Welcome to NAAMA’s Privacy Notice

We respect your privacy and are committed to protecting your personal data.

This Privacy Notice explains how NAAMA ("we", "us", or "our") look after your personal data when you visit the NAAMA website (“Website”), or one of our studios, and tells you about your privacy rights and how the law protects you. It also describes your data protection rights, including a right to object to some of the processing which NAAMA carries out. By agreeing to NAAMA's terms and conditions, you are agreeing to this Privacy Policy and consenting to the processing of your personal information as explained herein. More information about your rights, and how to exercise them, is set out in the following.

Last updated: July 2024

INTRODUCTION

• Important Information About NAAMA

• The Data We Collect About You

• Why We Use Your Personal Data

• Marketing

• Sharing Your Personal Data

• International Transfers

• Retaining Your Personal Data

• Your Legal Rights

• Other Important Information

• Contact Details

• Klarna

1. IMPORTANT INFORMATION ABOUT NAAMA

1.1 PURPOSE OF THIS PRIVACY NOTICE

The Privacy Notice applies to you if you are a NAAMA client, but it also applies if you are simply visiting our Website, interacting with us on social media, writing us an email, subscribing to our newsletter, or participating in one of our events.

We also may provide you with additional information when we collect personal data, where we feel it would be helpful to provide relevant and timely information.

2. THE DATA WE COLLECT ABOUT YOU

When you visit our Website or studio, or otherwise interact with us, NAAMA may collect, use, store and transfer different kinds of personal data about you. The types of personal data we collect from you are listed below, and depend on the type of relationship you have with us. If you are interested in how we use the various types of personal data, please see Why We Use Your Personal Data at Section 3.

• Identity Data: such as your first name, last name, username or similar identifier, title, date of birth, and gender.

• Contact Data: this includes your billing address, email address, and telephone number.

• Demographic Information: Age, gender, and other relevant information.

• Financial Data: such as your payment card or bank account information. If you apply for financing through a third-party lender and get approved, we are notified. However, we do not receive other details related to your application, except your name, email, billing, and mailing address, the approved financing amount and reference numbers.

• Marketing Data: such as preferences in receiving marketing from us and our third parties.

• Profile Data: including details of any appointments you attend, purchases you make, and any queries, comments, or complaints you send us in relation to our business relationship.

• Social Media Data: including details of your social media accounts, in instances where you follow or interact with us on social media, or use your social media accounts to create an account on our website.

• Audio and Visual Information including before and/or after photos, customer service call recordings.

• Medical and Health Data: Health history, treatment details, and other relevant medical data including allergies, medications you take, whether you are pregnant, skin conditions, and other medical conditions or health concerns. Given the medical nature of tattoo removal, we may also need to collect medical information or doctors' notes related to your procedures.

• Racial and Ethnicity Data: we require information regarding your skin type and ethnicity, which may include photographs of your tattoo(s) or other parts of your body.

• Website Analytics Data: such as information about how you use our Website, links you click on and pages you visit, time zone, browsing behaviour and device type.

• NAAMA uses Google Analytics: you can read the Google Analytics Privacy Policy here.

• Technical Data: internet protocol (IP) address, login data, browser type and version.

We collect most of this information from you directly. For example, data is collected from forms completed by you on our Website or at our studios; obtained from your passport or other identity documents; from correspondence with you; or through interviews, meetings or interactions with us on social media. We also collect some information about you from other people or organisations: we collect information from your doctor or other medical teams if necessary before we carry out any tattoo removal procedure, as well as from publicly available sources, such as search engines.

3. WHY WE USE YOUR PERSONAL DATA

We collect, use and store your personal data for the reasons set out below.

Where the processing is necessary for us to enter into or administer a contract with you:

• providing tattoo removal services

• registering you as a new or potential client and contacting you about the services and procedures that you have requested from us

Where necessary for NAAMA’s legitimate interests, as listed below, and where our interests are not overridden by your data protection rights:

• as required to manage our business, including: to deliver high levels of client care and ensure that we provide quality services; and developing our brand and marketing strategy

• growing our professional network of tattoo artists, dermatologists and other professionals who may like to receive referrals from us

• management of our IT systems and infrastructure, including improving and running our Website. We aim to ensure that content from our Website is presented in the most effective manner for you and for your computer or mobile device

• sending you relevant stories or promotional information about our services where you have not previously opted out of receiving this information. For more information on our marketing activities, please see Marketing at Section 4 below

• improving our services when you provide feedback for audit purposes protecting our legitimate business interests and legal rights, including use in connection with legal claims, compliance, regulatory, auditing and investigative purposes (including disclosure of such information in connection with legal process or litigation) and other ethics and compliance reporting requirements

Where we process personal data on this basis, then – as required by data protection law – we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals’ interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test using the contact details at Section 10.

Where necessary to comply with all legal obligations, such as:

• tax law and similar obligations

• health and safety obligations

• responding to court orders, subpoenas or other legal processes with which NAAMA is required to comply

• complying with legal, regulatory and other requirements under EU or Member State laws

With your consent:

• we collect pictures of your tattoo for use when you enquire about our services

• we use your pictures for sharing on our Website alongside your personal data on social when you interact with third-party social networking features to serve you with advertisements and engage with you on third-party social networks

• we collect feedback when you complete surveys where you have opted in to receive these electronically

• we collect health data from your doctor if necessary before we carry out tattoo removal procedures

• using your personal data where it cannot be anonymised to conduct medical research on how to improve our medical devices and lasers, or to study how tattoo removal can improve body image or wellbeing

We may provide you with more specific notices for some of the processing described above and, if we require your consent, we will ask for this at the time we collect your personal data.

