Privacy Policy

Who is responsible for your data?

It depends on your relationship with us:

• Customers (event organisers, professional accounts) and visitors of our websites: BEPHOTO SRL is the controller of your data.
• Guests photographed at an event: the organiser who rents or uses the Bebooth is the controller of the photos, videos, audio messages and contact details collected at their event. BEPHOTO SRL processes them on the organiser's behalf, as a processor (article 28 GDPR), following the organiser's instructions and our terms and conditions.

What data do we process?

Depending on the service:

• Customers: identification and contact data (name, company, VAT number, address, email, phone), account login data, bookings and orders, invoices and payment information, and our exchanges with you. Card payments are handled by our payment providers; we never store your card number.
• Event guests: photos, videos, GIFs and audio messages taken with the Bebooth, the images generated from them by AI themes, and the email address or phone number you enter to receive your photos.
• Breathalyzer game (only if the organiser enables it): the reading is shown on screen and can appear on the souvenir photo. It is not stored separately and is never used to identify you.
• Bebooth devices: technical data of the iPad (device identifiers, app version, serial number of managed devices, battery and printer status, name of the Wi-Fi network used, push notification token), used to operate and support the booths.
• Website visitors: the data you send us through our forms, and the cookies described below.

Camera, augmented reality and face tracking

The Bebooth app uses the iPad camera to take photos and videos. For augmented-reality effects, it can use Apple's TrueDepth API to follow the position of the head and face. This information stays on the device, is not stored and never leaves the iPad. We do not use facial recognition and never identify the people photographed.

Why do we use your data and on what legal basis?

We only process personal data for the following purposes:

• Providing the photobooth service (capture, AI themes, printing, galleries, sharing by email, WhatsApp or QR code): performance of the contract with the organiser (article 6.1.b GDPR); for guests, on the organiser's instructions.
• Managing customer accounts, bookings, delivery, billing and support: performance of a contract (article 6.1.b GDPR).
• Answering your availability requests and sending you a single reminder if you do not complete your booking: pre-contractual steps taken at your request (article 6.1.b GDPR).
• Accounting and tax obligations: legal obligation (article 6.1.c GDPR).
• Security, fraud prevention, diagnostics and improvement of our services: our legitimate interest in providing reliable and secure services (article 6.1.f GDPR).
• Audience measurement and marketing cookies: your consent (article 6.1.a GDPR), which you can withdraw at any time.

Artificial intelligence

Some themes transform guests' photos with artificial intelligence. Most of these images are generated on our own servers in Belgium. For certain themes, the photo is sent to Google (Gemini) or Black Forest Labs (FLUX), which generate the image on our behalf as processors. AI-generated images are kept for the same period as the other photos of the event. No decision with legal or similarly significant effects is taken automatically about you.

How long do we keep your data?

We keep data only as long as necessary:

• Event photos, videos, audio messages, AI-generated images and the contact details entered to receive them: deleted 30 days after the event, unless the organiser sets a different period.
• Customer data (account, bookings, orders, invoices): 7 years after the end of our business relationship, to meet our accounting and tax obligations.
• Availability requests (event date, email, phone): deleted 6 months after the request.
• Cookies: see the durations in the table below.

Who do we share your data with?

We never sell your data and send no marketing emails. We only share the data each recipient needs, with processors bound to us by a contract compliant with article 28 GDPR:

• Hosting: our own servers in Belgium and OVHcloud (European Union).
• Brevo (France): sending of emails (photos, bookings, invoices).
• Twilio (United States): sending of photos by WhatsApp.
• Google Firebase (United States): notifications sent to the booths.
• Google (Gemini) and Black Forest Labs: generation of images for certain AI themes.
• Dropbox (United States): backup of an event's photos, only if the organiser enables it.
• Stripe, Apple and RevenueCat: payments and in-app purchases.
• bpost: delivery and return of the booths and of printed orders.
• Our accountants and legal advisers, and public authorities when the law requires it.

Transfers outside the European Union

Some of these providers are located in the United States or may access data from there. These transfers are covered by the EU-US Data Privacy Framework or by the European Commission's standard contractual clauses (article 46 GDPR). You can obtain more information by contacting us.

Information security

We apply technical and organisational measures (encrypted connections, firewalls, restricted and controlled access, backups) to protect your data against unauthorised access, loss and destruction. Our processors are bound by the same obligations.

Your rights

You have the following rights over your data:

• Access: know whether we process your data and obtain a copy.
• Rectification of inaccurate or incomplete data.
• Erasure, for example of your photos before the end of the retention period.
• Restriction of processing.
• Objection to processing based on our legitimate interest.
• Portability of the data you provided to us.
• Withdrawal of your consent at any time, without affecting earlier processing.

How to exercise your rights

Write to rgpd@bephoto.be or to BEPHOTO SRL, Rue Mathy 12, 1380 Plancenoit, Belgium. We may ask for proof of identity if we have a reasonable doubt. We answer within one month; this period can be extended by two months for complex requests, in which case we inform you. Requests are free, unless they are manifestly unfounded or excessive. As a guest, you can also contact the organiser of the event; we forward the requests we receive to them and help them answer.

Minors

Our services are intended for event organisers. Minors may be photographed at an event under the responsibility of the organiser and of their parents or guardians. A parent or guardian can ask us at any time to delete the photos of their child at rgpd@bephoto.be.

Complaints

If you believe your data is not processed in accordance with the GDPR, you can lodge a complaint with the Belgian Data Protection Authority, Rue de la Presse 35, 1000 Brussels, https://www.dataprotectionauthority.be. We would appreciate the opportunity to address your concerns first at rgpd@bephoto.be.

Changes to this policy

We may update this policy to reflect changes to our services or to the law. The date of the latest update is shown at the top of this page.

Cookies

We use three categories of cookies. Necessary cookies are always on. Audience measurement and marketing cookies are only set with your consent.

Necessary

Required for the site to work: form security, language, remembering this choice.

Audience measurement

Google Analytics: number of visits and pages viewed, to improve the site.

Marketing

Google Ads and Meta (Facebook, Instagram): measuring and personalising our ads.

Your choice is kept for 6 months, then we ask again. You can change it at any time with the button below or with the "Cookie settings" link at the bottom of every page. When you withdraw your consent, the related cookies are deleted.

Manage my cookies

Contact

For any question about your data: rgpd@bephoto.be. BEPHOTO SRL, Rue Mathy 12, 1380 Plancenoit, Belgium.