Last updated: 2 September 2026

1. Who we are

This Privacy Policy explains how MASTILNICA EOOD, UIC 203064316 (“Mastilnica”, “we”, “us”), processes personal data when you visit mastilnica.com, contact the studio, use the live chat, request a consultation, create an account or place an order through the online shop.

Data controller: MASTILNICA EOOD, UIC 203064316
Contact address: 152 G. S. Rakovski St., Sofia, Bulgaria
Email: info@mastilnica.com
Telephone: +359 885 432 604

2. Personal data we may collect

  • Contact and enquiry data: name, email address, telephone number, subject and message content.
  • Consultation and appointment data: preferred artist, tattoo idea, placement, size, reference images, preferred date and related correspondence.
  • Live-chat and messaging data: the content of your chat, contact details you choose to provide, timestamps and basic technical information. This also applies when you contact us through WhatsApp, Viber or a social platform.
  • Order and account data: name, billing and delivery address, email address, telephone number, account details, order history, payment status and transaction reference. We do not normally receive full payment-card details when payment is handled by an external payment provider.
  • Technical and usage data: IP address, browser and device information, language, referring page, pages viewed, approximate location, cookie identifiers and security logs.
  • Photographs and media: photographs or videos of tattoos and studio work where you have agreed that they may be created and used.

Please do not send health information through the general contact form or live chat unless we specifically request it for the safe provision of a service. Where health-related information is genuinely necessary, we process it only with an appropriate legal basis, which may include your explicit consent.

3. Why we use personal data and our legal bases

  • To answer enquiries, arrange consultations and appointments, and take steps requested by you before entering into a contract — Article 6(1)(b) GDPR.
  • To provide tattoo, consultation and retail services and manage orders, payments, delivery, returns and customer accounts — Article 6(1)(b) GDPR.
  • To issue and retain accounting and tax documents and comply with other legal obligations — Article 6(1)(c) GDPR.
  • To protect the website, prevent spam, fraud and abuse, maintain service security, and establish or defend legal claims — Article 6(1)(f) GDPR, based on our legitimate interests.
  • To measure website performance and understand how visitors use the site — Article 6(1)(a) GDPR where consent is required.
  • To publish identifiable photographs, videos or testimonials — Article 6(1)(a) GDPR, on the basis of consent, unless another lawful basis has been clearly agreed.

4. Contact forms, consultations and live chat

When you send a message through the website, request a consultation or use the live chat, we use the information you provide only to respond, organise the requested service and keep an appropriate record of the communication. The live-chat service is provided through tawk.to, which may process chat content and technical information on our behalf. See the tawk.to Privacy Policy.

5. Online shop and customer accounts

The online shop is operated with WooCommerce. When you place an order or create an account, we process the information necessary to complete the purchase, provide customer support, manage returns and comply with accounting and tax requirements. Necessary WooCommerce cookies may remember your cart, session and account status.

6. Cookies, analytics and external services

The website uses cookies and similar technologies. Some are strictly necessary for security, the shopping cart, account functions and core site operation. Others support analytics, live chat or external content and are used on the basis of consent where required by law. You can restrict or delete cookies through your browser settings; blocking necessary cookies may affect the operation of the shop or account.

  • Google Analytics and Google Tag Manager: help us understand website traffic and performance. Data may include device and browser information, page interactions, approximate location and cookie identifiers. See Google’s Privacy Policy.
  • tawk.to: provides the live-chat widget and may use cookies or similar technologies needed to deliver and secure the chat.
  • Cloudflare Turnstile: helps distinguish human visitors from automated abuse and protect our forms. See the Cloudflare Turnstile Privacy Addendum.
  • Google Reviews / Trustindex: displays public reviews and may load resources from the relevant service provider.
  • External platforms: links or embedded content from Instagram, Facebook, TikTok, YouTube, LinkedIn, Pinterest, WhatsApp and Viber are governed by the privacy terms of those providers. When you open such a link or content, the provider may receive technical and usage data.

7. Who may receive your data

We may share personal data only where necessary with hosting and IT providers, email and communication providers, tawk.to, Cloudflare, Google, payment providers, delivery companies, accountants and professional advisers, and competent public authorities where required by law. These recipients act as processors, independent controllers or authorised recipients according to the service and applicable law. We do not sell personal data.

8. International data transfers

Some service providers may process data outside the European Economic Area. Where required, transfers are protected by an adequacy decision, the European Commission’s Standard Contractual Clauses or another lawful safeguard under Chapter V GDPR. Further information may be obtained from us or from the relevant provider’s privacy documentation.

9. How long we keep personal data

We retain data only for as long as necessary for the purpose for which it was collected:

  • Enquiries, consultations and chat correspondence are kept for the time needed to handle the request and, where appropriate, for a reasonable period afterwards to manage follow-up questions or legal claims.
  • Order, payment and accounting records are retained for the statutory periods required by applicable accounting and tax law.
  • Account data is retained while the account is active or until you request deletion, unless continued retention is legally required.
  • Security logs and analytics data are retained according to operational necessity and the settings of the relevant service.
  • Media used on the basis of consent is kept until the consent is withdrawn or the stated purpose no longer applies, subject to copies already lawfully used and any overriding legal requirements.

10. Security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, alteration or disclosure. No internet service is completely risk-free, so please avoid sending unnecessary sensitive information through open communication channels.

11. Your rights

Subject to the conditions of the GDPR, you may request access to your personal data, rectification, erasure, restriction of processing, data portability, or object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent at any time without affecting processing carried out before withdrawal. You also have the right to lodge a complaint with a supervisory authority.

To exercise your rights, contact info@mastilnica.com. We may need to verify your identity before responding.

12. Children

The website and online services are not intentionally directed at children. If a person under 18 contacts us regarding a service, we may require the involvement and consent of a parent or legal guardian where appropriate.

13. Automated decision-making

We do not use personal data to make decisions based solely on automated processing that produce legal or similarly significant effects.

14. Complaints

You may lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP): 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria; cpdp.bg.

15. Changes to this policy

We may update this policy when our services, technologies or legal obligations change. The latest version and its revision date will be published on this page.