Your photos and data,
clearly explained.

01

Who is responsible

SNAP HEAVEN LTD is the data controller for personal information used to run Snap Heaven, deliver photobooth photos, answer enquiries and manage privacy requests.

Company number: 17062483
Registered office: 82a James Carter Road, Mildenhall, Bury St. Edmunds, Suffolk, United Kingdom, IP28 7DE

Contact dpo@snapheaven.co.uk about this policy, a photo, or your data protection rights. You can also use the website contact form; choose “Photo or privacy request”.

02

Photobooth photos and payments

When you use a booth, it takes your photos and creates a private link. Cloudflare stores the online copies and delivers them when someone opens the link. The booth also keeps a local copy. Anyone you give the link to may be able to view or download the photos, so please share it carefully.

If you ask us about a photo, we may use the venue, date and other details you give us to find it and respond to your request.

Nayax handles card payments at our booths. We record the amount, product, time and payment result so we can provide the service and resolve problems. Card details are entered at the Nayax reader.

We only post a guest photo on our website or social media, or share it with a venue for marketing, if the guest has agreed. Cloudflare stores the record of that permission. If you withdraw permission, we can remove a post from accounts we control, but we cannot remove copies other people have made.

03

Website visits and enquiries

Cloudflare hosts and protects this website and provides website analytics. It receives details such as your IP address, browser and request time. Its analytics measures visits and page performance without analytics cookies. This website has no guest account or checkout. It uses temporary browser storage to remember page navigation during a tab session; security services may use their own cookies.

If you use the contact form, you provide your name, email address, reason for contact and message. You may also add a phone number and venue name. Web3Forms receives the form, keeps a copy and sends it to our SpaceMail inbox. Messages sent directly to our support, partnership or privacy email addresses also reach SpaceMail. Please do not send payment card details or sensitive documents in a routine message.

hCaptcha checks contact form activity for spam. It may receive technical details such as your IP address and how you use the check. You can email dpo@snapheaven.co.uk instead of using the form for a privacy request.

04

How long we keep data

• Online photos and links: private links expire 30 days after capture. Online photos are scheduled for deletion 30 days after upload. Deletion usually completes within another day, but can take longer if delayed. You can ask us to delete a photo earlier.
• Copies on the booth: these have no fixed deletion date. The booth removes older copies when it needs storage space, while keeping photos that are still waiting to upload. Its session and payment records also have no automatic expiry. A private link can expire while a local copy remains.
• Marketing photos and records: a photo posted with permission remains on accounts we control until we remove it or you withdraw permission. Cloudflare keeps consent and other operational records without an automatic expiry; marketing consent records remain until deletion is requested. Previous versions of a deleted record may remain in Cloudflare recovery copies for up to 30 days.
• Enquiries and email: Web3Forms keeps a copy of contact form submissions for up to three years. Messages also reach SpaceMail, where we archive correspondence without a fixed deletion period. SpaceMail says its server backups last up to four weeks.
• Operational logs: we generally keep booth service logs for about five weeks and payment logs for about fourteen weeks. They may remain longer if a booth is offline. Cloudflare keeps logs from the online photo service for up to seven days.
• Website use: temporary browser storage lasts for the tab session. Cloudflare keeps detailed website analytics data for seven days and makes reports available for six months. hCaptcha keeps technical data under its own privacy policy.

To ask for early deletion of information we control, email dpo@snapheaven.co.uk. Deleting a photo does not remove copies already downloaded or shared by others, or copies in a provider's backup before its normal expiry.

05

Services and sharing

These companies help us run the booths, website and support service:

• Cloudflare stores and delivers online photos, keeps consent and operational records, and hosts, protects and measures use of this website. Read Cloudflare's privacy policy.
• Web3Forms receives website contact form messages, checks for spam and sends them to our inbox. Read Web3Forms' privacy policy.
• hCaptcha checks the form for automated abuse. Read hCaptcha's privacy policy.
• SpaceMail hosts our email inboxes for enquiries, support and privacy requests. Read its provider Spaceship's privacy policy.
• Nayax handles card payments at the booths. Read Nayax's privacy policy.
• Instagram (Meta) receives photos we publish with permission. Read Meta's privacy policy.

We may also share information with professional advisers when needed. We do not give venues guest photo data by default; marketing sharing with a venue requires the guest's permission.

06

Transfers outside the UK

Some providers may handle information outside the UK. Cloudflare operates a global network. Web3Forms says its form servers are in the United States and its operator is based in India. hCaptcha and SpaceMail may process data in the United States. Nayax says it may transfer data to Israel, the United States and Europe.

For transfers that need protection under UK law, the providers describe arrangements such as approved contractual terms or the UK–US Data Privacy Framework, where applicable. The arrangement depends on the provider and transfer. You can read Cloudflare's, Web3Forms', hCaptcha's, SpaceMail's and Nayax's published information, or email us for more details.

07

Lawful bases and data protection rights

UK data protection law requires us to have a lawful basis for each way we use personal information. The basis we rely on can affect which rights apply. You can read more about lawful bases on the ICO's website.

Why we use your information

• Contract: We use information needed to take payment, provide a photobooth session and give you access to your photos. We also use information to respond to a venue partnership enquiry or carry out a venue agreement.
• Legitimate interests: We use information to keep the booths and website secure, prevent fraud and spam, check problems with payments or photo delivery, and answer support and privacy requests. We rely on this basis only where those interests are not overridden by your rights and freedoms.
• Consent: We ask for permission before using a guest's photo for optional social media or venue marketing. You can withdraw that permission at any time by contacting us.

Service updates and marketing

We use the bases above for messages needed to provide a service or respond to an enquiry. If we send optional marketing messages, we use consent where required and you can withdraw it at any time.

Your rights

Depending on the circumstances, you may have the following rights over your personal information:

• Access: Ask us for a copy of the personal information we hold about you.
• Rectification: Ask us to correct information that is inaccurate or incomplete.
• Erasure: Ask us to delete your personal information.
• Restriction: Ask us to limit how we use your information.
• Objection: Object to our use of your information based on legitimate interests, or to its use for direct marketing.
• Data portability: Ask to receive information you gave us in a portable format, or have it transferred to another organisation, where this right applies.
• Withdrawal of consent: Withdraw permission for any use that relies on consent, including optional photo marketing.

These rights are not absolute, and some depend on the lawful basis used. Email dpo@snapheaven.co.uk to make a request. We may ask for enough detail to identify the right photo or verify your identity. We respond without undue delay and normally within one month.

08

How to complain

If you have concerns about our use of your personal data, email dpo@snapheaven.co.uk or use the contact form and choose “Photo or privacy request”. If you remain unhappy after raising a complaint with us, you can complain to the Information Commissioner's Office (ICO).

Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint