Back to the site

Privacy policy

Last updated:

This policy explains what personal information the site and the service collect, what it is used for, who holds it, how long it is kept and what your rights are, under the Israeli Protection of Privacy Law, 1981, as amended by Amendment 13, and its regulations.

Who is responsible for the information

The information is controlled by Eden Zohar, trading as “עדן זוהר קעקועים” (Eden Zohar Tattoos), registered in Israel as an exempt dealer (osek patur); the dealer number is given to clients before any deposit is paid. For privacy matters: call +972 54-485-3500, send a WhatsApp message to the same number, or email edentattoos1@gmail.com.

Eden tattoos at a station she rents in a studio in Rishon LeZion that she does not own. Client information reaches Eden only, and is not given to the studio’s owners or to anyone else.

What information is collected

  • Browsing the site: technical data such as IP address, browser and device type and the page viewed, for security, operation and anonymous statistics (see “Cookies, browser storage and analytics”).
  • The tattoo form: your name, and a description of the tattoo you want: the idea, style, placement, size and preferred timing. Your phone number is not asked for in the form; Eden sees it through WhatsApp when you send the message.
  • Correspondence: messages, calls and emails you send, including photos you attach (such as references or the body area).
  • Health declaration: before the tattoo, see below.
  • Photos: photos and video of the tattoo, only with your consent (see “Photos and publication”).

The booking form is not stored on the site

What you fill in on the tattoo booking form is not sent to or stored on the site’s server. Until you send it, the draft is kept only in your browser (sessionStorage), so your answers survive a trip to WhatsApp and back, and it is deleted when you close the tab.

Pressing “Send on WhatsApp” opens WhatsApp with a ready message. The text reaches WhatsApp (Meta) as soon as the link opens, as part of the link’s address, but it is sent to Eden only if you press send yourself. WhatsApp’s (Meta’s) privacy policy also applies to what reaches WhatsApp.

Health declaration: specially sensitive information

Before a tattoo, clients fill in a health declaration through a link Eden sends them personally. It asks for a full name, ID number, phone and date of birth; answers to a medical questionnaire about illnesses and medical conditions, allergies, regular medication, alcohol or drug use in the last day and pregnancy, with details where the answer is yes; acknowledgements that you read and understood the terms; the optional photo consents; and a signature, kept as an image. From 15 to 17 it also takes a parent’s full name, ID number and consent.

Medical information is “specially sensitive information” under the law. It is collected only to make sure the tattoo is safe for you and to record your consent to the treatment and the terms explained to you. It is not used for any other purpose.

Do you have to give this information

You are under no legal obligation to give the information. Without the booking details we cannot plan a tattoo with you, and without a full, signed health declaration we cannot tattoo you, because it is needed for your safety. Hiding medical information may put you at risk. Consent to photos is optional and never a condition of the service.

Who receives the information

The information reaches Eden Zohar only and is held by her only, and it is never sold or given to anyone for their own use. The site’s developer, who maintains it for Eden, can access the site’s systems for maintenance and security only, and does not use the information for anything else. Personal information is used only for the purposes in this policy.

For the site and its forms to work, these infrastructure providers store or transmit the information on Eden’s behalf only, and do not use it for their own purposes:

Information is given to anyone else only where the law, an authority or a court order requires it.

Transfer of information outside Israel

The providers above are international companies, and the information may be stored on or pass through servers outside Israel, subject to the providers’ commitments in their data processing agreements. The health declaration database is stored mainly on Cloudflare servers in Europe. The other providers may also process information in the United States and other countries. Google, which is not one of the infrastructure providers, may also process outside Israel the information it receives when the map at the bottom of the home page loads, under its own privacy policy.

