Privacy Policy

Click Photobooth Ltd, trading as Click Photo Booth, respects the privacy of our clients, event guests, website visitors, business contacts and other individuals whose personal information we process.

This Privacy Policy explains what personal information we collect, why we use it, the lawful bases we rely on, who information may be shared with, how long we retain it, how event photographs and other media are handled, and the rights available to individuals under UK data protection law.

This policy applies to personal information processed through our website, enquiry and booking forms, correspondence, photo booth services, online event galleries, digital sharing services, corporate activations, event reporting, marketing activities and related business operations.

It should be read alongside our Terms of Service, Booking Agreement and any event-specific proposal, agreement, privacy notice or data-processing terms that apply to a particular booking.

1. Who we are

The data controller is:

Click Photobooth Ltd Trading as Click Photo Booth Company number: 15377262 Registered in England and Wales Registered office: 15 Birch Avenue, Auckley, Doncaster, England, DN9 3LT

Privacy and general enquiries: info@clickphotobooth.co.uk Telephone: 07538 362489

For most of the personal information described in this policy, Click Photobooth Ltd determines why and how that information is processed and therefore acts as the data controller.

There are some corporate, school, charity or other organised events where the event organiser determines what guest information should be collected, why it should be collected and how it will be used. In those circumstances, the organiser may be the data controller and Click Photobooth Ltd may process the information on the organiser’s instructions as a data processor.

Where appropriate, those roles will be confirmed in the event proposal, contract, data-processing agreement or event-specific privacy information.

Where Click Photobooth Ltd and another organisation jointly determine the purposes and means of processing, the relevant responsibilities will be considered and documented where required by law.

2. Personal information we may collect

The information we collect depends on how you interact with us.

Enquiries, quotes and bookings

When you enquire about or book our services, we may collect:

• your name;
• email address;
• telephone number;
• billing information;
• event date;
• event type;
• venue name and location;
• venue postcode;
• estimated guest numbers;
• preferred operating times;
• package and add-on selections;
• backdrop and booth customisation choices;
• template and Tap-to-Start selections;
• access, parking or setup information;
• correspondence between you and Click Photo Booth;
• information contained in proposals, contracts or booking agreements; and
• any other information you voluntarily provide that is relevant to the booking.

Submitting an enquiry does not subscribe you to marketing communications.

Payment and transaction information

Where you make a payment to us, we may process information such as:

• payment amount;
• payment date;
• payment reference;
• payer name;
• invoice information;
• transaction status; and
• information made available to us through our bank or payment provider.

We do not need to retain complete card details where payment processing is handled by a separate regulated payment provider.

Event photographs and media

When a person chooses to use our photo booth, we may process:

• photographs;
• GIFs;
• Boomerangs;
• short videos or video guestbook recordings;
• digital templates and branded versions of captures;
• capture date and time;
• event information associated with the capture; and
• technical information required to create, store or deliver the media.

Where a person can be identified from a photograph or recording, that media may constitute personal information.

Digital sharing information

Where a guest chooses to receive a capture digitally, we may process:

• email address;
• telephone number;
• selected sharing method;
• sharing activity;
• delivery status; and
• information necessary to deliver the requested photograph, GIF, Boomerang or video.

Depending on the event configuration, sharing may be available through email, text message, QR code, AirDrop or another supported method.

An email address or telephone number entered solely to receive a photo will not automatically be treated as consent to receive marketing.

Corporate activations, surveys and event reporting

Certain corporate packages can be configured to collect additional information.

Depending on the approved event brief, this may include:

• email address;
• telephone number;
• survey responses;
• feedback;
• marketing preferences;
• competition or campaign information;
• company or professional information;
• event-specific responses; and
• engagement and sharing statistics.

The information collected, purpose of collection, mandatory and optional fields, lawful basis, intended recipients and retention requirements should be agreed with the corporate client before the event.

We will not treat participation in a photo booth session, provision of contact information for photo delivery, or completion of an unrelated survey question as automatic consent to future marketing.

Where marketing consent is requested, it must be presented separately and meet the applicable legal requirements.

Website and technical information

When you use our website we may automatically receive technical information such as:

• IP address;
• browser type;
• device type;
• operating system;
• pages visited;
• approximate interaction information;
• referral source;
• security information;
• server logs; and
• cookie or consent preferences.

Analytics, advertising and similar non-essential technologies are used only where permitted by applicable law and, where consent is required, after the appropriate choice has been made.

Business and venue contacts

We may process professional contact information relating to venues, suppliers, event planners, corporate prospects and other organisations, including:

• name;
• job title;
• business email address;
• business telephone number;
• company or venue;
• professional correspondence; and
• publicly available business information.

