Legal
Privacy Notice
Last updated: 3 September 2026
1. Who is responsible for your data
For bookings we provide directly to our clients, 234INSPIRED LIMITED, trading as Essex Photobooths, is normally the data controller. For certain corporate or branded events, the event organiser may determine some purposes and means of processing — where that's the case, our respective roles may differ and we'll put appropriate contractual arrangements in place.
2. The information we process
Client information
Name, email address, phone number, correspondence, event details, venue information, billing information, transaction and payment records, package information, artwork instructions, and complaints or customer-service records.
Event media
Photographs, videos, GIFs, boomerangs, 360-degree video, print layouts, guestbook content, digital signatures where enabled, and AI-generated or AI-modified images where such features are selected.
Guest-sharing information
Where guests use our sharing functions: email addresses, mobile telephone numbers, social-sharing details, and sharing activity.
Technical information
Depending on the platform used: IP addresses, device/browser information, session identifiers, gallery activity, and technical logs.
3. Why we process your information
To provide quotations; manage bookings; communicate with you; provide the contracted photobooth service; create and deliver photographs and videos; provide physical prints and galleries; deliver media by email, SMS, WhatsApp or other requested channels; customise overlays and event branding; process payments; operate and secure our equipment; resolve complaints; maintain business and accounting records; protect our legal rights; meet legal requirements; and carry out marketing where legally permitted.
4. Our lawful bases
Depending on the activity, we rely on:
- Contract — where processing is necessary to enter into or perform our contract with you.
- Legitimate interests — where processing is reasonably necessary for our legitimate business interests (service administration, security, fraud prevention, complaint handling, protecting our equipment and legal rights) and isn't overridden by your rights.
- Legal obligation — where we must process information to meet accounting, tax, regulatory or legal requirements.
- Consent — where consent is the appropriate basis, including certain promotional uses of identifiable photographs and certain direct-marketing activities. You can withdraw consent at any time; this doesn't affect processing lawfully carried out before withdrawal.
5. Photographs and videos
Using one of our photo or video booth experiences necessarily involves capturing and processing imagery to provide that experience. We aim to provide a short privacy notice at or near the booth, with access to this full notice. A guest appearing in event photographs does not, by itself, mean we use those images for our own advertising.
6. Our photobooth technology providers
We currently use the following platforms, selecting the technology appropriate to the particular booth or package:
LumaBooth / dslrBooth
Supplied by Lumasoft LLC, used to capture and process event photographs, videos, GIFs and other media. Depending on event configuration, this may also process sharing information such as guest email addresses or mobile numbers.
fotoShare
fotoShare Cloud, also supplied by Lumasoft LLC, hosts and delivers event galleries and facilitates sharing. Depending on use, it may process photographs and videos, guest email addresses, mobile numbers, IP addresses, device/browser information, sharing records, and event-gallery analytics.
Touchpix
For some events we use Touchpix for capture, processing, hosting or sharing of photo and video content, which may process event media and contact details guests supply to receive their content.
7. Data-processing relationships
For LumaBooth, dslrBooth and fotoShare Cloud, Lumasoft LLC acts as our data processor under its Data Processing Agreement. For Touchpix event services, Touchpix similarly processes event data on our behalf as processor, subject to its applicable terms. We remain responsible for establishing the appropriate lawful basis for our processing and for giving relevant privacy information to event attendees.
8. Where your information is stored
Lumasoft LLC is based in the United States and uses cloud and communications providers which may process information in the United States, the European Economic Area and other territories; its current Data Processing Agreement provides appropriate safeguards for restricted UK transfers, including the UK International Data Transfer Addendum where applicable. For events configured as taking place in GDPR-regulated countries, Touchpix states that event data is stored and processed on servers within Europe. Other processing may occur internationally where required for particular features. Where UK personal data is transferred outside the UK in circumstances requiring a safeguard, we take reasonable steps to ensure an appropriate mechanism is in place.
9. fotoShare / Lumasoft retention
Event media hosted through fotoShare Cloud may remain available while our Lumasoft subscription remains active, unless we delete the event earlier — Lumasoft gives us tools to do this. If our Lumasoft service ends, its current terms state controller personal data will normally be deleted from active systems within 90 days, subject to backup cycles, legal obligations and limited permitted records. Because we control our own event-deletion decisions while the account is active, we operate our own retention policy (Section 11) rather than relying on indefinite platform availability.
