Privacy policy

English translation of our German privacy policy (Datenschutzerklärung). If the two versions differ, the German version prevails.

Privacy Policy

Online shop and tattoo and piercing studio of Atelier Hannibal GmbH

Document 03 · Version: 11 November 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is Atelier Hannibal GmbH, Kaulardstraße 21, 50354 Hürth, HRB 113522, Local Court of Cologne (Amtsgericht Köln).

For all questions about data protection and for exercising your rights, you can reach us at datenschutz@atelierhannibal.de.

2. Scope and overview

This privacy policy applies to the website and the online shop at atelierhannibal.de and to the consultation and the forwarding of enquiries by the studio. Part A describes the processing in the online shop, Part B the processing in connection with the studio services.

The Artists working in the studio are self-employed entrepreneurs and independent controllers for their own processing. The studio and the Artist are separate controllers; in this respect, there is no joint controllership within the meaning of Art. 26 GDPR.

Part A: Online shop

A.1 Shopify platform

The shop is operated on the Shopify platform (Shopify International Ltd., Ireland). Shopify hosts the website, processes order, account and usage data on our behalf and provides the shop functions. For certain cross-platform functions, Shopify is itself the controller; details and the rights you have in relation to Shopify can be found in Shopify’s privacy policy (privacy.shopify.com). When the website is accessed, Shopify processes technically necessary connection data (IP address, date and time, page accessed, browser and device information) in order to deliver the website and ensure its security. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in the secure and stable operation of the website.

A.2 Order, account and payment data

When you make a purchase in the shop, we process contact, delivery and billing data, order and transaction data and, where applicable, account data. The purpose is the performance of the purchase contract, payment, shipping, the handling of returns and customer service. The legal basis is Art. 6(1)(b) GDPR. Card payments, Apple Pay, Google Pay and Shop Pay are processed by Shopify Payments (Shopify International Ltd., Ireland), and payments with PayPal by PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg. The payment data are transmitted directly to the respective payment service provider, which processes them as an independent controller, including for fraud prevention and to comply with legal obligations. We do not receive full card details. If you withdraw from a purchase via our online withdrawal function, we process your name, the information identifying the contract and your email address in order to process the withdrawal and send you an acknowledgement of receipt (Art. 6(1)(c) GDPR).

A.3 Printing and shipping (Picanova, Printful)

We have wall art (canvas, framed canvas, aluminium dibond, acrylic glass) printed by Picanova GmbH, Cologne, via its merchOne application and shipped directly to you. For this purpose, we transmit your name, your delivery address, the items ordered and, where necessary for delivery and shipment notification, your telephone number and your email address. Picanova processes these data on our behalf (Art. 28 GDPR) and passes the delivery data on to the carrier, for example DHL, GLS or UPS, which uses them as an independent controller for delivery. The legal basis is Art. 6(1)(b) GDPR.

Some of our products are manufactured and shipped by print on demand via our fulfilment service provider Printful. To carry out your order, we transmit the order and shipping data required for this purpose, in particular name, delivery address and items ordered, to Printful, which manufactures the product and ships it directly to you.

Printful also processes data outside the EU. The legal basis for the processing is Art. 6(1)(b) GDPR (performance of your order); the safeguards set out in Section 4 apply to the transfer to a third country.

A.4 Reach measurement and advertising

On our website we use the Meta Pixel of Meta Platforms Ireland Ltd. This allows us to measure the effectiveness of our advertising, record conversions and show you interest-based advertising on Meta’s platforms. In the process, usage, device and event data are transmitted to Meta. The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) of the German Telecommunications Digital Services Data Protection Act (TDDDG), which you give via our cookie banner and can withdraw at any time via the cookie settings. We and Meta are joint controllers for the collection and transmission via Meta’s Business Tools; the agreement is available at facebook.com/legal/controller_addendum. Under that agreement, Meta is responsible for fulfilling your rights with regard to the data processed by Meta after transmission. B.9 applies to the landing pages of individual Artists.

