How MADA Booth complies with the GDPR
A photo booth takes photos of people, which means it processes personal data. Here we explain in plain language who is responsible for what, which data we process, where it is stored, how long it is retained and how we protect it.
You are the controller, we are the processor
You as a rental company or hospitality business
You are the data controller for the photos and guest data from your events. You decide what is photographed, shared and retained.
MADA Tech as processor
We only process this data to provide the service and in line with your settings. This is set out in a data processing agreement in accordance with Article 28 of the GDPR.
Data processing agreement included
A data processing agreement is automatically included with every subscription. Request a signed copy via info@madabooth.nl.
Read the full data processing agreement and the privacy policy.
What data is processed
Photos and videos
The images and videos from the session, including when they were created and which photo booth was used.
Only if the guest chooses to
An email address or phone number, only if the guest wants to receive their photo this way or agrees to receive news.
No guest account required
Guests do not need to log in or install an app. The sharing page works via a unique link.
Your team's details
The name, email address and role of each person with access to the dashboard.
Guest consent and information
Clear from the start
The start screen can explain what happens to the photos, so guests know exactly what to expect.
Sharing is optional
Guests scan the QR code themselves and decide whether to download or share a photo.
News only with consent
An email address is only used for news or promotions if the guest explicitly opts in. Consent can be withdrawn at any time.
Stored within the EU and secured for each customer
First on the photo booth
Each photo is first stored on the photo booth itself and remains there until the server has confirmed receipt.
Dedicated media server
Online photos are stored on our own secure media server. Storage is not public: nothing can be accessed without a valid link.
Temporary links
A photo is only displayed after the system has verified that the link is authentic and still valid. Links expire automatically.
Separated by customer
Each customer has their own secure environment. Customers can never view each other's photo booths, photos or data.
All processing takes place within the European Union. No data is sold or used for advertising.
Retention periods you set
Configurable for each environment
You decide how long photos remain available online. After that, the system deletes them automatically.
Manual deletion
You can delete a photo, session or entire album yourself at any time in the dashboard.
After cancellation
After your subscription ends, your environment remains available for export for thirty days. After that, personal data is deleted, except for information that must be retained by law, such as invoices.
Logs
Technical photo booth logs are retained for a maximum of ninety days.
How we protect data
Encrypted traffic
All connections between the photo booth, dashboard and sharing page are encrypted.
Personal accounts and roles
Each employee has their own account with only the permissions they need.
Two-factor authentication
You can add extra login security with a code from an authenticator app. We strongly recommend this.
Logging
Important actions in the dashboard are logged, so you can see who did what afterwards.
Locked photo booth
The photo booth runs in locked mode. The service menu can only be accessed with the service code.
Data breaches
If we suspect a data breach, we will notify you within 24 hours, allowing you to report it to the Dutch Data Protection Authority in time.
What if a guest wants their photo deleted
Guests have the right to access, correct and delete their data. In practice, a guest will usually ask for a photo to be removed. You can handle this yourself in just a few clicks: find the session in Photos and guests and delete the photo or the entire session. The sharing page will then stop working.
If we receive a request via info@madabooth.nl, we will forward it to you as the responsible party and provide support where needed.
GDPR checklist for your event
- Inform your guests. Explain what happens to the photos on the start screen or on a sign next to the booth.
- Set a retention period. Choose a period that suits the event, such as thirty days.
- Make clear agreements with your client. Document who receives the photos and whether they may be used for promotional purposes.
- Secure your account. Enable two-factor authentication and only give staff the permissions they need.
- Handle requests quickly. Delete a photo immediately if a guest asks you to.
Frequently asked questions
Is MADA Booth GDPR compliant?
MADA Booth gives you the tools to comply with the GDPR: a data processing agreement, storage within the EU, protected links, configurable retention periods and the option to delete individual photos. As the responsible party, you decide how to use these tools at your event.
Can my client view the data processing agreement?
Yes. The data processing agreement is publicly available on this website, and a signed copy is available on request.
Are photos used to train software?
No. Photos are only used to provide the service to you and your guests.
What happens to photos when the booth is offline?
They remain on the booth until they have been sent and the server has confirmed receipt.
Want to try it yourself?
Create your account and try everything free for seven days, with no obligations.