Skip to content

Privacy policy

Updated 28 September 2026

This privacy policy explains how Kuvapalvelut.com Finland Oy processes personal data on the kuvapalvelut.com website and in the Photobooth service (photo point, online gallery and the photographers’ desktop application).

Data controller

Kuvapalvelut.com Finland Oy
Business ID: 3282062-8
Käpyläntie 2 A 7, 00610 Helsinki, Finland
petri.aho@kuvapalvelut.com

Who this policy covers

  • Event guests who are photographed at the photo point and view their photos in the online gallery with a gallery code or QR code. Guests do not need a user account.
  • Photographers and event organisers (operators) who have a user account and buy the service as a subscription or credits.

Data we collect

About guests:

  • photos and videos taken at the photo point, versions made of them (e.g. background removal, frames) and the gallery code
  • gallery usage events: viewing, downloading, printing, liking, sharing and deleting images, and technical details of the visit (device type, browser, language, visit duration, page load time)
  • IP address in technical server logs and for abuse prevention

About operators, in addition:

  • account details: username, email address, password as a protected hash and two-factor authentication settings
  • subscription and purchase details: name, billing address, email, phone number, purchased products, order history and credit usage. Payment card details are not stored in our service; they are handled by the payment provider.
  • desktop application device keys: device name, operating system, application version, last contact time and the IP address of the contact
  • activity log: logins, key creation and revocation, subscription and credit changes, and image import error notifications

Purposes and legal bases

  • displaying, downloading, printing and sharing images for guests (legitimate interest and the agreement with the event organiser)
  • providing the service to operators, billing and customer support (contract)
  • ensuring security, preventing misuse and troubleshooting (legitimate interest and legal obligations)
  • accounting (legal obligation)

Data is not used for marketing or profiling.

AI-based image processing

Photo point images may be processed with AI-based features such as background removal and image editing. Processing primarily takes place on the photographer’s own device. If a feature uses an external AI service, the image is transferred to that service only for the duration of processing and is not used to train the provider’s models.

Image retention

Images are visible to guests in the gallery for 30 days unless otherwise agreed with the event organiser. A guest may delete their own images from the gallery at any time. After deletion, images are retained for 30 days for administrative purposes and are not shown to users. The total retention period is at most 60 days unless otherwise agreed.

Images are stored in Amazon Web Services cloud storage within the European Union (Frankfurt).

Retention of accounts and order data

  • A user account remains active while the subscription is valid. When the subscription ends, access to the service and device keys are removed automatically after 7 days.
  • You may request deletion of your account by email. We delete the account and related data within 30 days of the request.
  • Order and payment data are retained for the period required by accounting legislation.
  • Technical and activity logs are retained for at most 12 months.
  • Backups are encrypted and expire automatically within 35 days.

Cookies and statistics

The service uses only cookies that are necessary for its operation:

  • a session cookie that remembers the language selection and the opened gallery code
  • WordPress login cookies for operators
  • WooCommerce cart and session cookies during a purchase
  • a cookie that remembers that the cookie notice has been acknowledged

Gallery usage statistics are compiled without cookie-based tracking and no personal profiles are built from them. The service does not use Google Analytics or marketing cookies.

Data sharing and transfers

Personal data is processed only by partners essential for operating the service:

  • Amazon Web Services: server, image storage and email delivery, EU region (Frankfurt)
  • the payment provider, which processes payments under its own terms
  • accounting services
  • AI-based image processing services as described above, where used

Data is stored within the European Union. If data is transferred outside the EU or EEA, the transfer is based on the European Commission’s standard contractual clauses or another basis permitted by data protection law. Data is not sold or disclosed to third parties for marketing.

Security

Connections are encrypted (HTTPS). Administrator accounts are protected with two-factor authentication. Access rights are restricted and critical actions are logged. Backups are encrypted.

Your rights

You have the right to:

  • know what data about you is processed and receive a copy of it
  • request correction or deletion of your data
  • restrict or object to processing
  • have the data you provided transferred to another system
  • delete your own images from the gallery yourself
  • lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi)

Requests are sent by email to petri.aho@kuvapalvelut.com. We respond within one month. We may ask you to verify your identity before fulfilling a request.

Changes

We update this policy as the service evolves. The current version is always available on this page.

Contact

For privacy matters, contact: petri.aho@kuvapalvelut.com