The Meta Pixel is integrated into our shop via Meta’s sales channel. With your consent to marketing cookies, we also transmit, where available, your email address, telephone number, name and address as a hash value for better matching (advanced matching). Events such as a completed enquiry or a purchase may additionally be transmitted server side via Meta’s Conversions API, likewise only with your consent to marketing cookies. The data transmitted are the type and time of the event, an event identifier, IP address and browser information, Meta’s browser and click identifiers, and your email address and telephone number as a hash value; we do not transmit the content of your enquiry, health information or the Artist you have chosen.

In addition, we use Google services integrated via the Google tag (gtag.js): Google Analytics to analyse website usage and Google Ads conversion tracking to measure the success of and deliver our advertising. In the process, usage, device and event data are processed and transmitted to Google (Google Ireland Ltd. or Google LLC, USA). The legal basis is your consent pursuant to Art. 6(1)(a) GDPR in conjunction with Section 25(1) TDDDG, which you give via the cookie banner and can withdraw at any time.

If you submit the contact form, we transmit your email address, telephone number and name as a hash value to Google, with your consent to marketing cookies, in order to be able to attribute the enquiry to an advertisement (enhanced conversions).

A.5 Cookies and similar technologies

The website uses technically necessary cookies and, with your consent, analytics and marketing cookies and similar technologies. Our cookie banner informs you about the type, purpose and provider of the cookies used and about giving and withdrawing your consent. The legal basis for non-essential cookies is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG).

A.6 Social media profiles

We maintain profiles on Instagram, Facebook, TikTok and YouTube. For the page insights on Instagram and Facebook, we are joint controllers with Meta Platforms Ireland Ltd. (Art. 26 GDPR); the agreement is available at facebook.com/legal/terms/page_controller_addendum. Otherwise, the platform operators are independently responsible. The legal basis for our processing is Art. 6(1)(f) GDPR (communication and reach analysis).

Part B: Tattoo and piercing studio

B.1 Contact and enquiry data

We process your name, contact details and information about the desired design. Purpose: consultation, introducing suitable self-employed Artists and forwarding your enquiry to the Artist you have chosen. Legal basis: Art. 6(1)(b) GDPR (contract and pre-contractual measures).

Enquiries via the website’s contact form reach us by email. We transfer them to our CRM and store a copy in our email inbox. With your enquiry, we store the campaign or page through which you came to us (campaign parameters and landing page) in order to measure the success of our advertising; the legal basis is Art. 6(1)(f) GDPR. We do not store Google and Meta click identifiers in our CRM; they are only set in your browser and transmitted to Google and Meta with your consent to marketing cookies (A.4). If you book an initial consultation, we record the appointment with name, contact details and time in the studio’s calendar. Video consultations generally take place as a video call via WhatsApp (B.5), alternatively via Google Meet; they are not recorded. For the processing by Meta and Google and the transfer to the USA, see Sections 4 and 7.

We document the initial consultation in a consultation record. It records the project details and your confirmation that you have been informed about the self-employed status of the Artist performing the work, that your contractual partner for the tattoo or piercing is exclusively the chosen Artist and that you have taken note of the studio’s General Terms and Conditions. We store the record as an independent controller as evidence of our consultation and information services. The legal basis is Art. 6(1)(f) GDPR, our legitimate interest in providing evidence, including towards authorities, and in legal defence.

B.1a Feedback on the initial consultation to Google and Meta

If you have given separate consent in the consultation record, we transmit, after your initial consultation, your email address and telephone number as a hash value together with the event “initial consultation” and its date to Google (enhanced conversions for leads) and Meta (Conversions API). Google and Meta match the hash values with their user accounts so that we learn which ads have led to consultations and can align our advertising accordingly. We do not transmit details of the project, the chosen Artist or health information. The legal basis is your consent (Art. 6(1)(a) GDPR). It is voluntary; the consultation takes place regardless of it. You can withdraw your consent at any time with effect for the future, for example by sending a message to datenschutz@atelierhannibal.de; events already transmitted remain unaffected. A.4 applies to the roles of Meta and Google, and Section 4 to the transfer to the USA. We keep the proof of consent together with the consultation record. This transmission does not take place for enquiries via the landing pages of individual Artists (B.9).

