Privacy

1. Controller

Sinkply Tattoo · Staffelstrasse 8, 8045 Zürich, Switzerland
Contact: WhatsApp and phone +41 77 212 07 67 · Instagram @sinkply.zurich

This notice follows the Swiss Federal Act on Data Protection (FADP/DSG) and, for visitors from the EU, the EU General Data Protection Regulation (GDPR).

2. Data collection

We process personal data when you actively contact us (WhatsApp, Instagram, phone, email, contact form). We use it solely to handle your enquiry and arrange an appointment.

When you use the contact form, we store your first name, your WhatsApp number or email address, your short description, the page you write from and the time of your consent in our booking system (Supabase, servers in Frankfurt, Germany) in order to contact you about your enquiry. Retention as in section 6.

In addition, technical data is processed when you visit this website (IP address, browser and device type, pages visited, source of the visit). Section 4 explains how and why.

3. Third-party services

When contacting us via WhatsApp, Meta Platforms' privacy policies apply. The same goes for Instagram. To arrange appointments we store your phone number, your WhatsApp name, the appointment details and a short description of your tattoo request in our booking system (provider Supabase Inc., USA; servers in Frankfurt, Germany; data processing agreement). Reference images you send us are stored in our Google Drive to prepare your appointment. Other message content stays in WhatsApp or Instagram.

4. Cookies, analytics and advertising tools

This website uses strictly necessary cookies and – only with your consent – analytics and advertising cookies. On your first visit you will see a notice with an "Accept" and a "Reject" button. Your choice is stored in your browser under the key sinkply_ch_consent_v1.

Until you consent, no analytics or advertising cookies are set, no identifiers are shared with third parties for analytics or advertising (except the ad code described below) and no sessions are recorded. What remains is aggregated traffic measurement with no way of recognising you. Legal basis for consent: Art. 6 FADP and Art. 6(1)(a) GDPR.

PostHog – behaviour analytics and session recording

• Purpose: we record in aggregate which pages are visited and, once you consent, we record your session (mouse movements, clicks, scrolling, the path you take through the site) and build heatmaps. This shows us where visitors get stuck so we can fix it.
• What is not recorded: your camera, your microphone and anything you do outside this website. Password fields are always masked. The rest of the page content shown on screen may be included in the recording: that is why we keep it for a maximum of 30 days and access stays limited to the studio.
• Provider and role: PostHog, Inc., acting as a processor on our behalf (Art. 9 FADP / Art. 28 GDPR), under the data processing agreement PostHog incorporates into its terms of service.
• Where the data is hosted: in PostHog's European cloud, on servers in Frankfurt am Main, Germany. For this tool there is no transfer to the United States. Germany is on the Swiss Federal Council's list of countries with adequate data protection (Annex 1 DPO).
• Retention: session recordings for a maximum of 30 days, then deleted automatically. Aggregated usage data for as long as the tool is in use, reviewed at least annually.
• More: PostHog privacy policy · data processing agreement · sub-processors.

Google Analytics 4, Google Tag Manager and Google Ads

• Purpose: Google Tag Manager loads the other tags. Google Analytics 4 measures site traffic (page views, source, device). Google Ads measures which ads lead to an enquiry and enables relevant advertising.
• Provider: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) and Google LLC.
• International transfer: processing may involve transfers to the United States. Google relies on the European Commission's Standard Contractual Clauses and on the alternative transfer mechanisms it publishes, including its certification under the EU-U.S. Data Privacy Framework; the Swiss-U.S. Data Privacy Framework applies for Switzerland.
• Retention: user and event data in Google Analytics 4 for a maximum of 14 months; Google advertising cookies according to the periods Google publishes.
• If you reject, no Google tag is loaded — neither Tag Manager, nor Analytics, nor Ads. Nothing from your visit is sent to Google.
• More: Google privacy policy · how Google uses information from sites that use its services · Google Ads data processing terms.

Google ad origin

If you reach our website through a Google ad, we store Google's click identifier (gclid) together with a short code (e.g. "Ref: AB12CD") in your browser and in our database. The code appears at the end of the pre-filled WhatsApp message; you can delete it before sending. This shows us which ads lead to enquiries and appointments. If you reject cookies, we delete the code in your browser and the click identifier in our database. Only if you have accepted cookies do we report back to Google that the click led to an enquiry or appointment – and we only send the click identifier and the time, never your phone number, name or message content. We delete the link between click and phone number after 120 days at the latest. Purpose: measuring the success of our advertising (legitimate interest, Art. 6 and 31 FADP).

Meta Pixel (Facebook and Instagram)

• Purpose: measuring which Facebook and Instagram ads lead to an enquiry, and building similar audiences.
• Provider: Meta Platforms Ireland Limited (Merrion Road, Dublin 4, Ireland). The pixel only loads after you consent; before that it is entirely inactive.
• International transfer: possible transfers to the United States, based on the Standard Contractual Clauses and Meta's certification under the EU-U.S. and Swiss-U.S. Data Privacy Frameworks.
• More: Meta privacy policy · cookies policy · Meta business tools terms.

5. Withdrawing consent

You can withdraw your consent at any time. Clear this site's data in your browser (in Chrome: Settings → Privacy and security → Cookies and other site data → See all site data and permissions → sinkply.ch → Delete). The notice will appear again on your next visit and you can choose afresh. You can also reach us on WhatsApp or Instagram. Withdrawal does not affect the lawfulness of processing carried out beforehand.

6. Retention

We keep each category of data only as long as needed for its purpose: appointment enquiries and contact details for the duration of the business relationship and thereafter for as long as statutory retention rules require; enquiries that do not lead to an appointment for up to 2 years after the last contact; PostHog session recordings for a maximum of 30 days; Google Analytics 4 user and event data for a maximum of 14 months; Google ad click identifiers for 90 days, and their link to a phone number for 120 days at most.

7. Hosting

Hosted on Vercel Inc. (USA) servers. Vercel processes connection data as part of providing the website. The transfer is based on the Standard Contractual Clauses.

8. Your rights

You have the right to information, correction, deletion, restriction of processing and data portability, and to withdraw your consent. Contact us on WhatsApp or by phone at +41 77 212 07 67, or on Instagram @sinkply.zurich. You may also complain to the Swiss Federal Data Protection and Information Commissioner (edoeb.admin.ch); visitors from the EU may contact their own supervisory authority.

9. Changes

We may update this notice when our website or the services we use change. The version published on this page is the one that applies.
Last updated: October 2026.