Hexed Ink Tattoo Collective – Privacy Policy (South Africa)

1. Who we are

Hexed Ink Tattoo Collective is a tattoo, piercing and permanent makeup studio based in Roodepoort, South Africa.

Contact details

• Address: cnr Kite & Heron Street, Horison, Roodepoort
• Phone / WhatsApp: +27 66 076 0880
• Email: hexed.inkcollective@gmail.com

If you have any questions about this Privacy Policy or how we process your personal information, please contact us using the details above.

2. What personal information we collect

We may collect and process the following types of personal information, where necessary for our business and services:

• Identification details: full name, ID or passport number, date of birth, age confirmation (18+).
• Contact details: phone number, email address, physical address, emergency contact details.
• Booking and service information: appointment history, preferred artist, procedure details, consent forms, before/after photos.
• Health and risk information: relevant medical history you choose to disclose (e.g. allergies, medications, conditions that affect tattooing, piercing or PMU), and your answers on our consent and indemnity forms.
• Payment information: proof of payment and limited payment details needed for invoicing; we do not store your full card details if you pay via a payment gateway.
• Website usage data: IP address, browser type, pages visited, date and time of visits, and cookies or similar technologies (where applicable).

We only collect personal information that is reasonably necessary for the purposes set out in this Privacy Policy.

3. How we collect your personal information

We collect personal information in the following ways:

1. Directly from you when you complete consent forms, booking requests, contact forms, or communicate with us by phone, WhatsApp, email, social media, or in person.
2. Through our website when you use our contact or booking forms or interact with our online content.
3. Indirectly from third-party service providers who assist us with bookings, payments, or marketing, where permitted by law and subject to their own privacy practices.

Providing certain information (e.g. health and identification details) may be a condition of using our services to ensure we can perform procedures safely and legally.

4. Why we collect and use your personal information

We process your personal information for the following lawful purposes:

• To schedule, manage and confirm bookings and appointments.
• To provide tattoo, piercing and permanent makeup services safely and appropriately, including assessing risks and suitability.
• To comply with legal and regulatory requirements, including health and safety, record-keeping, and age restrictions.
• To communicate with you about your appointments, aftercare, studio updates, and changes to our terms or policies.
• To respond to queries, complaints or requests.
• To maintain internal records, statistics, and business administration.
• To improve our services, website, and client experience.
• With your consent, to send you marketing communications about our services and promotions (you may opt out at any time).

We will not use your personal information for any purpose that is incompatible with the original reason for which it was collected, unless permitted by law or with your consent.

5. Legal basis for processing

We process personal information based on one or more of the following legal grounds:

• Your consent (for example, when you complete a consent form or opt in to marketing).
• The need to perform or conclude a contract with you (for example, to provide booked services).
• Our legitimate interests in operating and protecting our business, staff and clients, where these interests are not overridden by your rights.
• Compliance with legal obligations, including those under health and safety and POPIA.

6. Sharing your personal information

We do not sell your personal information. We may share it only when necessary with:

• Our staff and artists, who need the information to perform their duties and provide services to you.
• Third-party service providers who support our business (for example: booking systems, payment processors, website hosting, email providers), under appropriate confidentiality and data-protection obligations.
• Professional advisors (such as legal, accounting or insurance providers) where reasonably necessary.
• Law enforcement, regulators, courts or other third parties where required by law or to protect our rights, safety or property.

Where we transfer personal information across borders (for example, through cloud-based services hosted outside South Africa), we will take reasonable steps to ensure that the recipient is subject to laws, binding rules, or agreements that provide an adequate level of protection in line with POPIA.

7. How we protect your personal information

We take reasonable technical and organisational measures to protect personal information against loss, misuse, unauthorised access, alteration, or destruction.

These measures may include:

• Securing physical records (consent forms, files) in locked storage.
• Using password-protected systems and limiting access to staff on a need-to-know basis.
• Using reputable service providers for hosting and processing.
• Training staff on confidentiality and privacy obligations.

However, no system is completely secure. We cannot guarantee the absolute security of information transmitted over the internet and you provide information at your own risk.

8. Retention of personal information

We keep your personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by law or legitimate business needs (such as health and safety record-keeping and financial reporting).

When we no longer need your personal information, we will take reasonable steps to destroy or de-identify it in a secure manner.

9. Your rights under POPIA

Under POPIA, you have certain rights in relation to your personal information, including the right to:

• Ask what personal information we hold about you.
• Request access to your personal information.
• Request the correction, updating, or deletion of personal information that is inaccurate, out of date, excessive, or no longer required.
• Object, on reasonable grounds, to the processing of your personal information.
• Withdraw your consent where processing is based on consent (this will not affect processing that took place before withdrawal).
• Lodge a complaint with the Information Regulator if you believe your rights have been infringed.

To exercise your rights, please contact us at hexed.inkcollective@gmail.com or on +27 66 076 0880. We may need to verify your identity before responding to your request.

Information Regulator (South Africa) website: https://inforegulator.org.za.

10. Cookies and website tracking

Our website may use cookies or similar technologies to enhance your browsing experience, remember your preferences, and collect basic usage statistics.

You can usually choose to accept or decline cookies via your browser settings.

If you disable cookies, some website features may not function properly.

More detail about specific cookies used can be provided in a separate Cookies Notice if required.

11. Children and minors

Our services are not directed at children under 18 years of age, and we do not knowingly collect personal information from minors for tattoo or piercing procedures.

If you believe we have collected personal information from a minor without proper consent, please contact us so we can investigate and take appropriate steps.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.

The latest version will always be available on our website and will apply from the date it is posted. We encourage you to review this Policy periodically.