COMPREHENSIVE PRIVACY NOTICE

I. PERSONAL DATA SUBJECT TO PROCESSING

UTV may collect and process the following categories of personal data, only when necessary, appropriate, and relevant for the purposes informed.

1. Identification data

• Full name
• Age
• Date of birth
• Handwritten or electronic signature
• Type and copy of official identification
• Identification number
• Nationality
• Photographic image
• Voice
• Data of the person exercising parental authority or guardianship, when applicable

2. Contact data

• Phone number
• Email address
• Address
• Contact methods voluntarily provided by the data subject

3. Financial, tax, or asset-related data

• Information necessary for invoicing
• Federal Taxpayer Registry (RFC), when required for invoicing
• Tax status certificate, when applicable
• Proof of payment
• Data related to deposits, payments, refunds, or balances
• Information strictly necessary to fulfill tax obligations

UTV must not request or retain complete bank-card details when payment is processed directly by an external platform.

4. Sensitive personal data

In accordance with Article 2, Section VI of the Federal Law on the Protection of Personal Data Held by Private Parties, sensitive data is that whose improper use may affect the most intimate sphere of a person, give rise to discrimination, or imply a serious risk.

To responsibly evaluate and provide tattoo or body piercing services, UTV may collect only the reasonably necessary health data, including:

• General health status
• Relevant medical history for the procedure
• Chronic illnesses
• Allergies
• Allergies to pigments, metals, latex, adhesives, or disinfectant products
• Dermatological conditions
• Diabetes
• Blood or clotting disorders
• Current medications or medical treatments
• History of epileptic episodes
• Pregnancy or breastfeeding
• Pre-existing medical conditions related to the safety of the procedure
• Information included in health questionnaires and informed consents

UTV must not request medical information that does not have a reasonable relationship to the evaluation, safety, execution, or follow-up of the requested procedure.

The processing of sensitive personal data requires the express and written consent of the data subject, by handwritten signature, electronic signature, or another valid authentication mechanism.

Simply browsing the website does not imply consent for the processing of sensitive personal data.

II. HOW PERSONAL DATA IS COLLECTED

UTV may obtain personal data:

• Directly from the data subject at the studio
• Through contact or booking forms
• Through digital appointment calendars
• Via email communications
• Via WhatsApp or other channels voluntarily chosen by the data subject
• Through health questionnaires
• Through informed consents
• During the billing process
• Through photographs or videos authorized by the data subject

Data provided through external platforms will additionally be subject to the policies and conditions of those platforms.

UTV must not obtain data through deceptive, fraudulent, or means other than those informed to the data subject.

III. PRIMARY PURPOSES

Personal data will be used for the following purposes necessary to initiate, maintain, and fulfill the relationship between the data subject and UTV:

• Identify and register the client
• Verify the client's age and identity
• Verify, when applicable, the identity and representation of the parent or legal guardian
• Handle information or quote requests
• Manage appointments and reservations
• Identify the requested service
• Assign artist, piercer, or responsible personnel
• Assess the technical and health feasibility of the procedure
• Identify possible contraindications
• Prepare medical questionnaires and informed consents
• Perform tattoo or body piercing services
• Confirm design, size, placement, jewelry, date, and price
• Manage deposits, payments, balances, and receipts
• Issue invoices
• Provide post-procedure follow-up
• Provide aftercare instructions
• Address questions, clarifications, incidents, or complaints
• Maintain necessary records of each procedure
• Comply with health, tax, contractual, and legal obligations
• Respond to valid requests from competent authorities
• Protect the safety of clients, artists, collaborators, and the studio

These purposes are necessary to provide the requested service.

When the data subject does not provide data indispensable for safely evaluating or performing the procedure, UTV may decline to provide the service.

IV. SECONDARY AND OPTIONAL PURPOSES

Additionally, UTV may request authorization to use certain data for the following secondary purposes:

• Photograph or record the procedure
• Photograph or record the final result
• Create an artistic portfolio
• Publish photographs or videos on social media
• Publish work on the UTV website
• Create editorial or advertising content
• Promote brand-awareness campaigns
• Send event invitations
• Communicate launches, promotions, or availability
• Conduct commercial communication campaigns

These purposes are not essential to receive the main service.

The data subject's refusal to allow the promotional use of their image, voice, tattoo, piercing, photograph, or video may not be used as grounds to deny the service.

Image-use authorization must:

• Be presented separately
• Be optional
• Not be pre-selected
• Indicate the media in which it may be published
• Be revocable for future uses upon request to the official email

When technically possible, UTV will honor requests to withdraw future publications. Revocation will not have retroactive effects on materials that were legitimately disseminated before receiving the request.