B.2 Website chatbot

The chatbot serves to provide style advice, pre-qualification and forwarding to an Artist. The legal basis for conducting the conversation is Art. 6(1)(b) GDPR, pre-contractual measures at your request. The chatbot is an AI-based system (see Section 8). If you have consented to marketing cookies, we report an enquiry made via the chatbot to Meta as an event (A.4); we do not transmit chat content or health information.

At the start of the conversation, we inform you about the processing and ask for your confirmation. If you do not wish to use the chatbot, you can equally reach us via the contact form, by email, by telephone or via WhatsApp. Your enquiry will not be treated any differently as a result.

Your input is transmitted to our service provider Anthropic in the USA to generate the responses. The transfer is based on the Standard Contractual Clauses of the EU Commission pursuant to Art. 46(2)(c) GDPR, which form part of our data processing agreement with Anthropic. For details, see Section 4.

For quality assurance, we evaluate chat histories internally in order to identify system errors and improve the responses. The evaluation is carried out by us; for technical analysis, we use the same service provider that also operates the chatbot (Anthropic, Section 3). For this purpose, chat histories are stored for a maximum of 30 days and then deleted. They are not passed on to Artists. The legal basis is our legitimate interest in an error-free and secure service (Art. 6(1)(f) GDPR).

Before the evaluation, we remove or shorten information that is not required for the error analysis, in particular health information.

B.3 Health data (medical history)

A medical history, that is allergies, medication, pre-existing conditions and current state of health, is taken exclusively by the Artist performing the work before the appointment; the Artist processes and keeps these health data as an independent controller. The studio does not collect health data and does not ask for them.

If you voluntarily tell us about health matters in the chat or in the initial consultation, we process them only on the basis of your explicit consent (Art. 9(2)(a) GDPR), which we obtain in the chat at the start of the conversation and in the initial consultation in the consultation form. We do not evaluate such information, do not use it further, remove it before any evaluations (B.2) and delete it without undue delay, no later than 30 days after it was communicated; in the chat, deletion takes place together with the chat history. If you voluntarily provide such information in the contact form, we likewise do not evaluate it or use it further; to this end, we shorten the free text of your enquiry after 30 days and delete form enquiries in our email inboxes 30 days after receipt. We do not store information about the medical history taken by the Artist.

B.4 Payment, gift cards and financing

You pay the Artist directly for the Artist’s service; the studio does not process any payment data in this regard. If you redeem a gift card of Atelier Hannibal GmbH or of the Erftstadt location with an Artist in Hürth or Euskirchen, we process the gift card code, the amount redeemed, the date of redemption and the redeeming Artist in order to deduct the amount from the gift card and pay it to the Artist. If a gift card of the Erftstadt location is redeemed with us or a gift card of Atelier Hannibal GmbH is redeemed at the Erftstadt location, we exchange this information with the operator of the Erftstadt location for settlement purposes (B.10). We do not record your name or details of the work in this process. The legal basis is Art. 6(1)(b) and (c) GDPR; we retain the records in accordance with the statutory periods (Section 5).

If the Artist offers you financing or payment in instalments, this is concluded directly between you and the Artist or the provider engaged by the Artist. The studio is not involved and does not transmit any data to financing providers.

B.5 WhatsApp communication

Communication for processing your enquiry until it is forwarded to the Artist takes place primarily via WhatsApp; providing a telephone number is required for this. Following the initial consultation, we send you general information on preparation and aftercare. The legal basis is Art. 6(1)(b) GDPR. You then arrange appointments directly with the Artist. If you do not wish to communicate via WhatsApp or WhatsApp is not available, we communicate by email. For the data processed by Meta, see Section 7.