This information may be obtained directly from the individual, from their organisation or from legitimate public business sources such as company websites, professional directories or business social-media pages.

Information you need to provide

Certain personal information is necessary for us to respond to an enquiry, prepare a proposal, enter into a booking agreement or provide the booked service. For example, we may require a contact name, email address, event date, venue information and information necessary to administer payment.

If information required to enter into or perform a contract is not provided, we may be unable to provide a quotation, accept the booking or deliver the relevant part of the service.

Providing information for optional activities such as digital photo sharing, surveys or marketing is voluntary unless the particular event clearly states otherwise. You are not required to agree to marketing in order to submit an ordinary enquiry or use the standard photo booth service.

3. Information we do not normally seek to collect

Our standard website forms and photo booth services are not designed to collect special category personal information such as health information, religious beliefs, racial or ethnic origin, political opinions, trade-union membership, sexual orientation or information about a person’s sex life.

A photograph may incidentally reveal characteristics about a person, but we do not normally analyse photographs for the purpose of identifying or inferring special category information.

We do not use facial recognition or biometric identification to identify event guests.

We do not routinely collect criminal offence information.

If a client proposes an event workflow that intentionally collects special category or other particularly sensitive information, that processing must be separately assessed before the event and an appropriate lawful basis and, where required, additional legal condition must be identified.

Please avoid submitting unnecessary sensitive information through free-text enquiry forms.

4. How we obtain personal information

We may obtain personal information:

• directly from you through an enquiry, booking, booth interaction, survey or communication;
• from the person or organisation arranging an event;
• from a corporate, school, charity or venue client;
• from our photo booth and event software;
• from website and security systems;
• from payment or banking providers;
• from professional advisers or suppliers where necessary;
• from publicly available business sources for legitimate business-to-business activity; or
• from another person where they are authorised or reasonably expected to provide information in connection with an event.

Where personal information is obtained from somebody other than the individual concerned, we will provide appropriate privacy information where required by law, taking account of the circumstances and any applicable exemption. Where Article 14 of the UK GDPR requires us to provide that information, we will do so within the applicable legal timeframe, normally no later than one month after obtaining the information, or earlier where required because we first communicate with the individual or disclose the information.

For event guests, privacy information may also be communicated through the booth interface, an event notice, signage, the event organiser, digital sharing screens or the online gallery.

5. Why we use personal information and our lawful bases

We only process personal information where we have a lawful basis to do so.

Where we rely on legitimate interests, those interests may include operating and protecting our business, providing the service expected by clients and event guests, maintaining appropriate records, improving our services, protecting legal rights, preventing fraud and developing legitimate professional relationships.

We consider whether those interests are necessary and whether they are overridden by the rights and freedoms of the individual.

You have the right to object to processing based on legitimate interests in certain circumstances.

6. Event guests who did not make the booking

The person who books Click Photo Booth is often different from the people who use the booth.

We therefore process information relating to guests who may never have entered into a contract with Click Photobooth Ltd.

Our legitimate interest in relation to ordinary guest participation is to provide the interactive photo booth service requested by the organiser and reasonably expected by guests who voluntarily choose to use the booth.

Guests are not required to use the booth.

Where practical, guests will be given access to appropriate privacy information before or at the point their information is collected.

Using the booth for the normal purpose of creating an event capture does not, by itself, give Click Photo Booth permission to use an identifiable guest’s image for advertising, social-media promotion or portfolio marketing.

7. Digital sharing and contact details

Where a guest enters an email address or telephone number to receive their capture, we use that information to provide the requested sharing function and related service administration.

We do not automatically add those details to Click Photo Booth’s marketing database.

Where the booth is temporarily offline, pending sharing information may be stored on the booth device until connectivity is restored and the requested delivery can be completed.

Where a corporate client wants to collect marketing permissions through the booth, the marketing choice must be clearly separated from the photo-delivery function and configured appropriately before the event.

A person must not be forced to agree to unrelated marketing merely to receive a photograph unless a lawful and fair event structure has been separately established.

8. Online event galleries

Event captures may be made available through an online gallery.

Depending on the event, a gallery may be:

• accessible through a unique link;
• password protected;
• restricted;
• made available only to the client; or
• configured so that guests receive only their own media.

Clients should take reasonable care when sharing gallery links or passwords.

Where a person who has legitimate access to a gallery downloads a photograph and subsequently shares or republishes it independently of Click Photo Booth, that subsequent use may be outside our control.

External social-media platforms and messaging services process information under their own privacy terms.

