Data processing agreement (DPA)

1. Parties, application and priority

This data processing agreement, version 2026-11-01, supplements the Tatnivo contract between the accepting tattoo studio as controller and Daniel Fischlin, Husmattstrasse 2, 6416 Steinerberg, Switzerland, as processor. Once validly incorporated, it applies to the processing of studio customer data and personal data in reference content within Tatnivo.

It does not establish retrospective acceptance by earlier users. In the event of a conflict with general terms of use, its data protection provisions take priority for processing on behalf of the studio. The operator’s own account, contract, security and billing purposes are described separately in the privacy notice.

2. Subject matter, duration and data categories

The subject matter is the collection, storage, organised display, AI-assisted assessment of work, provision, and instructed rectification, return or deletion of tattoo enquiries and studio references. Processing continues while the service is provided and afterwards only to the extent necessary for agreed retention, return, deletion or mandatory obligations.

Data subjects include the studio’s prospective and existing customers, people shown in images, and artists or contact persons mentioned in reference information. The data includes names, email addresses, telephone numbers, design images, descriptions, body placement, dimensions, style, budget, preferred artist, tattooing time, prices, status and notes. The application is not intended for medical records or unnecessary particularly sensitive data.

3. Studio responsibility and instructions

The studio determines the purposes and permissible scope of its customer processing. It ensures lawful collection, appropriate legal bases, information for data subjects and necessary image permissions. It reviews content and results and uploads only necessary data. Tatnivo decides neither on a tattoo treatment nor on its binding price.

The processor processes data only on documented instructions from the studio, including instructions about transfers. Settings and functions triggered by the authorised studio may constitute such instructions. Additional instructions must be communicated in a traceable manner. If the processor identifies a possible breach of law, it informs the studio and may suspend the affected processing until the matter is clarified. Processing required by mandatory law is communicated in advance where legally permitted.

4. Confidentiality and security measures

Persons with authorised access are bound by confidentiality duties or subject to an equivalent statutory obligation. Access is limited to providing the service and necessary support. The data must not be used for the processor’s own advertising, the sale of customer profiles or independent purposes.

The application’s technical measures include HTTPS delivery, server-side sign-in and studio assignment checks, protected image retrieval, input and file-type checks, size limits, origin checks for write requests and limits on access to public forms. Access keys are handled on the server. This does not assert end-to-end encryption, any particular certification or guaranteed data residency. The measures must be developed in line with the risks; the studio protects its own access and devices. For reference images explicitly approved for display in the customer form, every public retrieval checks the current approval and association with the relevant studio’s work. Individual approval is an instruction for this comparison display and does not release other studio or customer data.

5. Sub-processors and AI

The described service uses OpenAI for ChatGPT Sites and the AI API, and Cloudflare infrastructure provided through Sites for execution, database and file storage. This general authorisation covers the service chain described here. An up-to-date description of the providers used forms part of the privacy information. Stripe relates to the operator’s own studio subscription billing; it does not receive tattoo customer enquiries for payment processing through that arrangement. Supabase is used for the operator’s own studio account authentication; tattoo enquiries, customer images and studio references are not sent to Supabase for that authentication.

Sub-processors may be engaged only under data protection obligations corresponding to the applicable duties here. The processor remains responsible to the studio for its corresponding contractual duties. Planned material additions or replacements will be communicated to the studio in advance, with a reasonable opportunity to raise a substantiated data protection objection. The parties will seek a reasonable solution; if none is possible, the affected service may be terminated before the new provider is used.

AI requests contain design information and images together with selected references, not separate contact fields. Identifying content may still be present in images or free text. store:false is not a promise of Zero Data Retention; the API provider’s published security and retention rules must be taken into account.

6. International transfers

The infrastructure operates internationally, including possible processing in the United States. Exclusive storage in Switzerland or the EU is not agreed. Before a transfer restricted by law, the processor must ensure the required conditions, appropriate safeguards and, where necessary, additional measures, and provide the studio with relevant information on a justified request.

This DPA does not replace any required country-specific transfer agreements. In particular, it neither asserts that standard contractual clauses have been signed with every provider nor grants blanket permission for every target market. The studio must not instruct processing for which necessary legal conditions are absent.

7. Assistance and incidents

Taking account of the nature of processing and available information, the processor assists the studio with data subject rights, data protection impact assessments and required consultation with supervisory authorities. It forwards requests it receives concerning studio customer data to the studio without undue delay and generally does not answer them independently unless required by law.

The studio is notified without undue delay of personal data breaches of which the processor becomes aware. Available information about the nature, affected data, possible consequences and countermeasures will be supplied and supplemented when necessary. The parties cooperate in containment, investigation and legally required notifications.

8. Evidence, return and deletion

The processor provides the information necessary to demonstrate compliance with its applicable duties and enables reasonable audits by the studio or an auditor bound by confidentiality. Audits must be coordinated and protect security and the rights of other studios; legally required audit and supervisory rights are not excluded.

After the contract ends, processed data is returned or deleted at the studio’s choice and on its documented instruction, unless statutory retention prevents this. Enquiry data can be provided through the existing CSV export; further return and deletion are arranged on request. Cancellation does not currently trigger automatic workspace deletion. Any residual retention required by law must be limited and protected, and its reason disclosed. This agreement continues to apply to that extent until the relevant processing has been completed.