Try it for free

Processor agreement

Last updated: 4 November 2026

Who this is between

This agreement is between you, the rental business with a BoothBuddy account ("you"), and Perception Group BV, Gitsestraat 593, 8800 Roeselare, Belgium, company number 1031.162.458, VAT BE 1031.162.458 ("we"). It is part of the terms of use and you accept it when you create an account.

Who does what

For guests' photos and details, you are the controller and we are the processor (Article 28 GDPR). You decide why and how they are processed. For your own account data we are the controller: see the privacy policy.

What we process and why

We process guests' photos and details so that you can run events: putting the photos in your own Google Drive or Dropbox and loading them from there, the guest's gallery, your client's gallery, the slideshow, the client report, the guest list and the CSV export, sending by email or SMS through our sub-processors, and forwarding to your own webhook. We only keep a photo until it has reached your storage, plus a small preview for the gallery. We do this for as long as this agreement runs and your package's retention period. We use no AI and no face recognition, we do no profiling, and we don't use this data for ourselves.

Data and people

  • Data: photos, photo strips, GIFs and boomerangs; what guests enter (for example name, email address, phone number, answers to your questions); their consent choices; where mail and texts were sent; how often a guest's page and an event's gallery were opened, as a number on our server, without a cookie, without an IP address and without a time; your clients' names and contact details and your notes about them.
  • People: guests at your events, who can include children, and your clients' contact persons.
  • Sensitive data: we don't ask for it. Don't put questions in a form that collect it, unless you have a legal basis.

Your instructions

We only process this data on your instructions, as you give them through the settings of the web app and the apps, or in writing. If the law requires us to do something else, we tell you first, unless that law forbids it. If we think an instruction breaks the GDPR, we tell you.

Confidentiality

Anyone at our side with access to the data is bound to confidentiality, and only looks at it when that is needed to help you or to keep the service safe.

Security

These measures are in place:

  • encrypted connections (HTTPS) to the web app, the galleries and the apps;
  • files encrypted at rest by Cloudflare;
  • passwords stored only as a salted PBKDF2 hash, and sign-in cookies stored only as a SHA-256 hash;
  • your access to Drive and Dropbox stored encrypted (AES-GCM);
  • every account strictly separated from the others, with automatic tests on that separation;
  • limits on attempts at signing in, signing up, pairing and gallery access codes;
  • guest pages and files on long addresses that can't be guessed, and an access code you can set for an event's gallery;
  • a device token per iPad or computer, which you can revoke in the web app;
  • a logbook of changes in your account, with IP addresses shortened;
  • uploads checked by type, and stored files that can't run as a page.

Sub-processors

You give us general authorisation to use these sub-processors:

  • Cloudflare, Inc. (United States, with a worldwide network): hosting of the web app and the database, temporary storage of photos and the previews. The database and the storage are tied to the European Union when they are created.
  • Resend (Plus Five Five, Inc., United States, sending from Ireland): the email a guest asks for. Gets their email address, the link to their gallery and your words. Transfers under the EU-US Data Privacy Framework and the European Commission's standard contractual clauses.
  • Twilio (Twilio Inc., United States): the text message a guest asks for. Gets their mobile number, the link to their gallery and your words. Transfers under the EU-US Data Privacy Framework, Twilio's binding corporate rules and the European Commission's standard contractual clauses.
  • Stripe and Apple handle the payments and aren't sub-processors here: they get no guest data from us. We name them so that you have the full picture.

We tell you by email at least 30 days before adding or replacing a sub-processor, with who it is, what it does and the date it starts. During that time you can object on data protection grounds. We then look for a solution together. If that doesn't work out before the date, you can end the agreement free of charge before that date, and we refund what you paid in advance for the time after it. Our sub-processors are bound to the same duties, and we remain responsible to you for them.

Accounts you connect yourself

Google Drive and Dropbox are only used through your own account, with your own permission. You must connect one of them, because that is where the photos are. They are your processors, not ours: you choose them and you make your own agreement with them, including about where that data is kept. The same goes for the address you give a webhook. We only send guest answers there if you turn that on.

Transfers outside the EEA

The database, the temporary storage and the previews are within the European Union. That doesn't rule out transfers completely: Cloudflare is an American company, requests run through the nearest server in its worldwide network, and traffic data or access for support can end up outside the EEA.

For that, the EU-US Data Privacy Framework applies, in which Cloudflare takes part. If that falls away, the European Commission's standard contractual clauses from Cloudflare's processor agreement apply. You can ask us for a copy.

Helping you

Within reason, we help you answer guests' requests and meet your other duties under the GDPR, such as an impact assessment. In the web app you can find, export and delete a guest's data yourself. If a guest writes to us, we pass the request on to you and don't answer it for you, unless you ask us to.

Data breaches

If there is a personal data breach, we notify you without undue delay, and at the latest within 48 hours after we know about it, at your account's email address. Those 48 hours are a limit, not a waiting time. We say what happened, which data and how many people it concerns, and what we are doing about it. If we don't know everything yet, we first report what we know and add to it later. You decide whether to notify the authority and the guests; for the authority you have 72 hours yourself.

Deletion and return

  • During the agreement you can download and delete everything yourself. Sessions past your package's retention period (Basis 3 months, Pro 6 months, Luxe 1 year, counted from the day of the session) are deleted automatically on our side: the gallery, the preview, form answers, addresses and numbers. You manage the photos in your own storage yourself. If a guest asks you to remove a photo, delete it there too.
  • After the end of your hosting you decide: you can download everything per event and you can delete everything straight away. Your account stays view-only so that you can. As long as you do nothing else, your package's retention period is your instruction: it keeps your galleries available for you and your guests and lets you start again.
  • Reminder. We tell you this in the web app when you cancel. Before anything is automatically deleted for the first time after the end of your hosting, we email you once, and then we wait at least 30 days. The first deletion can therefore fall up to 30 days after the end of the period. If your package drops through a refund, we do the same before the shorter period applies.
  • Deleting your account. Do it yourself under Settings, or ask us to, and all guest data in it is gone within 30 days, unless the law requires us to keep something.
  • Restore history. Deleted data can stay in Cloudflare's database restore history for up to 30 days. After that it is gone for good.
  • The photos in your own Drive or Dropbox, on your devices or on your camera's card are yours to manage.

Audit

We give you the information you need to show that we keep to this agreement, on request and at most once a year unless there was a breach. If that isn't enough, you can have an audit done at your own cost, with reasonable notice and under confidentiality.

Your duties

  • You have a legal basis for what you do with guests' data, and you inform guests.
  • For guests under 16, you and your client are responsible for getting permission from a parent or guardian, also for photos of children. The terms of use explain why that is separate from the Belgian limit of 13.
  • You answer guests' requests, and keep your own contract with your client.
  • You keep your password, your device PIN codes and your devices safe.

Duration and liability

This agreement runs for as long as we hold personal data for you. The limits in the terms of use apply to it, unless the GDPR says otherwise. They don't limit the rights guests have themselves under the GDPR. If this agreement and the terms differ on personal data, this agreement goes first. Questions? Email info@studio-perception.be.