Privacy · GDPR · Transparency
Privacy policy
How LUX Artscio collects, uses, protects and deletes personal information
and how you can exercise your rights.
Collection
Only what's needed
Contact, service, payment and voluntary information used to deliver services and maintain records.
Control
Your GDPR rights
Request access, correction, erasure, restriction, portability or objection by email.
Automation
No profiling
LUX Artscio does not use automated decision-making or profiling.
LUX Artscio is a strong advocate for data rights and does not feed it into an AI.
Your data is your property and have specific rights at all times, which you can always enforce.
Data controller
Who is responsible
LUX Artscio determines why and how personal information is processed.
Name
Mie Valkyria Andersen
Founder and data controller
Role
LUX Artscio is not required to appoint an external Data Protection Officer.
Privacy questions can be submitted directly to the data controller.
Version of Privacy Policy v.3.1.1.4
Updated: 11. Oct. 2026
Data collected
What is handled
Information is limited to what is relevant for communication, service delivery, system access, payments and legal records.
Common categories
Email address, first name, artist name and phone number when provided.
Voluntary details needed for portal access, custom systems or coaching.
Service details, special agreements and payment information.
Payment details processed and encrypted by payment providers such as Stripe and Revolut for subscription clients.
Tattoo and ink records where retention is required for safety and regulatory purposes.
Relevant allergy information supplied before tattooing, handled separately as health information.
Where applicable: photographs, testimonials, loyalty/refferal records, website technical information and marketing preferences as explained below.
Data minimisation: LUX Artscio states that it collects only the information required to communicate, deliver a service, process payment or meet a legal obligation.
Required & optional details
Your choices
Enough details is needed to identify and contact you, arrange your appointment or service, and meet relevant accounting and tattoo-record obligations.
Required fields are identified at the point of collection.
Without information necessary to arrange or perform the service, it may not be possible to accept or complete the booking. Before tattooing, relevant allergies are needed to be discussed to assess whether the planned materials and procedure are suitable.
The allergy section explains this separately.
Newsletter registration and permission to publish content or testimonials are separate choices. Declining these optional uses does not affect your tattoo booking.
Your consent matters: By consenting to publish content regarding your tattoo is helping the artist's reputation, but you do have the rights to include that you do not wish to be identifiable in the content such as showing your face.
Allergies & tattoo preparation
Health information
Before tattooing, you'll be asked about allergies relevant to the products and materials used during your appointment, such as tattoo ink, gloves, skin-preparation products, dressings or adhesives.
The information is used to plan the appointment, assess the suitability of materials and decide whether the planned service can proceed.
Your full medical history is not needed.
Allergy information is health information and receives additional protecting.
This draft proposes processing the limited allergy information on the basis of your explicit consent under GDPR Articles 6(1)(a) and 9(2)(a), requested separately before it is recorded. This is separate from your consent to receive a tattoo, marketing, consent and photograph permissions.
Access is limited to the people who need the information to prepare or carry out your appointment, and the contracted providers used to store it securely. It is not used for marketing, audience targeting, portfolio publication or AI prompts.
You can withdraw your consent by contacting valkyria@luxartscio.com. Withdrawal does not affect the lawfulness of processing before withdrawal. Processing based on that consent will stop. If LUX.A.Ink cannot establish that the planned tattoo can proceed responsibly without the information, a discussion about whether an alternative is possible or whether the appointment must be postponed or declined.
Allergy notes are kept separately from mandatory ink and accounting records and only for the period needed for the appointment preparation and the agreed follow-up. The applicable period is stated in the retention section.
Purpose & lawful basis
Why data is used
Consent
Information voluntarily supplied for services, newsletters or requested access.
Contract
Information necessary to fulfill bookings, coaching, subscriptions and system access.
Accounting, tattoo documentation and other records required by applicable law.
Legal obligation
Legitimate interest
Data may be used for scheduling, project management, payment processing, service delivery, products, coaching programs and business communication.
Processing activities
Day-to-day processing
Different activities have different purposes, legal bases and retention periods.
Potential customers & enquiries
Email enquiries may involve name, email and phone number. The stated basis is legitimate interest under GDPR Article 6(1)(f). Communication is deleted when it is clear whether the person wants the service, unless a longer period is required in a special case.
Customers & service delivery
Customer records may include name, service, special agreements, payment information and related communication. The stated basis is performance of a contract under GDPR Article 6(1)(b). Data is deleted when the service and outstanding matters are complete, subject to legal retention duties.
Records are deleted according to the category-specific retention schedule, with statutory and justified claims-related exceptions handled separately.
Newsletter
The newsletter is voluntary and requires active consent. It may contain company updates, website content, service announcements and industry news. Subscribers can unsubscribe a any time.
If no newsletter has been sent for one year, consent expires through inactivity.
Previous consent may be retained for two years after last use in line with the limitation period referenced in the spam guide according to 'Ombudsmanden'.
Registration uses a confirmation email: you enter your email address and confirm the subscription before promotional messages begin. Consent is separate from booking and other choices. Every marketing email includes an unsubscribe option.
Accounting & tattoo records
Invoices and supporting documents may contain name and service description.
Accounting records are retained for at least 5 years after the end of the relevant financial year.
The same five-year practice is used for ink information.
At the end of the period, the policy states that the customer receives the ink information so LUX Artscio can delete the retained record safely.
Job applications
LUX Artscio does not accept job applications. Unsolicited applications are deleted.
Processors & technology
External services
The information is only shared with the relevant services with providers supporting operations, design, communications and payments. Some process data on LUX Artscio's instructions; other determine purposes of their own processing. Their privacy notices explain processing for which they are independently responsible.
Where a provider acts as processor, the processing must be covered by an applicable data-processing agreement and authorised sub-processing arrangements. A provider's privacy notice alone does not replace that agreement.
Information may be disclosed where legally required or necessary for a justified legal claim.
Notion
Workspace records, service delivery and client/project organisation. Processor for personal data uploaded as customer content; a separate controller for certain account / services information.
Google Workspace
Business email, calendar and associated collaboration. In Google's core-service processing is governed by its DPA; additional services and service / account data needed separate consideration.
Stripe
Payments and transaction administration where Stripe is used. Stripe can act as a processor or an independent controller, depending on the activity, including its regulatory and fraud-prevention purposes.
Revolut
Banking, system, refunds or payouts where used. Revolut acts as a controller for relevant banking / account and regulatory processing; some business customer-data activities may be performed on the business's behalf. It's precise role depends on the product and contract.
Figma
Collaborative designs and prototypes, including contributor details and comments.
Meta
Communication and publication where used. Meta is a controller for its platform processing, page insights and advertising / business tools can involve different or joint-controller agreements.
WIX
Website hosting and operation, contact and subscription forms, and newsletter management where enabled. Relevant information may include contact details, form submissions, subscription preferences and technical website data.
International transfers
Providers are generally used in the EU/EAA or store data there. Where data must be handled outside the EU/EAA, providers must offer adequate protection, including mechanisms such as standard contractual clauses.
The policy states that personal data is not passed to third parties for their own purposes and that processors are contractually required to protect it.
Security & incident response
Protection
Password policies
Account access is protected through documented password practices and MFA.
Encrypted backups
Regular encrypted backups support resilience and recovery.
Device security
Technical controls protect the devices used to access client information.
Ongoing training
GDPR awareness, courses and procedure reviews support the security level of the business.
Cold storage
Retention related information is stored in an encrypted cold storage as extra layer of protection.
Vulnerability tests
Frequent exercises vulnerability tests to enforce potential security gaps.
Incident response: If personal data is affected by a breach, LUX Artscio will inform impacted people promptly, advice them on the next steps and report the incident to Datatilsynet where required.
Retention & deletion
How long data stays
LUX Artscio determines why and how personal information is processed.
During the service
Client information is available to LUX Artscio as needed to deliver the agreed work.
The general policy states that client data may be stored up for a year, after which it is moved to an encrypted cold storage until the retention period is over.
If information is needed for research and or case presentation, the client will be asked for consent and the information will be anonymised.
Up to a year
Accounting documents and ink information may be retained for at least five years in the line with stated legal and safety obligations.
Five year where required
When a purpose and applicable retention period end, personal data is deleted or anonymised if needed for further research.
Deletion or anonymisation
Record category
Retention rule / confirmation needed
Until the enquiry is resolved; Enquiries are only kept for up to a year.
Enquiries
For delivery, handover and necessary follow-up; kept for up to a year with information. After a year, anonymisation will take effect.