10. Touchpix retention
Touchpix currently states that event photographs and videos are normally retained for six months from upload unless deleted earlier. The online gallery is accessible during the initial part of that period, after which media may be archived until deletion. Where an event is manually deleted, Touchpix states the associated photographs and videos are deleted from its servers. Certain guest contact information used for media delivery may also be retained for up to six months by the provider.
11. Our own retention policy
We aim not to keep personal data longer than reasonably necessary:
| Data | Retention |
|---|---|
| Booking and contractual records | Normally up to 6 years after completion, for accounting, contractual, tax or legal purposes |
| Event galleries and cloud-hosted media | Normally up to 6 months after the event, unless your package states a different period, you ask us to delete earlier where we lawfully can, we need it for an active complaint/legal matter, or a provider's backup cycle means full deletion takes slightly longer |
| Local copies on booth devices / working storage | Deleted or securely cleared once no longer needed for delivery, QA, backup or complaints — ordinarily within 6 months of the event |
| Guest email/phone used solely for photo delivery | Not added to our general marketing database automatically; kept only as long as the service and applicable law require |
| Marketing photographs | Kept while we have a valid lawful basis and they remain relevant to the purpose consented to; reviewed periodically |
We may delete a gallery earlier after giving you a reasonable opportunity to download your content.
12. Email, SMS and WhatsApp delivery
Where a guest gives an email address or phone number solely to receive their photo or video, we use it only to provide that delivery. This does not, by itself, sign anyone up for our marketing — where we invite guests to receive marketing, that choice is presented separately.
13. Marketing communications
We only send electronic direct marketing where permitted under applicable privacy and electronic-communications law. Where consent is required, we ask for it separately, consent boxes are never pre-ticked, and every marketing communication includes a clear way to unsubscribe. Operational booking communications aren't marketing and may still be sent where necessary to fulfil your booking.
14. Promotional use of event images
Accepting our Booking Terms does not automatically give us permission to publish identifiable event images for our own advertising. Where we'd like to use selected identifiable photographs or videos for our website, Instagram, Facebook, TikTok, advertising, brochures, portfolios or similar promotional material, we establish an appropriate lawful basis and seek consent where appropriate — see our Optional Photo & Marketing Consent. This permission is separate from your booking; saying no doesn't affect your service or price.
15. Children
Children may appear in booth photographs at family events, and we take additional care with children's images. Where we'd like to use an identifiable image prominently featuring a child for our own promotional purposes, we seek appropriate parent or guardian permission where required. Parents or guardians can contact us at bespoke@essexphotobooths.co.uk with any concerns about an image.
16. AI features
Some of our software may offer optional AI-enabled features such as background replacement, creative effects, portrait transformation or image-matching. Where these are enabled, we assess the feature and appropriate privacy information before enabling processing that materially changes how guest information is used. AI functionality does not give us permission to identify or profile individuals for unrelated purposes.
17. Who we may share information with
Where needed to supply our services: Lumasoft LLC, fotoShare Cloud, Touchpix, cloud hosting providers, communications providers used for email/SMS/WhatsApp delivery, payment service providers, website and email hosting providers, accountants, IT support providers, and professional advisers. We may also disclose information where required by law or reasonably necessary to protect our legal rights.
18. Payment information
We don't intend to retain full payment-card details ourselves where payment goes through an external payment provider, which processes card information under its own security and regulatory obligations. We may retain transaction references, payment status and accounting information.
19. Security
We take reasonable technical and organisational steps to protect personal information against unauthorised access, disclosure, loss, alteration and misuse, including appropriate password controls, software updates and access restrictions on systems under our control. Our external providers operate their own safeguards too. No digital system can be guaranteed completely risk-free.
20. Your rights
Depending on the circumstances, you may have rights to access, correct, erase, or restrict your data, to object to certain processing, to data portability, to withdraw consent, and protections concerning certain automated decision-making. These rights aren't absolute in every situation. To exercise a right, contact bespoke@essexphotobooths.co.uk — we may need enough information to locate the relevant event or image and verify your request.
21. Data-protection complaints
If you have a concern about how we've handled your personal information, please contact us first at bespoke@essexphotobooths.co.uk. We'll acknowledge, investigate and respond in line with applicable UK data-protection law.
22. Cookies
Where our website uses cookies or similar technologies, appropriate information and controls are provided through our Cookie Policy and consent banner. Non-essential cookies are never treated as essential merely for convenience.
23. Updates
This notice may be updated where our technology, suppliers, services or legal obligations change. The current version always displays its effective date above.
24. Contact
234INSPIRED LIMITED, trading as Essex Photobooths
128 City Road, London, England, EC1V 2NX
Company number: 15784003
Email: bespoke@essexphotobooths.co.uk