Photoboot (boot.small-victories.co and the Photoboot iOS app) is run by Small Victories BV, Mellestraat 303, 9090 Merelbeke-Melle, Belgium · enterprise number BE0793.301.929 · [email protected]. Questions, or want to use your rights? Mail us.
Who is responsible for what
- Photos taken at a booth belong to the event. The host who runs the booth decides to take and share them, and is the controller of those photos. Small Victories BV stores and shows them for the host, as its processor, under the data-processing terms in our terms.
- Hosts' own data (email address, event details, payments) and visits to our own pages: there Small Victories BV is the controller.
The booth: photos stay on the device unless shared
- The camera picture is processed in the browser or app on the booth device. Taking a photo or printing a sticker sends nothing to our server; the printer is reached over Bluetooth, straight from the device.
- The booth device can keep a colour copy of every photo in its own browser storage, so the host can download them later. That copy never leaves the device unless the host exports it. Settings, counters and the PIN live on the device too.
-
A photo reaches our server in two cases only:
- a guest taps Get photo to get it on their phone through a QR code;
- the booth is set up for an event with an online gallery: then every photo a guest keeps is uploaded to the event's gallery when they leave the photo screen. A photo the guest retakes is not uploaded.
Photos on our server
- We store the photo (a JPEG of the sticker layout in colour, without location or camera data) with a random id, the time it was taken, its size and the event it belongs to. Nothing else about the guest: no name, no face recognition, no location.
- Anyone with a photo's link can see it, so share links with care. The photo page has a Delete from the server button; that removes it for good, also from the event's gallery.
- Event photos can also be seen and downloaded by everyone who has the event's gallery link (the host, and whoever they share it with).
- Photo and gallery pages are private links: they are not listed anywhere, they tell search engines not to index them, and the photo files sit in private storage that only our server can read.
Hosts who buy an event gallery
- We keep the event name, the optional date and your email address, used to send you the setup link and the gallery link, and to answer you if you write to us. We don't send newsletters.
- When a booth joins an event, it stores the event's setup on our server (settings and any header or footer images you add) and reports counters (sessions, prints, shares, the busiest hour) under a random device id.
Payments
- On the web, Stripe handles the payment. You enter your card or other payment details with Stripe, not with us. We receive the payment's reference, amount, currency and your email address, and Stripe creates an invoice. See Stripe's privacy policy.
- In the iOS app, Apple handles the in-app purchase. Apple doesn't tell us who you are; we receive the signed transaction (its id, the product, price, currency, App Store country and date) and a random token that ties it to your event. See Apple's privacy policy.
Why we may use this data
- Photos of guests: we process them for the host, on the host's instructions (running the service as described here). The host needs their own legal ground, usually their legitimate interest in photos of their party, and must tell their guests; we give them a booth notice to print.
- Your email address and event details: to deliver the gallery you ordered (performance of a contract).
- Payment records: the contract, and our legal duty to keep accounting records.
- Booth counters: our legitimate interest in showing the host how their booth was used and keeping the service working. They hold nothing about guests.
- Google Analytics: only with your consent, which you can withdraw at any time.
How long we keep it
- Photos: deleted automatically 30 days after they were taken, or for an event with a paid gallery one year after (or the period agreed for that event). If an event's payment is refunded, its photos fall back to the 30 days.
- Events (name, date, email address, setup, counters): deleted with all their photos when the host deletes the event, or automatically once its photos have expired and another 30 days have passed. An event that was never paid is deleted after 30 days.
- Payment records are kept apart from the photos and events, for as long as Belgian accounting law requires (until the end of the seventh year after the payment), then deleted.
- Backups: the server is backed up every night, encrypted. Something deleted disappears from the backups within 30 days.
Who processes data for us
- Oracle Cloud Infrastructure (Amsterdam region, the Netherlands) runs the server, the database and the private storage for photos.
- Hetzner (EU) keeps our encrypted backups.
- Cloudflare sits in front of the site, like most websites, and sees your IP address and the requests you make, to deliver and protect the site. The site only works over HTTPS.
- Brevo (France) sends the email with your event links.
- Stripe and Apple handle payments, as above.
- Google runs Google Analytics and Google Tag Manager, only if you accept (below).
Outside the EU. Our server, database, photos and backups are stored in the EU. Cloudflare, Stripe, Apple and Google are (part of) American companies, and Oracle's support staff may reach the server from outside the EU, so some data can be handled in the United States or elsewhere. Those transfers are covered by the EU–US Data Privacy Framework, which these companies have joined, and by the European Commission's standard contractual clauses.
Cookies and analytics
- Only the event sign-up page and the privacy and terms pages use Google Analytics, loaded through Google Tag Manager, to count visits. The booth, the settings, and the guests' photo and gallery pages never load it.
- Nothing is tracked until you accept. A banner asks first. Until you click Accept, Google Analytics is told consent is denied and sets no cookies; Reject keeps it that way. Advertising cookies stay off, whatever you choose.
-
If you accept, Google Analytics records the pages you visit, where you came from, your approximate region
and your device and browser type, using the cookies
_gaand_ga_…. See how Google uses data from sites like this one. - Your choice is remembered in your browser (local storage). Changed your mind? Click and choose again; rejecting removes the Google Analytics cookies.
- Other browser storage is only functional: the sign-up form is kept for the browser session while you pay, so a cancelled payment doesn't lose it.
Your rights
Under the GDPR you can ask to see, correct or delete your data, object to its use, or take it with you. Mail [email protected]; we answer within a month. You can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be).
Guests: a photo of you
- Delete it yourself: open the photo's link (its QR code, or the event's gallery) and tap Delete from the server.
- Or ask the host of the event, or mail us the link of the photo (or the event's name and date). We remove it from our server within a few days and let the host know, since the photos are theirs; if the host has a good reason to keep it, we tell you. The booth device's own copy is the host's: ask them to delete it.
Hosts and their guests
A host who runs a booth at their event decides to take and share their guests' photos, and must tell their guests. Print the booth notice and put it next to the booth. Delete a photo when someone asks, and take extra care with photos of children.