4. MARKETING

We provide you with an opportunity to express your preferences with respect to receiving marketing communications from us, and for us to share your personal data with trusted partners for their direct marketing purposes. If you wish to update these preferences, you can submit a request by contacting us using the contact details in Section 10. To opt out of receiving our email marketing communications, you can also follow the 'unsubscribe' instructions provided in any messages you receive from us.

5. SHARING YOUR PERSONAL DATA

We will only share personal data where doing so is permitted under data protection law. If this is the case, we may share your personal data with the following parties:

• Service providers including, our appointment management system, CRM providers, marketing providers and payment and financing processors. Third parties that process personal data on our behalf are required by contract to implement safeguards that are no less protective than those implemented by us in order to protect any personal data they receive from us. Third-party service providers are further prohibited from using the personal data for any purpose other than to perform the services as instructed by NAAMA. In certain cases, service providers will be directly accountable to you for how they use your personal information. They may be legally required to give you additional details about the personal information they hold about you, including how and why they process it. You might receive this information in a separate notice or obtain it directly from the service providers, such as through their websites.

• Group companies, including our parent company and affiliates

• Professional advisers including our lawyers, bankers, auditors and insurers

• Regulators and Government Agencies, including HMRC, regulators and other authorities

• Members of our corporate group

• In the event that NAAMA is sold or integrated with another business, your details may be disclosed to our advisers and any prospective purchaser's advisers and will be passed to the new owners of the business

6. INTERNATIONAL TRANSFERS

NAAMA operates around the world. Therefore, we may share your personal data with our employees or other partners outside of the European Economic Area (“EEA”), but only when doing so is necessary for the purposes mentioned in this Privacy Notice. In the event that personal data is otherwise transferred outside of the UK or the EEA to an organisation in a country that is not subject to an adequacy decision by the EU Commission or considered adequate as determined by applicable data protection laws, we will take steps to ensure your personal information is adequately protected (e.g. by way EU Commission approved Standard Contractual Clauses, an appropriate Privacy Shield certification, a vendor's Processor Binding Corporate Rules or by relying on such other data transfer mechanisms as available under applicable data protection laws). A copy of the relevant mechanism can be obtained for your review on request by using the contact details below.

7. RETAINING YOUR PERSONAL DATA

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. Generally, your personal data will be kept for 6 years after your tattoo removal procedure or otherwise from your last interaction with us. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe that we may need to enforce our legal rights (for example, a lawsuit against us).

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

Please contact us if you have any questions regarding data retention.

8. YOUR LEGAL RIGHTS

You have the right to ask NAAMA for a copy of your personal data; to correct or delete your personal data; restrict the processing of your personal data; and to obtain the personal data you provide in a structured, machine-readable format. In addition, you can object to the processing of your personal data in some circumstances (in particular, where we do not have to process the data to meet a contractual or other legal requirement). Where we have asked for your consent, you may withdraw consent at any time. If you ask us to withdraw your consent to us processing your data, this will not affect any processing that has already taken place at that time.

These rights may be limited, for example if fulfilling your request would reveal personal data about another person, if you ask us to delete information that we are required by law or have compelling legitimate interests to keep. If you have unresolved concerns, you have the right to complain to a data protection authority. In the UK, this will be the Information Commissioner.

9. OTHER IMPORTANT INFORMATION

9.1 THIRD-PARTY LINKS

Our Website includes links to other websites and applications, including links to social media. Clicking on those links may allow third parties to collect or share data about you. NAAMA does not control these third-party websites, and we are not responsible for their privacy statements. We encourage you to visit the privacy statements for every website you visit.

9.2 CHANGES TO THE PRIVACY NOTICE

We keep our Privacy Notice under regular review. Any changes we make to this Privacy Notice in the future will be uploaded to the Website. We will provide you with a new privacy notice when we make any substantial changes. We may also notify you in other ways from time to time about the processing of your personal data.

10. CONTACT DETAILS

NAAMA has appointed a Data Protection Officer (DPO) and may be reached:

• by using the following email: paul.cohen@naamastudios.com

• by mail at the following address: 109 Great Portland St, Marylebone, W1W 6QG

NAAMA Studios Limited is the data controller of your personal data. You may contact NAAMA by emailing hello@naamastudios.com

11. KLARNA

In order to be able to offer you Klarna’s payment options, we will pass to Klarna certain aspects of your personal information, such as contact and order details, in order for Klarna to assess whether you qualify for their payment options and to tailor the payment options for you.

General information on Klarna can be found here. Your personal data is handled in accordance with applicable data protection law and in accordance with the information in Klarna’s privacy policy.

Cookie Policy

We use cookies to remember your preferences and optimise your experience of using the NAAMA Website.

HOW WE USE COOKIES

Cookies are very small text files that are stored on your equipment when you visit some websites. They can be used to identify that you have previously visited a site or to store small bits of information locally with you. We use cookies to remember your preferences and to make the NAAMA Website easier for you to use.

You can remove any cookies already stored on your computer, but if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our website.

You can manage your cookie settings at any time by clicking the cookie icon in the bottom left of the browser window.

We use the following cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of our website. They may include, for example, cookies that enable you to log into secure areas of our website, use a shopping cart or make use of e-billing services.

• Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.

• Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).

• Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.

Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies.