Last updated: [date]
MomentBox places particular importance on protecting your data. This policy explains what data we collect, why, how long we keep it and what your rights are, in accordance with the General Data Protection Regulation (GDPR — Regulation EU 2016/679) and the Belgian Act of 30 July 2018.
1. Data controller
[full address]
CBE: [BE 0XXX.XXX.XXX]
Email: contact@momentbox.be
Phone: 0495/47.42.25
2. Data collected
a) When you request a quote or make a booking
Surname and first name, email address, telephone number, event address, date and type of event, approximate number of guests, package and option preferences, elements required for customisation (logo, first names, text), and where applicable billing details (address, company number).
b) When you contact us
The data you send us spontaneously by form, email, telephone or messaging service.
c) Photographs taken during your event
Photographs taken by the photo booth constitute personal data (images of individuals). Their processing is covered in section 6 below.
d) Browsing data
See section 8 on cookies.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to a quote or information request | Pre-contractual measures (art. 6.1.b GDPR) |
| Delivering the booked service (delivery, setup, customisation) | Performance of the contract (art. 6.1.b) |
| Issuing and keeping invoices and accounting records | Legal obligation (art. 6.1.c) |
| Making the photo gallery available to participants | Performance of the contract / consent |
| Occasional information or commercial follow-up sent to our clients | Legitimate interest (art. 6.1.f), with a right to object at any time |
| Use of photographs for promotional purposes (website, social media) | Explicit and separate consent (art. 6.1.a) |
4. Recipients
Your data is neither sold, rented nor transferred to third parties for commercial purposes.
It may only be shared with:
- our web host: [name];
- our email and gallery hosting tool: [name];
- our accountant and invoicing software ([Accountable]);
- the tax authorities or a judicial authority, upon lawful request.
Where a provider is established outside the European Union, the transfer is governed by the European Commission's standard contractual clauses.
5. Retention periods
- Quote requests with no follow-up: 2 years from the last contact.
- Client files (contract, contact details, event details): 10 years from the end of the service, matching the contractual limitation period.
- Accounting records and invoices: 7 years, in accordance with Belgian legal obligations.
- Event photographs: see section 6.
- Cookies: see section 8.
6. Photographs taken by the photo booth
This point deserves particular attention, as it concerns the image of your guests.
Who is responsible?
During the event, MomentBox acts as a technical processor on behalf of the organising client. It is the organiser who informs their guests of the presence of a photo booth and of the use that will be made of the photographs.
What we do with the photographs
- Photographs are printed on site and handed to participants immediately.
- A digital copy is made available to the organiser through a private online gallery, accessible by link or code, for [30] days.
- A photograph is emailed only at the participant's request, who enters their own address. That address is used solely to send the photograph and is deleted afterwards.
What we do not do
We never use photographs from your event for promotion, portfolio or publication on social media without written, explicit and separate consent from the organiser and from any identifiable individuals appearing in the image. Silence does not constitute consent.
Deletion
Files are deleted from our servers and storage no later than [90] days after the event. Early deletion may be requested at any time at contact@momentbox.be and is carried out within 30 days.
7. Security
We implement reasonable technical measures: password-protected file access, private non-indexed galleries, equipment supervised during services, encrypted backups, access limited to the owner alone. As no system is infallible, we undertake to notify any data breach to the Data Protection Authority within 72 hours and to inform the individuals concerned where the risk justifies it.
8. Cookies
The website uses:
- Strictly necessary cookies for the website to function (navigation, forms). These do not require your consent.
- Audience measurement cookies [where applicable: Google Analytics / Plausible], intended to understand website traffic. These are only placed after your consent, collected via the information banner.
You may change your choice at any time via [the cookie management link] or configure your browser to refuse cookies. Maximum retention period: 13 months.
9. Your rights
You have the following rights, free of charge and at any time:
- access to your data;
- rectification of inaccurate data;
- erasure ("right to be forgotten"), within the limits of our legal retention obligations;
- restriction of processing;
- objection, in particular to any commercial prospecting;
- portability of your data;
- withdrawal of your consent, without affecting the lawfulness of prior processing.
To exercise these rights: contact@momentbox.be, with proof of identity where reasonable doubt exists. We respond within one month.
10. Complaint
If you believe your rights are not being respected, you may lodge a complaint with:
Data Protection Authority (DPA)
Rue de la Presse 35, 1000 Brussels
+32 (0)2 274 48 00
contact@apd-gba.be
www.dataprotectionauthority.be
11. Changes
This policy may be amended. The applicable version is the one published on the website on the date of your request.