Privacy & Data Protection Policy

1. Interpretation and Definitions

Key Terms

Throughout this policy, the following terms have the meanings set out below:
Company / We / Us / Our - refers to Bar Booths Ltd, 7 Bell Yard, London, WC2A 2JR. For the purposes of UK GDPR, the Company is the Data Controller.
UK GDPR - refers to the UK General Data Protection Regulation, as retained and amended by the Data Protection Act 2018.
Personal Data - any information that relates to an identified or identifiable living individual.
Data Subject / You - the individual accessing or using our Service.
Service - refers to our websites, photobooth systems, and associated digital platforms,
including snapomatic.co.uk and barbooths.co.uk.
Service Provider / Data Processor - a third party who processes data on our behalf.
Usage Data - data collected automatically through your use of our Service (e.g. IP address,
browser type, pages visited).
Photographic Data - images and GIFs captured by our photobooth systems during events.

 

2. What Data We Collect

2.1 Personal Data You Provide

When using our website or booking services, we may collect:
• Full name

• Email address
• Phone number
• Address, postcode, and town/city
• Marketing preferences (opt-in consent)

​

2.2 Data Collected at Our Photobooths

Our photobooth systems capture photographic images and GIFs of individuals during events. No personal data (such as name, email, or phone number) is collected directly at the booth itself. Customers who wish to receive their photos access them via a private link on our sharing website, where they may optionally provide consent to receive marketing communications.

 

2.3 Usage Data

Usage Data is collected automatically when you use our Service. This may include your device's IP address, browser type and version, pages visited, time and date of visit, time
spent on pages, and other diagnostic data.

 

2.4 Cookies and Tracking Technologies

We use cookies and similar tracking technologies to improve and analyse our Service. For
full details, please refer to our separate Cookie Policy available on our website.

 

2.5 Third-Party Social Media Login

You may choose to register or log in via third-party services including Google, Facebook,
Instagram, Twitter, and LinkedIn. Where you do so, we may receive personal data
associated with that account, consistent with your privacy settings on those platforms.

​

3. Photographic Data - Special Notice

As a photobooth operator, the capture and storage of photographic images is central to our Service. We want to be transparent about how we handle this data:
• Photos and GIFs are stored securely on Amazon Web Services (AWS) infrastructure in both UK and EU regions.
• Images are retained for up to 6 months from the date of capture, after which they are permanently deleted.
• Individuals access their own photos via a unique private link. No publicly accessible gallery is created by default.
• Venue clients and their parent companies (such as Stonegate Pub Company) may have access to images where they have entered into a GDPR-compliant data sharing agreement with us, and only where the individual has provided explicit consent.

• At events where children (under 18) may be present, we rely on the venue/event organiser to ensure appropriate consent has been obtained from parents or guardians.

 

Our systems do not intentionally target or capture data from children, and we do not knowingly retain photographic data of anyone under 13. If you wish to request deletion of your photographic data before the standard retention period, please contact us using the details in Section 10.

 

4. How We Use Your Data

We use personal data for the following purposes:
• To provide and maintain our Service, including photobooth operation and photo delivery.
• To manage your account or booking.
• To fulfil contractual obligations, including event hire agreements.
• To contact you regarding your booking, service updates, or security notices.
• To send marketing communications where you have given explicit opt-in consent.
• To analyse website usage and improve our Service.
• To comply with legal obligations.
• In the event of a business transfer, merger, or acquisition (with prior notice).

 

5. Legal Basis for Processing

Under UK GDPR, we process your personal data on the following legal bases:
• Consent - where you have actively opted in (e.g. marketing communications via our sharing website).
• Performance of a contract - to fulfil bookings and deliver our Service.
• Legal obligation - where required by law.
• Legitimate interests - for internal analytics, fraud prevention, and service improvement, where these do not override your rights.