V. SEPARATE CONSENTS

Digital or physical forms must not combine all authorizations into a single checkbox. Implement three independent controls:

1. Privacy Notice

"I have read and understood the Comprehensive Privacy Notice of Under The Vøid Tattoo Studio."

This checkbox may be required when the data subject provides data through a form.

2. Sensitive personal data

"I grant my express consent for the processing of sensitive health data that is strictly necessary to evaluate, perform, and follow up on the requested procedure."

This checkbox:

• Must be unchecked by default
• Must be used only when sensitive data is requested
• Must record the date, time, and evidence of consent
• Cannot be replaced by implied consent

3. Optional use of image

"I optionally authorize the use of photographs or videos of my procedure or result for portfolio, website, social media, and UTV communication."

This checkbox:

• Must be unchecked by default
• Must not be required to book or receive the service
• Must not be grouped with medical-data consent
• Must allow a clear refusal

Do not collect medical data through a public web form until confirming that:

• A secure connection exists
• Storage is restricted
• Access is controlled
• Express consent is recorded
• A retention and deletion procedure exists
• The provider used allows appropriate treatment of sensitive information

VI. TRANSFERS & TECHNOLOGY PROVIDERS

UTV does not sell, commercialize, or profit from its clients' personal data.

UTV may communicate or transfer information without additional consent only when a legal basis applies, including the scenarios provided in Article 36 of the Federal Law on the Protection of Personal Data Held by Private Parties.

This may include:

• Founded requests from competent authorities
• Health authorities
• Tax authorities
• Compliance with legal obligations
• Protection of the rights of the data subject or the controller
• Processors acting on behalf of UTV under confidentiality and security obligations

UTV may use technology providers to operate certain services, including:

• Appointment and calendar management
• Customer relationship management
• Hosting and website operation
• Technical storage and distribution of images
• Email
• Billing or accounting
• Client communication
• Analytics, only when installed and duly informed

Currently, the booking calendars use infrastructure associated with LeadConnector, HighLevel, or the domain links.multiplataforma.io.

Data entered directly into these calendars may be processed by the corresponding technology provider to manage the appointment.

UTV must limit the information requested in those calendars to what is necessary to book and administer the service.

Sensitive medical information must not be requested within the public calendar unless a suitable security, storage, and consent mechanism has been verified.

VII. EXTERNAL PLATFORMS

The UTV site may contain links to external platforms, including:

• Google Maps
• Instagram
• WhatsApp
• LeadConnector or HighLevel
• Calendar and booking services

When a user opens one of these links, they leave the environment directly controlled by UTV and access a platform with its own policies.

Using those platforms may imply that their operators receive technical information, such as:

• IP address
• Device type
• Browser
• Date and time of access
• Session data
• Information the user provides directly

UTV does not control the independent policies of Google, Meta, Instagram, WhatsApp, LeadConnector, HighLevel, or other external services.

External links must open through normal external navigation and must not be represented as if they were systems owned by UTV.

Do not claim that these platforms receive medical information unless such information is actually sent through them.

VIII. SECURITY MEASURES

UTV will implement reasonable administrative, technical, and physical measures to protect personal data against:

• Damage
• Loss
• Alteration
• Destruction
• Unauthorized access
• Unauthorized use
• Unauthorized disclosure
• Processing other than that informed

Measures may include:

• Restricted access to physical files
• Physical storage under safeguard
• Protected digital storage
• Passwords and access controls
• Role-based access limitation
• Internal confidentiality protocols
• Staff training
• Reduction of data requested
• Secure deletion when information is no longer needed
• Backup and recovery of information when applicable
• Updating tools and systems

Access to medical data must be limited to personnel who need to know it to evaluate, perform, or follow up on the procedure.

Sensitive information must not be used for advertising, commercial segmentation, or promotional profiling.

IX. RETENTION & DELETION

UTV will retain personal data only for the time necessary to fulfill:

• The informed purposes
• The contractual relationship
• Health obligations
• Tax obligations
• Legal responsibilities
• Applicable limitation periods

When data is no longer needed, it will be blocked and subsequently securely deleted or destroyed, unless a legal provision requires its retention.

Sensitive personal data must be retained for the minimum indispensable period.

Do not state a specific numerical retention period on the page without a verified internal policy to support it.

X. ARCO RIGHTS

The data subject has the right to exercise at any time their rights to:

• Access: know what data UTV holds and the conditions of its processing
• Rectification: request the correction of inaccurate, incomplete, or outdated data
• Cancellation: request that their data be blocked and subsequently deleted when appropriate
• Opposition: object to processing for legitimate reasons

To exercise any of these rights, a request must be sent to: media.utv.studio@gmail.com

The request must contain:

1. Full name of the data subject
2. Method to receive notifications
3. Documents proving identity
4. When applicable, documents proving legal representation
5. Clear description of the personal data related to the request
6. The ARCO right the data subject wishes to exercise
7. Description of what is being requested
8. Any document that facilitates locating or correcting the information

When rectification is requested, the required modifications must be indicated and supporting documentation provided.