9. Promotional use of event photographs and videos

We distinguish between processing event media to deliver the booked service and using event media to promote Click Photo Booth.

We do not treat silence, failure to opt out or simple participation in the booth as automatic permission for Click Photo Booth to use an identifiable person’s photograph or video in our advertising.

Where we wish to use identifiable client or guest media for advertising, portfolio content, social media, promotional material or another purpose beyond ordinary event delivery, we will ensure there is a separate lawful basis.

Where we rely on consent, that consent will be requested through a clear affirmative action and can be withdrawn.

Withdrawal of consent will not affect processing that was lawful before withdrawal.

Where content has already been lawfully published or incorporated into physical materials before consent is withdrawn, complete retrospective removal may not always be technically possible, but we will take reasonable steps in accordance with the law.

10. Corporate events and client-controlled data capture

Corporate photo booth activations can involve more complex data processing than private celebrations.

Where a corporate client asks us to configure email capture, telephone capture, survey questions, competition fields, marketing permissions or other guest information, the intended data flow must be established before the event.

If the corporate client determines why the information is collected and how it will be used, the client will normally be responsible for identifying its own lawful basis and providing any privacy information required for its processing.

Where Click Photobooth Ltd processes that information solely on the client’s documented instructions, we will act as a processor. Appropriate written data-processing terms will be put in place as required by applicable data protection law before that processing begins.

We will not independently use client-controlled contact or survey information for Click Photo Booth marketing unless we have our own lawful basis to do so.

Where both parties intend to use the same information for their own purposes, their respective roles and responsibilities must be identified before the collection takes place.

Corporate clients must not instruct us to collect information unlawfully.

11. Children and young people

Click Photo Booth provides services at events that may be attended by children and young people, including birthdays, school celebrations, proms, family events and Bar or Bat Mitzvah celebrations.

Children’s personal information requires particular care.

For child-focused or school events, the organiser should ensure that appropriate privacy, safeguarding and photography arrangements have been considered and that parents, guardians, pupils or attendees receive appropriate information where required.

Where a school or other organisation determines the purposes for which children’s information is processed, its own privacy notice and safeguarding policies may also apply.

We do not use contact information collected from children through the booth for direct marketing.

We do not use identifiable images of children for Click Photo Booth promotional purposes without an appropriate lawful basis and, where appropriate, valid permission from a parent or guardian.

Where additional safeguards are appropriate, an event gallery may be password protected, restricted or supplied directly to the organiser rather than made generally accessible.

A child, or a parent or guardian acting appropriately on their behalf, may contact us regarding the child’s personal information and data protection rights.

12. Direct marketing

We may send information about Click Photo Booth services where permitted by data protection law and the Privacy and Electronic Communications Regulations.

For individual subscribers, this will normally be where:

• the person has given valid marketing consent; or
• all requirements of the existing-customer or prospective-customer soft opt-in are satisfied.

Where we rely on the soft opt-in, marketing will relate only to our own similar services, an opportunity to opt out will have been provided when details were collected, and an opt-out will be offered in every subsequent message.

Different rules can apply to genuine corporate subscribers.

Where UK GDPR applies to an identifiable business contact, we may rely on legitimate interests for proportionate business-to-business marketing where appropriate.

We do not assume that a publicly available personal email address automatically provides consent to electronic marketing.

Every person has the right to object to direct marketing at any time.

We maintain appropriate suppression information so that people who have opted out are not accidentally added back to active marketing lists.

YOUR RIGHT TO OBJECT TO DIRECT MARKETING

You have an absolute right to object to the use of your personal information for direct marketing.

If you tell us that you no longer want to receive direct marketing from Click Photo Booth, we will stop using your information for that purpose.

You can use the unsubscribe method in a marketing communication or contact us directly.

There is no charge for exercising this right.

13. Who we share personal information with

We do not sell or rent personal information to third parties for their own marketing purposes.

We may share information where reasonably necessary with:

Photo booth software and gallery providers

We use Photobooth Supply Co’s Fiesta platform to operate core photo booth functions including captures, digital sharing, event galleries, analytics and, where configured, surveys and contact capture.

Information processed through Fiesta may include event media, email addresses, telephone numbers, sharing information, survey responses and technical information.

Event organisers and corporate clients

Where agreed as part of an event, we may provide the booking client or authorised organiser with:

• event captures;
• gallery access;
• engagement information;
• sharing statistics;
• agreed survey results;
• configured contact-capture information; or
• other agreed reporting data.

Where guest personal information is to be supplied to an organiser, the intended disclosure and purpose should be made clear as part of the event privacy arrangements.