 

6. Who We Share Your Data With

6.1 Service Providers (Data Processors)

We share data with trusted third parties who process it on our behalf, including:
• Amazon Web Services (AWS) - cloud infrastructure and photo/data storage (UK and EU regions).
• Google Analytics - website traffic analysis.

• Stripe - payment processing for online transactions
• myPOS - cashless payment processing at photobooth terminals
• Nayax - cashless payment processing at photobooth terminals

 

Each of these providers is contractually required to handle your data in accordance with UK GDPR and their own privacy policies.

​

6.2 Venue Partners

Where a venue partner (such as Stonegate Pub Company Ltd has a GDPR-compliant data sharing agreement in place with us, we may share photographic data with them. This only occurs where:
• You have given explicit consent at the point of sharing, AND
• A formal data sharing agreement governs the transfer.

 

6.3 Legal Disclosure

We may disclose your data where required by law, court order, or to protect the rights, property, or safety of Bar Booths Ltd, our customers, or the public.

 

7. International Data Transfers

Your data is stored on AWS infrastructure located in both the UK and EU (European Economic Area). Transfers to EU regions are made in accordance with UK GDPR rules on
international transfers, relying on adequacy decisions or standard contractual clauses as appropriate.

 

We do not transfer your personal data outside the UK or EEA to countries that do not provide an equivalent level of data protection without appropriate safeguards in place.

 

8. Data Retention

We retain your personal data only for as long as necessary for the purposes described in this policy, or as required by law. Our standard retention periods are:
• Photographic data (photos and GIFs): up to 6 months from date of capture.
• Booking and contact data: for the duration of the contractual relationship plus any
legally required period thereafter.
• Website usage/analytics data: typically up to 26 months (as per Google Analytics
defaults).
• Marketing consent records: retained until consent is withdrawn, plus a reasonable period thereafter for compliance purposes.

 

9. Your Rights Under UK GDPR

You have the following rights in relation to your personal data:
• Right of access - to request a copy of the data we hold about you.
• Right to rectification - to request correction of inaccurate or incomplete data.
• Right to erasure ("right to be forgotten") - to request deletion of your data where there is no compelling reason to continue processing it.
• Right to restrict processing - to request that we limit how we use your data.
• Right to data portability - to receive your data in a structured, machine-readable format.
• Right to object - to object to processing based on legitimate interests or for direct marketing purposes.
• Right to withdraw consent - where processing is based on consent, you may withdraw it at any time. This does not affect the lawfulness of processing prior to withdrawal.

 

To exercise any of these rights, please contact us using the details in Section 10. We will respond within one calendar month. We may ask you to verify your identity before actioning a request. If you are unhappy with how we have handled your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
• Website: https://ico.org.uk/make-a-complaint/
• Phone: 0303 123 1113

​

10. Security of Your Personal Data

We take the security of your personal data seriously and implement appropriate technical and organisational measures, including encrypted storage on AWS infrastructure. However, no method of transmission over the internet is 100% secure, and we cannot guarantee
absolute security. In the event of a personal data breach that is likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and, where required, notify affected individuals without undue delay.

 

11. Children's Privacy

Our Service is not directed at children under the age of 13. We do not knowingly collect personal data from children under 13. Where our booths operate at events where children may be present, we rely on venues / event organisers to obtain appropriate parental consent. If you believe a child under 13 has provided us with personal data without appropriate consent, please contact us and we will take steps to remove that data promptly.

 

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and, where appropriate, by email. The 'Last updated' date at the top of this document will always reflect the most recent revision. We encourage you to review this policy periodically.

 

13. Contact Us

If you have any questions about this Privacy Policy, wish to exercise your data rights, or wish to request deletion of your data, please contact us:
• Email: support@barbooths.co.uk
• Website: www.barbooths.co.uk
• Post: Bar Booths Ltd, 7 Bell Yard, London, WC2A 2JR
Data Controller: Bar Booths Ltd (Company No. 10750017)
ICO Registration Reference: ZA812783