UTV will communicate its decision within a maximum of twenty business days, counted from receipt of the request.

When the request is granted, UTV will make the right effective within the fifteen business days following communication of the response.

Deadlines may be extended once for an equal period when circumstances justify it and applicable law permits.

Exercising ARCO rights is free of charge, subject to reasonable reproduction or shipping costs when legally applicable.

XI. REVOCATION OF CONSENT

The data subject may revoke the consent granted for the processing of their personal data.

The request must be sent to: media.utv.studio@gmail.com

It must include:

• Name of the data subject
• Contact method
• Document proving identity
• Processing or authorization to be revoked
• Sufficient information to identify their data

Revocation will not have retroactive effects.

UTV will inform the data subject when a revocation cannot be executed immediately due to compliance with a legal, health, tax, contractual, or legal retention obligation.

Revocation of consent for secondary purposes will not affect the provision of the main service.

XII. LIMITATION OF USE OR DISCLOSURE

The data subject may request at any time:

• Not to receive promotional communications
• Not to receive event invitations
• Not to receive information about availability or launches
• Limitation of the use of their image
• Limitation of the disclosure of certain data

The request must be sent to: media.utv.studio@gmail.com

UTV must maintain an internal record of persons who have requested to stop receiving secondary communications.

XIII. COOKIES & TRACKING TECHNOLOGIES

The website may use cookies or similar technologies necessary for:

• Maintaining technical functionality
• Remembering essential preferences
• Preventing errors
• Improving security
• Loading external content
• Integrating booking calendars

1. Necessary

These are essential for the functioning of the site and its requested services.

2. Analytics

These allow us to understand in aggregate how the site is used.

3. Advertising or tracking

These allow measurement, commercial personalization, or cross-platform tracking.

When non-essential analytics or advertising cookies are used, implement a consent mechanism that allows:

• Accept
• Reject
• Configure preferences
• Change the decision later

Non-essential cookies must not be placed before obtaining the user's decision when legally and technically required.

Cookie preferences must not condition access to basic site content.

XIV. MINORS' INFORMATION

UTV will only process information about minors when:

• The procedure is permitted under applicable rules
• Written authorization from the parent or legal guardian exists
• The legal guardian is physically present when required
• The minor's identity is verified
• The responsible adult's identity and authority are verified
• The corresponding informed consent is obtained

UTV may request a copy of the parent or guardian's identification and the documentation necessary to verify the relationship or representation.

The minor's and the legal guardian's information will be used only for:

• Verifying identity and age
• Confirming authorization
• Evaluating the safety of the procedure
• Preparing consent documentation
• Fulfilling health and legal obligations

Do not use minors' data or images for promotional purposes without specific, separate, and unequivocal authorization from the legal guardian and, when applicable, the minor.

XV. USE OF IMAGE, PHOTOGRAPHY, VIDEO & VOICE

UTV may request authorization to capture and use:

• Photographs of the procedure
• Photographs of the result
• Video
• Voice
• Partial body image
• Portfolio material

The authorization must identify the intended purposes and media. It may include:

• Physical portfolio
• Website
• Instagram
• Other official social media
• Editorial material
• Advertising communication

The authorization will be optional.

UTV should seek to avoid publishing:

• Official identifications
• Contact information
• Medical information
• Signed forms
• Faces, when there is no specific authorization
• Elements that unnecessarily identify the data subject

Photography authorization does not imply authorization to disclose medical or contact data.

XVI. CHANGES TO THE PRIVACY NOTICE

UTV may modify or update this Privacy Notice to:

• Address legal reforms
• Incorporate new services
• Update internal processes
• Reflect new technology platforms
• Modify contact methods
• Improve security measures

The current version will be permanently available at:

/en/privacy

The last-updated date must appear at the beginning and end of the page.

When a change requires new consent, UTV must obtain it before applying the new corresponding processing.

XVII. CONSENT OF THE DATA SUBJECT

When the data subject voluntarily provides personal data after having had access to this Privacy Notice, UTV may process non-sensitive data in accordance with the informed purposes and the forms of consent permitted by applicable law.

For sensitive personal data, UTV must obtain express and written consent through:

• Handwritten signature
• Electronic signature
• Electronic checkbox accompanied by an authentication and evidence-retention mechanism
• Another valid mechanism that demonstrates the data subject's will

General acceptance of the Privacy Notice does not replace the signing of the specific informed consent for tattoo or body piercing.

XVIII. CONTACT