Website, communications and IT providers

We may use service providers for website hosting, website forms, email delivery, security, backups, spam prevention, analytics, consent management and other technical services.

Such providers may process personal information only to the extent required to provide the relevant service and subject to appropriate contractual or legal protections where required.

Banking and payment providers

Payment information may be processed by our bank, Revolut Business, payment networks or another payment provider used for the relevant transaction.

Professional advisers and insurers

Information may be shared where reasonably necessary with accountants, legal advisers, insurers or other professional advisers.

Authorities and legal recipients

We may disclose personal information where required or permitted by law, including to courts, regulators, law-enforcement authorities, tax authorities or other public bodies.

We may also disclose information where necessary to establish, exercise or defend legal claims or protect the rights, safety or property of Click Photobooth Ltd or another person.

14. Service providers and data processors

Where another organisation processes personal information on our behalf, we take reasonable steps to select appropriate providers and use contractual arrangements required by data protection law.

Our processor agreements require processors, where applicable, to:

• process information only in accordance with lawful instructions;
• maintain appropriate security;
• restrict access to authorised personnel;
• assist with relevant data-protection obligations where required; and
• delete or return information in accordance with the applicable agreement.

Where a provider engages subprocessors, international services or additional infrastructure, the relevant contractual and transfer requirements must also be considered.

15. International transfers

Some technology providers involved in operating our services are based outside the United Kingdom or may use infrastructure or subprocessors located outside the United Kingdom.

This includes services associated with our photo booth software and digital delivery platform.

For each restricted transfer, we identify and document the transfer mechanism that actually applies to the relevant provider and destination. We do not rely on a generic transfer mechanism where the legal requirements for that mechanism are not met.

Where personal information is transferred to a separate organisation outside the UK and the transfer is subject to UK international-transfer rules, we will ensure that the transfer is covered by an appropriate legal mechanism.

Depending on the recipient and destination, this may include:

• UK adequacy regulations;
• an applicable UK-approved adequacy arrangement;
• the UK International Data Transfer Agreement;
• the UK Addendum to approved international contractual clauses;
• another lawful Article 46 safeguard; or
• a statutory exception where its requirements are satisfied.

Where appropriate safeguards are relied upon, we will complete and retain the assessment required by UK data protection law for that transfer and keep the applicable contractual safeguards or other transfer documentation under review.

You may contact us if you would like further information about the safeguards applicable to a particular transfer of your personal information.

16. How long we keep personal information

We do not keep identifiable personal information indefinitely simply because storage is available.

The following are our normal retention periods unless a longer or shorter period is required by law, an event-specific agreement, a valid client instruction where we act as processor, or the need to establish, exercise or defend legal claims.

We periodically review personal information and delete, anonymise or securely dispose of information that is no longer required.

Deletion from active systems may not result in immediate deletion from every backup copy. Backup information may remain until the normal backup cycle overwrites it, during which time it will remain protected and will not normally be restored except for legitimate recovery purposes.

17. Security

We take appropriate technical and organisational measures designed to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access.

Measures may include, as appropriate:

• account authentication and access controls;
• device security and passcodes;
• limiting administrative access;
• secure transmission of website information;
• password-protected or restricted galleries where appropriate;
• software and security updates;
• appropriate backups;
• data minimisation;
• staff or operator confidentiality;
• secure disposal; and
• procedures for responding to suspected security incidents.

No internet service, device or storage system can be guaranteed to be completely secure. We therefore continually consider security in proportion to the nature and risk of the information being processed.

18. Personal data breaches

If we become aware of a personal data breach, we will assess the nature, scope and likely risk of the incident.

Where the law requires it, we will notify the Information Commissioner’s Office within the applicable statutory timeframe.

Where a breach is likely to result in a high risk to the rights and freedoms of affected individuals, we will also notify those individuals without undue delay unless an applicable exception applies.

We maintain appropriate records of personal data breaches where required.

19. Cookies and similar technologies

Our website uses cookies and similar technologies.

Some are necessary for the website to operate, maintain security or remember privacy choices.

Other technologies may support analytics, functionality, advertising or measurement.

Where consent is legally required, those non-essential technologies will not be activated until the relevant choice has been made.

Our consent controls allow website visitors to accept, reject or adjust relevant cookie categories.

You can change your preferences through the cookie controls available on the website.

Withdrawing cookie consent does not affect processing that lawfully occurred before withdrawal.

Third-party services used through the website may process information according to their own privacy notices.

20. Third-party websites, social media and external services

Our website, emails, event galleries or sharing functions may contain links to third-party websites or services.

