)(a) GDPR – consent.
3.3 Optional Marketing via Contact Form
Users who submit a contact request may optionally provide separate and specific consent, through dedicated checkboxes, to receive email communications relating to this Website, Tattoo Life magazine, books, ebooks and related editorial products. Such communications are sent only with the user’s explicit consent, collected through a specific optional checkbox.
Legal basis: Art. 6(1)(a) GDPR – consent.
3.4 Compliance with Legal Obligations
To fulfil obligations imposed by applicable Italian and EU laws and regulations.
Legal basis: Art. 6(1)(c) GDPR – legal obligation.
3.5 Protection of Legal Rights
Where necessary, personal data may be processed to establish, exercise, or defend legal claims.
Legal basis: Art. 6(1)(f) GDPR – legitimate interest.
4. Data Retention
Personal data are retained only for as long as necessary to fulfil the purposes for which they were collected and in accordance with applicable legal obligations:
• Data related to contact requests: retained for up to 12 months from the date of the last interaction.
• Data processed for marketing purposes or partner consent: retained until consent is withdrawn and, in any case, no longer than 24 months from the last interaction.
• Data processed to comply with legal obligations (e.g. accounting and fiscal records): retained for the period required by applicable law, generally 10 years under Italian law.
• Browsing data and server logs: retained for a maximum of 90 days, unless required for security investigations.
• Cookie consent records: retained for 12 months as evidence of the lawful basis for processing.
5. Methods of Processing and Security Measures
Personal data are processed using electronic and, where necessary, manual tools, in accordance with the principles of lawfulness, fairness, and transparency.
Appropriate technical and organisational measures are adopted to ensure a level of security appropriate to the risk, including protection against unauthorised access, loss, or unlawful processing. Hosting infrastructure is located in Italy.
However, it is not possible to guarantee that such measures completely eliminate any risk of unauthorized access or data disclosure.
To report malfunctions, security concerns, or abuse, please contact: info@tattoolife.com.
6. Data Recipients
Personal data may be processed by authorised personnel of the Data Controller and, where necessary, shared with third parties, including:
• IT service providers and hosting providers (servers located in Italy);
• email service providers and marketing platforms;
• analytics and tracking service providers (see Section 8);
• Security service providers (including Cloudflare Inc.);
• legal, fiscal, and administrative consultants;
• public authorities, where required by law.
Such parties act as data processors pursuant to Art. 28 GDPR or as independent controllers, depending on the circumstances and the nature of the processing.
7. Transfers of Data Outside the European Economic Area (EEA)
Personal data may be transferred to countries outside the European Economic Area (EEA), in particular in connection with the use of services provided by companies such as Google LLC, Meta Platforms Inc., and Cloudflare Inc., which may process data in the United States or other third countries.
In such cases, the Data Controller ensure that such transfers are carried out in compliance with the GDPR (Chapter V), in particular through:
• adequacy decisions issued by the European Commission (e.g. the EU–US Data Privacy Framework for certified US companies, adequacy decision of 10 July 2023);
• Standard Contractual Clauses (SCCs) approved by the European Commission (Decision 2021/914/EU).
You may request further information about the specific safeguards applicable to any transfer by contacting us at info@tattoolife.com.
8. Cookies, Tracking Technologies, and Third-Party Services
The Website uses cookies and similar tracking technologies to ensure its proper functioning and to improve the user experience. For detailed information on the specific cookies used, their duration, and how to manage or withdraw consent, please consult the Cookie Policy available on the Website.
The following subsections describe each third-party service that may be active on the Website.
8.1 Google Analytics 4
The Website uses Google Analytics 4 (“GA4”), a web analytics service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). GA4 collects browsing data — such as pages visited, session duration, device type, and approximate geolocation — and generates aggregated statistical reports on Website usage. IP addresses are anonymised before any data is stored.
Legal basis: Art. 6(1)(a) GDPR – consent. GA4 is activated only after the user grants consent via the cookie banner.
Data transfer: Covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses (SCCs — Decision 2021/914/EU).
Opt-out: Withdraw consent via the cookie preferences panel at any time, or install the Google Analytics opt-out browser add-on (https://tools.google.com/dlpage/gaoptout).
Privacy policy: policies.google.com/privacy
8.2 Google Fonts
The Website may use Google Fonts, a font delivery service provided by Google LLC. When a page loads, the user’s browser may send a request to Google’s servers to retrieve font files, which may transmit the user’s IP address. To protect user privacy, it is recommended to self-host all fonts (download and serve them from the Website’s own server). If self-hosting has been implemented, this section may be removed.
Legal basis: Art. 6(1)(f) GDPR – legitimate interest (technical necessity for correct page rendering). Alternatively, consent may be collected via the cookie banner.
Privacy policy: policies.google.com/privacy
8.3 MailUp
The Website uses MailUp, an email and SMS marketing platform provided by MailUp S.p.A. (Via Famagosta 75, 20142 Milan, Italy). MailUp is an Italian company; all data is processed within the European Union.
Legal basis: Art. 6(1)(a) GDPR – consent.
Data transfer: Within the EU — no adequacy decision or Standard Contractual Clauses required.
Opt-out: Unsubscribe link in every communication, or written request to info@tattoolife.com.
Privacy policy: www.mailup.com/privacy-policy/
8.4 YouTube
Some pages of the Website embed videos hosted on YouTube, a service provided by Google LLC. Videos are embedded using privacy-enhanced mode (youtube-nocookie.com) wherever technically possible, which prevents cookies from being set until the user actively clicks Play. When a video is played, YouTube may set cookies and collect data including the user’s IP address, device information, and viewing behaviour for its own purposes.