Service and consulting records
Until the tattoo project(s) and necessary follow-up are complete; the information will be transferred to cold storage with an ID number, which is generated by the clients booking location. This information will be deleted after 5 years due to the data shows clients can return to the tattoo artist with a few years in between. Therefore it is held as long as the information of the tattoo ink used.
Allergy information
Normally five years from the end of the financial year to which the records relate, subject to applicable exceptions.
Accounting records
Five years under the tattoo establishments's statutory obligation; LUX Artscio keeps the connection of the ink record and client for up to 5 years.
Mandatory ink traceability
While subscribed; on withdrawal, stop marketing. The existing policy's two-year evidence rule and one-year activity rule must be confirmed against current guidance and actual system behaviour. Keep minimal suppression data only as justified to prevent unwanted re-enrolments.
Newsletter and consent evidence
For the approved use while permission is valid.
Photographs and testimonials
While administering the benefit and resolving relevant claims; same retention period as ink traceability.
Loyalty and referral records
When the purpose and applicable retention period ends, the record is deleted or genuinely anonymised.
Removing a name alone does not necessarily anonymise a record. If records are needed for a specific legal obligation or claim, only the relevant information is retained and access is restricted.
Website & cookies
Online use
When you use the website, technical information such as IP address, browser/device information, access time and requested pages may be processed by the hosting or security provider to deliver and protect the site. The applicable data categories, recipients, lawful basis and retention are described in the completed website-processing schedule.
Cookies and similar technologies are described by their actual purposes, providers and lifetimes.
Where consent is required, non-essential technologies remain inactive until you choose to enable them.
You can decline optional technologies and withdraw consent as easily as you have it.
Photographs & testimonials
Optional publicity
If asked to being photographed with the tattoo as the focus or use an identifiable testimonial, the purpose will be explained before collecting or publishing it.
Internal project documentation and public portfolio use are treated separately.
When publication relies on consent, you choose the material and the approved channels separately from your tattoo booking. You can say no without losing access to the service.
Consent for a website portfolio does not automatically cover social-media publication, paid advertising or unrelated future uses.
You can withdraw publication consent by email.
Future use based on that consent stops and material within LUX Artscio's possession is removed where required.
Public platforms or other people may have copied published material; LUX Artscio cannot guarantee removal of every independent copy, but this does not remove the obligation.
LUX Artscio will fight for your rights to get your published material removed if needed.
Loyalty & referrals
If you practice
If you join a loyalty or referral programme, LUX Artscio process the information needed to check eligibility, administer earned benefits, record balances and expiry, and arrange relevant payments. This may include your name, contact details, qualifying transaction references and the link between a referral and its reward.
Administration of an agreed programme is separate from email-marketing consent.
Marketing preferences are recorded separately.
Referral information is limited to what is needed to administer the benefit; health information, tattoo details and unnecessary payment information are not disclosed to the referrer.
AI workflows
If data is involved
AI tools used only with non-personal or genuinely anonymised material do not require your personal information.
Allergy information and connection is excluded from AI prompts, agents and general creative / project tools under the proposed allergy workflow. AI-assisted drafting does not, by itself, mean that a legally significant decision is made solely by an automated system.
Other sources
Referrals & studio cooperation
If a studio, referrer or business client supplies personal information about you, I explain the source, categories of information, purpose, legal basis, recipients and retention when when providing the relevant privacy notice.
When required by GDPR Article 14, that information is provided within a reasonable period and no later than one month after receipt, or earlier at the first communication with you or first disclosure to another recipient, as applicable.
Receiving a referral does not automatically authorise marketing emails.
Your rights
GDPR
Contact LUX Artscio to exercise these rights.
Requests are handled directly rather than through a self-service portal.
Access
See the information processed about you and receive related details.
Rectification
Correct inaccurate or incomplete personal information.
Erasure
Request deletion in circumstances recognised by GDPR.
Restriction
Limit processing in qualifying circumstances.
Objection
Object to certain lawful processing and direct marketing.
Portability
Receive eligible data in a structured, commonly used, machine-readable format.
Withdraw consent
Withdraw consent wherever processing depends on consent.
No automated decisions
Remain free from solely automated decisions or profiling; neither is used.
Complaints
You may lodge a compliant with the Danish Data Protection Authority if you are dissatisfied with how your personal data is being handled.