If you choose to use an external social-media platform, messaging service or website, that organisation may process your information independently under its own privacy terms.

Click Photobooth Ltd is not responsible for the independent privacy practices of third-party controllers.

Where a third party processes information on our behalf rather than for its own independent purposes, our processor obligations apply instead.

21. Automated decision-making and profiling

Click Photobooth Ltd does not normally make decisions about individuals based solely on automated processing where those decisions produce legal effects or similarly significant effects.

Photo booth engagement analytics, sharing statistics and event reporting are used to understand interaction with the service and do not make legally significant decisions about individual guests.

Where optional website advertising or measurement technologies involve profiling, they are subject to applicable cookie, privacy and consent requirements.

If our use of automated decision-making materially changes, we will update our privacy information as required.

22. Your data protection rights

Depending on the circumstances and the lawful basis being relied upon, UK data protection law may give you the following rights.

Right of access

You may ask whether we process your personal information and request a copy of relevant information.

Right to rectification

You may ask us to correct inaccurate personal information or complete information that is incomplete.

Right to erasure

You may ask us to delete personal information in circumstances where the legal requirements for erasure are satisfied.

This right is not absolute. We may need to retain certain information where required by law or where another lawful reason for retention applies.

Right to restriction

You may ask us to restrict how personal information is used in certain circumstances.

Right to data portability

Where the legal requirements are satisfied, you may request certain information that you provided to us in a structured, commonly used and machine-readable format or ask for it to be transmitted to another controller where technically feasible.

Right to object

You may object to processing based on legitimate interests.

We will consider the circumstances and stop processing unless we have compelling legitimate grounds that override your interests, rights and freedoms, or the processing is required for legal claims.

The position is different for direct marketing: your right to object to direct marketing is absolute.

Right to withdraw consent

Where we rely on your consent, you may withdraw that consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Rights concerning automated decisions

You may have rights relating to certain decisions made solely by automated processing that have legal or similarly significant effects.

We do not normally undertake this type of decision-making.

23. Exercising your rights

To exercise a data protection right, contact us using the details in this policy.

Please explain what you are requesting and provide enough information for us to identify the relevant records.

We may need to ask for proportionate information to confirm your identity where necessary to protect information from unauthorised disclosure.

We will respond without undue delay and normally within the statutory one-month period, subject to any lawful extension, pause or exception that applies to the particular request.

We do not normally charge a fee for exercising data protection rights. The law permits fees or refusal in limited circumstances.

24. Data protection complaints

If you believe Click Photobooth Ltd has infringed data protection law in relation to your personal information, you may make a complaint directly to us.

You can do so by email or through our contact facility.

It is helpful, although not mandatory, to state that your message is a Data Protection Complaint and explain:

• what happened;
• what personal information is involved;
• why you are concerned; and
• what outcome you are seeking.

We will acknowledge receipt of a data protection complaint within 30 days beginning with the date it is received.

We will then take appropriate steps to investigate and respond to the complaint without undue delay.

Where appropriate, we will keep you informed about progress and will communicate the outcome of the complaint.

You do not lose your right to complain merely because you did not label a communication as a “Data Protection Complaint”.

25. Complaining to the Information Commissioner’s Office

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator.

You may contact the ICO if you believe your personal information has been handled in a way that breaches data protection law.

You are not legally required to complain to us before approaching the ICO, although giving us an opportunity to address the issue may allow it to be resolved more quickly.

Information about making a complaint is available from the Information Commissioner’s Office.

26. Legal claims and regulatory requirements

Nothing in this policy requires us to delete or disclose information where doing so would conflict with a legal obligation, applicable exemption, court order, regulatory requirement or legitimate requirement to establish, exercise or defend legal claims.

Where an individual right is restricted by law, we will explain that position where we are permitted and required to do so.

27. Changes to this Privacy Policy

We may update this Privacy Policy when our services, technology, suppliers, legal obligations or data-processing activities change.

The current version will be published on the Click Photo Booth website together with its latest revision date.

Where a change materially affects how we use existing personal information, we will take additional steps to notify affected individuals where required.

We will not treat a change to this Privacy Policy as a substitute for obtaining consent where the law requires new consent for a new processing purpose.

28. Contact us

For privacy questions, individual-rights requests or data protection complaints, contact:

Click Photobooth Ltd Trading as Click Photo Booth Company number: 15377262

Registered office: 15 Birch Avenue Auckley Doncaster England DN9 3LT

Email: info@clickphotobooth.co.uk Telephone: 07538 362489

Please include enough information for us to understand and locate the information relevant to your request, but do not send unnecessary sensitive information.