B.6 Marketing

With separate consent, we inform you about promotions and offers via WhatsApp broadcast or email and ask you for a review after your appointment. For the review request, we record, if communicated to us, exclusively the date of your appointment with the Artist. We delete this date after sending the review request, no later than 30 days after the appointment; without consent to the review request, we do not record it. Legal basis: Art. 6(1)(a) GDPR; you can withdraw your consent at any time.

B.7 Photographs and video recordings

We use recordings of the result for portfolio and reference purposes exclusively on the basis of separate, written consent. This consent specifies the purposes and recipients individually and can be withdrawn at any time with effect for the future. Legal basis: Art. 6(1)(a) GDPR, Section 22 of the German Art Copyright Act (KUG).

If an Artist provides us with recordings of their own work, the Artist is obliged towards us to hold consent from the person depicted that expressly covers publication by us. If you wish to end a publication, a message to datenschutz@atelierhannibal.de is sufficient; we will then remove the recording without undue delay.

B.8 Disclosure to the Artist performing the work

For the performance of the work, the enquiry is handed over to the self-employed Artist you have chosen. Before accepting, the Artist receives only a brief description of the project without your contact details; if the Artist declines, the Artist deletes any data received without undue delay. The data are transmitted to the Artist as an independent controller on the basis of Art. 6(1)(b) GDPR, since you wish the enquiry to be forwarded to the Artist you have chosen. Depending on the agreement, Artists remunerate us for the provision of a pre-qualified enquiry with a fee that is based on objective project characteristics or is uniform, or on a flat-rate basis with the usage fee; this has no influence on the price of your tattoo or piercing. The studio’s customer data remain with the studio. In our CRM, we note which Artist you have chosen and whether the Artist has accepted your enquiry; we pseudonymise this assignment 30 days after the handover (Section 5); we do not store the Artist’s cost estimates, prices or further appointment details. The customer’s contractual partner is exclusively the Artist.

B.9 Advertising campaigns for Artists (ad service)

For individual Artists, we operate Artist-specific landing pages and online advertising campaigns as an agency. We process enquiries received via these landing pages on behalf of the respective Artist as the Artist’s processor (Art. 28 GDPR); the controller is the Artist named with name and address on the respective landing page. The persons making enquiries are customers of the Artist. On these landing pages, with your consent, we use the Meta Pixel and the Google tag on behalf of the Artist to measure campaign success; the usage, device and event data transmitted correspond to A.4. The controller is the Artist, and for the collection and transmission to Meta jointly with Meta (A.4 applies accordingly). If you have consented to marketing cookies, we also transmit, on behalf of the Artist on these landing pages, the contact details available to us (email address, telephone number, name and, for example from a customer account in the shop, address) as a hash value to Meta and Google (advanced matching, enhanced conversions, Meta’s Conversions API); we do not transmit the content of your enquiry or health information. Insofar as we also use these event data for our own advertising, we are the controller in that respect (A.4).

B.10 Forwarding to the Erftstadt location

If you would like a consultation or an appointment at the Erftstadt location, we forward your enquiry, that is name, contact details and information about the desired design, to the operator of this location: Atelier Hannibal Erftstadt (Major.ttts), owner Mario Krampf, Franz-Busbach-Straße 3a, 50374 Erftstadt-Lechenich. The operator is a self-employed franchisee and is independently responsible for the subsequent processing of your data. The legal basis for the forwarding is Art. 6(1)(b) GDPR.

B.11 Appointment management on behalf of Artists

If an Artist expressly instructs us to manage their appointments, we manage your appointments and send appointment confirmations and reminders in the name of the Artist as the Artist’s processor (Art. 28 GDPR); the controller is the Artist. We delete appointment data no later than 30 days after the respective appointment. Without such an instruction, we do not store any appointments with the Artist.

