Privacy Policy

At Omnibooth Studio, owner of Omnibooth Studio, we are committed to protecting your privacy and to processing your personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR), Spanish Organic Law 3/2018 on the Protection of Personal Data and the guarantee of digital rights (LOPDGDD) and other applicable legislation.

This policy explains what data we collect, why, how we use it and what rights you have over it.

1. Data controller

The controller of your data is the owner of Omnibooth Studio, with address in Torredembarra (Tarragona), Spain. You can write to them at info@omniboothstudio.com.

The full identifying details (name, tax number and address) appear at the end of this page and in the legal notice.

2. Data we collect

2.1 Data you give us directly

• Account registration: first name, surname, email address and password.
• Purchases: billing details (name, address, country) and order history. Credit card details are processed directly by Stripe and never pass through our servers.
• Communications: messages you send us by email or through contact forms.

2.2 Data we collect automatically

• Browsing data: IP address, browser type, operating system, pages visited, date and time of access.
• Software usage data: version installed, licence activations, errors (without any personal data of the photo booth's end users).
• Cookies and similar technologies: as detailed in our Cookie Policy.

2.3 Children's data

The service is aimed at users aged at least 16. We do not knowingly collect data from children under 16. If we find that data from a minor has been collected without appropriate parental consent, we will delete it immediately.

3. Purposes and legal bases for processing

• Providing the service and managing your account — Basis: performance of a contract (Art. 6.1.b GDPR).
• Processing payments and invoicing — Basis: performance of a contract and legal obligation (Art. 6.1.b and 6.1.c GDPR).
• Transactional communications (purchase confirmations, licence notices, changes to the service) — Basis: performance of a contract (Art. 6.1.b GDPR).
• Commercial and marketing communications — Basis: express consent (Art. 6.1.a GDPR). You may withdraw your consent at any time.
• Compliance with legal obligations (tax, accounting, requests from authorities) — Basis: legal obligation (Art. 6.1.c GDPR).
• Improving the service and analysing usage — Basis: legitimate interest (Art. 6.1.f GDPR), provided your rights and freedoms do not prevail.
• Security and fraud prevention — Basis: legitimate interest (Art. 6.1.f GDPR).

4. Data retention

Your data will be kept for as long as necessary for the purposes stated and, in any case:

• Account data: while the account is active and for 3 years after it is closed, in order to handle any claims.
• Billing data: 5 years from the transaction, in accordance with Spanish tax law.
• Support communications: 2 years from the last interaction.
• Browsing data and logs: 12 months maximum.

Once these periods have elapsed, the data will be securely deleted or anonymised.

5. Recipients and international transfers

Your data may be shared with the following categories of recipient:

• Stripe, Inc. — payment processing. Stripe is certified under the EU-U.S. Data Privacy Framework and offers appropriate safeguards in accordance with the GDPR.
• Cloud infrastructure providers (hosting, storage) — within the European Economic Area or with appropriate contractual safeguards (Standard Contractual Clauses).
• Public authorities where required by law.

As we sell worldwide, certain billing data may be transferred outside the EEA in order to comply with tax or legal requirements in the user's country. In such cases we apply the safeguards required by the GDPR.

We do not sell, rent or transfer your data to third parties for their own commercial purposes.

6. Your rights

Under the GDPR, you may exercise the following rights over your personal data:

To exercise any of these rights, send an email to info@omniboothstudio.com stating the right you wish to exercise and attaching a copy of your identity document. We will reply within a maximum of 30 days.

If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.

7. Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss, destruction or alteration. These measures include encryption in transit (TLS/HTTPS), access control, periodic audits and incident management in accordance with the GDPR.

In the event of a security breach that poses a risk to your rights and freedoms, we will notify you within the time limits set by the GDPR.

8. Cookies

We use cookies and similar technologies. For more information, see our Cookie Policy.

9. Changes to this policy

We may update this Privacy Policy. We will notify you of relevant changes by email or by notice on the platform. The updated version will always be available on this page with the date it was last updated.

10. Contact

For any query about privacy or to exercise your rights, write to us at info@omniboothstudio.com.