Legal basis: Art. 6(1)(a) GDPR – consent. Cookies are set only upon activation of the video player.
Data transfer: Covered by the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
Privacy policy: policies.google.com/privacy
8.5 Facebook / Meta Social Plugins
The Website may display Facebook/Meta social plugins such as Like, Share, or Follow buttons. When such a plugin is present, the user’s browser establishes a direct connection to Facebook’s servers, which may record the user’s IP address and the page visited — even if the user does not interact with the plugin. If the user is logged into Facebook, Meta may associate this visit with their profile. Plugins are loaded only after the user has granted consent.
Legal basis: Art. 6(1)(a) GDPR – consent.
Privacy policy: www.facebook.com/privacy/policy/
8.6 Instagram
The Website may embed Instagram posts or widgets provided by Meta Platforms Ireland Limited. When embedded content is loaded, the user’s browser connects to Instagram/Meta servers and may transmit the user’s IP address. If the user is logged into Instagram, the visit may be associated with their account.
Legal basis: Art. 6(1)(a) GDPR – consent.
Privacy policy: privacycenter.instagram.com/policy
8.7 Social Sharing Buttons
The Website may display social sharing buttons allowing users to share content on social networks. To protect user privacy, these buttons are implemented so that no connection to social networks is established automatically on page load. A connection is made only when the user actively clicks a sharing button, at which point the target platform may collect the user’s IP address and other data in accordance with its own privacy policy.
Legal basis: Art. 6(1)(a) GDPR – consent through voluntary action (clicking the button).
8.8 Cloudflare Turnstile
To protect the Website from spam and automated abuse, we use Cloudflare Turnstile, a privacy-friendly CAPTCHA alternative provided by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Unlike traditional CAPTCHAs, Turnstile validates users without requiring visual puzzles. It may process technical signals such as IP address, browser characteristics, and interaction patterns strictly necessary for the security verification. Data may be transferred to the United States under Standard Contractual Clauses.
Legal basis: Art. 6(1)(f) GDPR – legitimate interest of the Data Controller in ensuring the security of the Website and protecting its forms against spam and abuse.
Privacy policy: www.cloudflare.com/privacypolicy/
8.9 Vimeo
Some pages of the Website embed videos hosted on Vimeo, a platform operated by Vimeo, LLC (555 West 18th Street, New York, NY 10011, USA). When the user interacts with an embedded Vimeo player, Vimeo may collect the user’s IP address and other technical data as an independent data controller. The Data Controller does not control and is not responsible for Vimeo’s independent processing.
Legal basis: Art. 6(1)(a) GDPR – consent.
Data transfer: Covered by Standard Contractual Clauses (Decision 2021/914/EU).
Privacy policy: vimeo.com/privacy
8.10 Pinterest
The Website may include Pinterest Save buttons or widgets provided by Pinterest Europe Ltd. (Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland). These widgets are implemented so that no connection to Pinterest’s servers is established automatically on page load. A connection is made only when the user actively interacts with the widget, at which point the user’s IP address and browsing data may be transmitted to Pinterest as an independent data controller.
Legal basis: Art. 6(1)(a) GDPR – consent, obtained through the user’s active interaction.
Privacy policy: policy.pinterest.com/en/privacy-policy
9. Rights of the Data Subject
In accordance with Articles 15–22 of the GDPR, users have the right at any time to:
• access their personal data and obtain a copy, including information on purposes, categories of recipients, retention periods, and applicable safeguards (Art. 15 GDPR);
• request rectification of inaccurate or incomplete personal data (Art. 16 GDPR);
• request erasure of their data (‘right to be forgotten’) where processing lacks a lawful basis or the purpose has ceased (Art. 17 GDPR);
• request restriction of processing in specific circumstances, e.g. while accuracy is contested (Art. 18 GDPR);
• object to processing based on legitimate interest, including for direct marketing purposes (Art. 21 GDPR);
• withdraw consent at any time, without affecting the lawfulness of processing carried out prior to withdrawal (Art. 7(3) GDPR);
• receive their data in a structured, commonly used and machine-readable format, and transmit it to another controller (data portability — Art. 20 GDPR, applies to data processed by consent or contract);
• lodge a complaint with a competent supervisory authority.
Requests to exercise any of the above rights can be submitted to: info@tattoolife.com. We may ask the user to provide proof of identity to protect against unauthorised access. We will respond within one month of receipt of the request (extendable by two further months in complex cases — Art. 12(3) GDPR).
The competent supervisory authority in Italy is the Garante per la protezione dei dati personali (www.garanteprivacy.it). Users may also lodge a complaint with the supervisory authority of their habitual residence or place of work within the EU.
No automated individual decision-making processes, including profiling pursuant to Art. 22 GDPR, are carried out on this Website.
10. Third-Party Websites
The Website may contain links to external websites not managed or controlled by the Data Controller. When users click on such links, they leave the Website and are subject to the privacy policies of the respective third-party websites. The Data Controller is not responsible for the content or privacy practices of such external websites.
11. Minors
The Website is not directed at individuals under the age of 14 (the minimum age for valid online consent to data processing in Italy — D.Lgs. 196/2003, Art. 2-quinquies, as amended by D.Lgs. 101/2018). The Data Controller does not knowingly collect personal data from minors. If such data are inadvertently collected, they will be promptly deleted upon notification.
12. Changes to This Privacy Policy
The Data Controller reserves the right to update this Privacy Policy at any time to reflect changes in applicable law, processing activities, or the services used. The updated version will be published on this page with a revised ‘Last updated’ date. Users are encouraged to review this page periodically.