B.12 Replies to reviews

We reply publicly to reviews that you publish on the Google Business Profiles of our studios. For this purpose, we process your name as displayed there, your star rating and your text. We prepare draft replies with the support of an AI service (Anthropic, processor, transfer to the USA in accordance with Section 4). We publish replies to positive reviews automatically according to fixed rules; we check all others before publication. The legal basis is our legitimate interest in responding to feedback from our customers (Art. 6(1)(f) GDPR). We store reviews and our replies for follow-up purposes for a maximum of twelve months; the review itself is managed by Google. For the profile of the Erftstadt location, we act on behalf of its operator.

3. Recipients and processors

To provide the shop and the studio services, we use the following service providers and recipients. Insofar as they act on our behalf, data processing agreements are in place. For the Meta Pixel and the advertising services, Meta and Google are responsible jointly with us or independently (A.4), and on Artists’ landing pages jointly with the respective Artist or independently (B.9). We use the Google account (Gmail, Calendar, Google Meet), through which enquiries via the contact form are received and the studio’s consultation appointments are managed, under Google’s general terms of use; to that extent, Google also processes the data as an independent controller.

• Shopify: shop platform and hosting

• Shopify Payments and PayPal: payment processing (independent controllers)

• Picanova: printing and shipping of wall art (processing on our behalf)

• Printful: print on demand and shipping

• Carriers: delivery (independent controllers)

• Meta Platforms: Meta Pixel and WhatsApp Business Platform

• 360dialog: technical connection to the WhatsApp Business Platform

• Pipedrive: customer relationship management, EU data centre

• Hetzner: server hosting and data backup, data centres in Germany or within the European Union

• IONOS: email inbox, data centre in Germany

• Google: email inbox for incoming enquiries (Gmail), calendar and video conferencing (Google Meet) for the studio’s consultation appointments, analytics and advertising services and map service

• Anthropic: processing of chatbot input via the application programming interface and preparation of draft replies to reviews (B.12)

• sevDesk: invoicing

In addition, we operate a self-hosted automation environment on our own server; it does not constitute a third party.

4. Transfers to third countries

Individual service providers process data outside the EU or the EEA, in particular in the USA, for example Meta, Google, Printful and Anthropic and, where applicable, Shopify and individual payment service providers.

The transfer takes place on the basis of appropriate safeguards pursuant to Art. 46 GDPR, in particular the Standard Contractual Clauses of the EU Commission, or on the basis of an adequacy decision pursuant to Art. 45 GDPR, insofar as the respective provider is certified under the EU-US Data Privacy Framework. The transfer to Anthropic is governed by the Standard Contractual Clauses, which form part of our data processing agreement. Insofar as processing is additionally based on your consent, for example for cookies and reach measurement, you can withdraw this consent at any time with effect for the future.

We point out that third countries may not have a level of data protection fully comparable to European law and that, in particular, access by government authorities and limited legal remedies cannot be ruled out.

