At XS Tatouage et Perçage Inc. (“XS Tattoo & Piercing,” “we,” “our,” or “us”), your privacy is important to us. This Privacy Policy explains how we collect, use, protect, and share personal information when you visit xstattoos.com, use our online booking platform at book.xstattoos.com, book or manage an appointment, contact us, submit an inquiry, or use our services at any XS location in Quebec or Ontario. This policy covers both websites and the related booking and customer communication services.

Information We Collect

We may collect personal information that you provide to us, including:

• Name
• Email address
• Phone number
• Appointment location
• Selected service
• Preferred staff member, if selected
• Appointment date and time
• Notes, messages, or special requests you submit
• Rent-a-spot inquiry details, if applicable
• Portfolio or professional information you choose to provide for rent-a-spot inquiries
• Your optional SMS consent choice and related records, such as consent date, collection method, and policy or disclosure version
• Appointment communications and delivery or response records
• For employees and authorized studio users: work contact information, assigned location, scheduling and access permissions, account identifiers, and relevant activity logs

We do not collect payment card information through our website or online booking app. Payments, if applicable, are handled separately at the studio or by the payment service identified to you at the time of payment.

We may also collect technical information needed for security, functionality, and analytics, such as IP address, browser and device information, website interactions, error and access logs, pages visited, and cookie identifiers where applicable.

How We Use Your Information

We use personal information to:

• Book, confirm, manage, reschedule, or cancel appointments
• Send appointment confirmations, reminders, and appointment updates
• Respond to customer questions or inquiries
• Process rent-a-spot applications or inquiries
• Provide customer service
• Improve our website, booking system, services, and customer experience
• Send promotional emails or updates only with your consent or where otherwise permitted by applicable anti-spam laws
• Manage staff accounts, schedules, permissions, and authorized access to the booking system
• Record and honour customer communication preferences and SMS opt-out requests
• Maintain business records and protect the security of our systems

SMS / Text Messaging

Email Communications

We may send appointment-related emails, such as confirmations, reminders, updates, cancellations, and rescheduling information.

We may also send promotional emails, news, offers, or updates about our services with your consent or another lawful basis permitted by Canada’s anti-spam legislation. Simply providing an email address for an appointment does not automatically subscribe you to marketing. Promotional emails include an unsubscribe method, and you may also contact us to opt out.

Sharing of Information

We do not sell, rent, or trade your personal information.

We may provide limited personal information to service providers who perform functions for us, such as website and cloud hosting, booking database operations, transactional email delivery, SMS message transmission, security, and analytics. Access is limited to what is needed to deliver those services and subject to applicable privacy safeguards and contractual protections. Authorized XS personnel may access appointment or staff information according to their work duties. These arrangements do not permit any transfer or sale of text messaging opt-in consent for marketing or promotional purposes.

We may also disclose information if required by law, to protect our rights, to prevent fraud or abuse, or to protect the safety of our customers, staff, or business.

Processing Outside Quebec

Some service providers that support our websites, booking platform, or communications may process or store information outside Quebec, including elsewhere in Canada or in other countries. Privacy laws in those locations may differ. We take applicable legal requirements into account when selecting providers and arranging cross-border processing, including appropriate assessments and safeguards where required. Contact us for information about applicable processing arrangements.

Cookies and Analytics

Our website may use cookies and similar technologies to improve your browsing experience, remember preferences, analyze website traffic, and understand how visitors use our website.

We may use Google Analytics to collect general website usage information, such as pages visited, device type, browser type, and general interaction data. This helps us improve our website and services.

You can restrict cookies through your browser settings; some features may then stop functioning. Where a non-essential technology requires consent, we seek that consent through the relevant website or application interface. You can contact us with questions about the tools used.

Data Security

We use administrative, technical, and organizational safeguards appropriate to the information involved. These may include access controls, employee permissions, authentication, logging, and protection of service-provider integrations. Only personnel who need information for an authorized purpose should have access to it. No online system is completely secure. If a privacy incident occurs, we will assess and handle it, including any notices required by law.

Data Retention

We keep personal information only as long as reasonably necessary for appointment management, customer service, staff administration, security, business records, legal compliance, and dispute resolution. Retention periods depend on the type of information and applicable requirements. When no longer required, information is securely deleted or otherwise handled in accordance with applicable law and our retention procedures. You may ask us about the retention period applicable to your information.

Minors

Some tattoo and piercing services require parent or guardian consent, depending on the customer’s age, the service, applicable law, and studio policies. In Quebec, where parental or guardian consent is required for collecting personal information from a child under 14, that consent must be provided before submitting the information, unless a legal exception applies. A parent or guardian may contact us about information relating to a minor.

Third-Party Links

Our website may contain links to third-party websites or services. These third-party websites are governed by their own privacy policies. We are not responsible for the content, privacy practices, or activities of third-party websites.

Your Choices

Subject to applicable law and exceptions, you may request access to or correction of the personal information we hold about you, ask questions about its collection or use, withdraw consent where applicable, or request deletion when permitted. Where applicable under Quebec law, you may also request a copy of certain computerized personal information in a commonly used structured format, or request that information be transferred as provided by law.

You may unsubscribe from promotional emails by using the unsubscribe link included in those emails.

You may opt out of SMS messages by replying STOP.

You may send a privacy concern or complaint to our Privacy Officer using the contact information below. We may need to verify your identity before acting on a request. If you are dissatisfied with our response, you may also contact the relevant privacy regulator, including the Commission d’accès à l’information du Québec where applicable.

Contact Us

For access requests, corrections, privacy concerns or complaints, and questions about this policy, contact our person responsible for the protection of personal information:

Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in our practices, systems, or legal requirements. The updated version will appear on this page with its last-updated date. Where required, we will provide additional notice or obtain new consent.