Cookies, browser storage and analytics

The site uses no tracking, advertising or marketing cookies, and no social media pixels. The one exception: the map at the bottom of the home page is shown through Google Maps, and it loads only after you accept in the notice on the site or press “Show the map”. When it loads, Google receives your IP address and browser data and may set its own cookies under Google’s privacy policy (opens in a new tab). You can withdraw consent at any time with the button under the map; cookies already set are deleted through your browser settings. For statistics it uses two tools: Umami Analytics, which counts page visits, clicks on the contact buttons, how far visitors get in the booking form and which gallery piece they asked about (never the form’s contents); and Cloudflare Web Analytics, which counts visits and measures load speed. The data is aggregated and anonymous, collected without cookies or cross-site tracking, and does not identify anyone. Neither runs on the health declaration page. The bot check on that page (Cloudflare Turnstile) may store technical data in your browser for the check only. The booking form draft is kept only in your browser (sessionStorage), as described above, and your light or dark mode choice is kept in your browser (localStorage) for your next visit. Your choice about the map is kept there too, so we don’t ask again. Fonts, photos and videos are served from the site itself.

How long it is kept

  • Health declarations: up to 7 years from signing, or, for someone who signed as a minor, up to 7 years from their 18th birthday (the limitation period only starts then). After that they are deleted from the database automatically, by a job that runs every day, and Eden deletes the emailed copies from the mailbox herself. The storage provider’s automatic backup keeps deleted data for a short period of up to 30 days.
  • WhatsApp conversations and attached photos: as long as they are needed to plan the tattoo, support you while it heals and honour the touch-up guarantee.
  • Records the law requires (for example for tax): for the period the law sets.
  • Browsing data and statistics: technical data and statistics are kept by the providers that run them (Cloudflare and Umami), for their own retention periods. See their privacy policies under “Who receives the information”.
  • Your choice about the map: kept only in your browser (localStorage) and not sent to us. It stays until you withdraw consent with the button under the map or clear the site’s data in your browser. Information Google received when the map loaded is kept under its own policy.

Security

We take reasonable steps to protect information: the site is served only over an encrypted connection (HTTPS), health declarations are kept in a private database with no public address, and the declaration page has a send rate limit and a bot check. WhatsApp messages are end-to-end encrypted. Still, no online system is completely secure. If a serious security incident happens, we will act as the law requires, including reporting it to the Privacy Protection Authority.

No marketing messages

We send no marketing messages, advertising or mailings of any kind, and use your details for nothing but the service itself.

Photos and publication

Photos and videos of the tattoo are published on this site and Eden Zohar’s social media only with your consent, and without your face unless you separately and explicitly agree to your face being shown. For a minor, a parent gives the consent too. Consent is optional and never a condition of the service. If you appear in one and want it removed, get in touch and it will be taken down.

Security cameras at the studio

The studio has security cameras, operated by the studio.

Minors

The service is for clients aged 18 and over. From 15 to 17, tattooing is possible only with one parent present and consenting: the parent comes to the studio with their ID and the ID appendix (sefach) listing the minor, and signs a written consent, and the minor brings their own ID. There are no tattoos under 15.

The health declaration cannot be sent under 15. From 15 to 17 it is sent only with a parent’s name, ID number and consent, which are kept with the declaration on the same terms. The parent may exercise the rights below on the minor’s behalf.

Changes to this policy

If the site starts using other tools (such as marketing cookies or an advertising pixel), this policy will be updated first and your consent asked for where required. The date of the last update is at the top.

Your rights

Under section 13 of the Protection of Privacy Law you may review the information kept about you, and under section 14 you may ask for information that is wrong, incomplete, unclear or out of date to be corrected or deleted. You can also ask for your conversation and photos to be deleted. You can also ask for a health declaration to be deleted before the retention period ends, and each request is considered in accordance with the law. Information the law requires us to keep will not be deleted before that period ends.

For any request, call +972 54-485-3500, send a WhatsApp message, or email edentattoos1@gmail.com. To protect your information we may ask you to confirm your identity. We will reply within 30 days, and if we refuse a request we will explain why and how you can appeal. You can also contact the Privacy Protection Authority at the Ministry of Justice.