5. Storage period and deletion

Personal data are deleted as soon as the respective purpose no longer applies and no statutory retention obligations prevent deletion. The retention periods under commercial and tax law apply to order and invoice data; we retain invoices and accounting records for eight years from the end of the calendar year (Section 147(3) of the German Fiscal Code, Section 257(4) of the German Commercial Code, Section 14b of the German VAT Act). We retain consultation records for four years from the end of the calendar year in which the consultation took place; if an official audit is pending at that time, until it has been completed. We delete enquiries that are not handed over to an Artist, as well as contact details after the handover, including message histories via WhatsApp and email and the entries in the consultation calendar, twelve months after the last contact; we delete form enquiries in our email inboxes 30 days after receipt. Chat histories are deleted after a maximum of 30 days (B.2). We do not store the hash values generated for the feedback under B.1a beyond the transmission. We store reviews and our replies to them (B.12) for a maximum of twelve months. We retain the record of a withdrawal made via our online withdrawal function (name, email address, order number, content of the declaration and date and time of receipt) for three years from the end of the year of receipt in order to be able to prove timely receipt (Art. 6(1)(f) GDPR); we retain records of a refund as accounting records for eight years. When the cooperation with an Artist ends, the studio’s customer data remain with the studio; any access rights of the Artist, for example to an Artist portal, are terminated. We pseudonymise the assignment of your enquiry to an Artist 30 days after the handover; thereafter, it is no longer possible to trace to which Artist your enquiry was forwarded. Invoices to Artists for enquiries provided do not contain customer names. We store consents to advertising messages (B.6) and to the review request until they are withdrawn, and the proof of consent for three years thereafter. A customer account in the shop exists until it is deleted. Where service providers keep deleted records in a recycle bin function, for example our CRM, they are permanently removed there no later than 30 days after deletion; data with a deletion period of 30 days or less are permanently deleted by us immediately. Backups of our server are overwritten after seven days; encrypted backup copies in our backup storage are deleted after ten weeks at the latest.

6. Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection, as well as the right to withdraw consent given at any time with effect for the future. The lawfulness of the processing carried out until the withdrawal remains unaffected. To exercise these rights, a message to datenschutz@atelierhannibal.de is sufficient. Providing your name, contact details and project details is required for consultation and forwarding; without them, we cannot process your enquiry. There is no statutory obligation to provide them. In the shop, the information marked as mandatory fields is required for the order.

Right to object pursuant to Art. 21 GDPR: Insofar as we process your data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims. You may object to processing for direct marketing purposes at any time without giving reasons.

7. Note on WhatsApp and Meta

When communicating via WhatsApp, technical connection and usage data are processed by Meta Platforms, including outside the EU (see Section 4). Health data are not transmitted via WhatsApp. If WhatsApp is not available, we use email.

8. Use of AI (transparency notice)

The website chatbot is an AI-based system. You are informed at the start that you are communicating with an automated system. The chatbot provides exclusively non-binding guidance; the binding price is set solely by the Artist. No automated decision with legal effect within the meaning of Art. 22 GDPR takes place.

9. Children and minors

The online shop is not directed at minors. We process enquiries about tattoos and piercings from the age of 16; enquiries about piercings for younger persons only if the persons with parental responsibility make the enquiry. For minors, the written consent of all persons with parental responsibility on the form provided for this purpose is required, which must be available before an appointment deposit is paid; the identity documents are inspected on site by the Artist performing the work and are neither copied nor stored. Further details are set out in § A7 of our General Terms and Conditions.

10. Data security

We take technical and organisational measures pursuant to Art. 32 GDPR. These include in particular:

• encryption of all connections to our website and our systems in accordance with the state of the art (TLS); the certificates are renewed automatically

• server operation exclusively in data centres within the European Union

• access to our systems exclusively via personal accounts with two-factor authentication; administrative server access exclusively via cryptographic key procedures, password login is deactivated

• assignment of permissions according to the principle of least privilege and logging of administrative access

• daily backups separated from the production system

• prompt installation of security updates and automated blocking after repeated failed login attempts

• obligation of all persons with access rights to maintain confidentiality

Transmission over the internet can nevertheless never be absolutely secure; please provide health information exclusively to the Artist performing the work on the Artist’s form and not via messenger services.

11. Changes to this privacy policy

We adapt this privacy policy as necessary. The version published on the website at the relevant time applies.

12. Contact and supervisory authority

If you have questions or wish to exercise your rights, you can reach us at datenschutz@atelierhannibal.de or by post at Atelier Hannibal GmbH, Kaulardstraße 21, 50354 Hürth.

You also have the right to lodge a complaint with a data protection supervisory authority; the authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2-4, 40213 Düsseldorf, poststelle@ldi.nrw.de.

Atelier Hannibal GmbH · Kaulardstraße 21, 50354 Hürth · HRB 113522, Local Court of Cologne (Amtsgericht Köln)