Privacy notice

27 October 2026 · IP-privacy-2026-10-27-1

Lewis Knight, trading as Instapic Photo Booth & Events, is responsible for how the business uses your information. We use it to answer enquiries, organise your event and keep an accurate record of your booking and payments. Contact info@instapicphotobooth.co.uk about your information. Business correspondence: 29 Cadwell Walk, Gorebridge, Midlothian, EH23 4LF; correspondence only, no visits or collections.

We receive information from you, a person organising the event for you, and the payment or email providers that report transaction and delivery results. We use contact details, event date, venue, products, options and messages to manage the enquiry and booking. We also keep your agreed quote and terms, booking changes, payment amounts and references, selected payment arrangement and any refund or dispute records. Sign-in and security records may include your device/browser information and IP address. Email delivery records tell us whether essential booking emails were sent, delivered or rejected.

Where you are our customer, we use this information to take steps you request before booking and to provide the agreed service. For a contact acting for a company or another organiser, we use the necessary contact and event information for our legitimate interests in communicating with the organiser and delivering the booking. We keep necessary accounting records to meet legal obligations. We also use limited security and audit information for our legitimate interests in protecting accounts, preventing duplicate payments, resolving problems and keeping reliable records. Optional marketing and separate promotional use of photographs are not authorised simply by accepting a booking. The event-gallery arrangements are described separately below. For guests using the booth or mirror, our legitimate interests are providing the requested event photography, prints and controlled gallery access. We give guests information before use and consider privacy concerns or objections. Public promotional use is separate.

The Hub uses Vercel for hosting, Neon for its booking database and Resend for booking and sign-in emails. We use Google Workspace for the business inbox. Stripe handles online checkout; PayPal or Klarna may also process information when you choose an available method. The Hub records payment references and results, not your full card number or security code. Payment providers also use information for their own payment, fraud-prevention, legal-compliance and, where relevant, credit decisions. Their own notices explain this processing and retention: Stripe, PayPal and Klarna. We do not decide whether a finance provider grants credit.

Only authorised people working on your booking receive the details they need. We may also disclose information where needed for professional advice, a legal obligation or a properly handled claim.

Booking diary

We use Google Calendar and Apple Calendar/iCloud to organise confirmed bookings and allocate work to our event staff. Diary entries contain the customer name, email enquiry source label, event date, venue, booked services and an optional customer contact phone number. The notes field contains only that phone number, when supplied. Staff receive the event details needed for their assignment. We do not include payment history, private account links or internal customer notes in automated diary entries.

The Hub's Google connection creates a separate business calendar and adds each newly confirmed booking once. It stores the new calendar and event identifiers, a private creation marker and delivery status so it can check delivery without creating duplicates. Its access is limited to calendars created through this connection; it does not read existing Google calendars or iCloud staff calendars. Lewis and Shannon manage timings and staff allocation in Apple Calendar after the entry is added. Calendar information is used for this booking-diary feature, not advertising or customer finance decisions. Any new purpose or broader Google access will be explained and authorised before it is introduced.

Event photographs and galleries

Photo booth and magic mirror bookings normally include prints on the night unless otherwise agreed. Event photographs are also supplied through Pixieset, linked from the client-gallery area of our website. The Booking Hub does not itself store the gallery photographs.

New event galleries use a viewing password. The gallery contents can be opened by people who have that password. A genuine event photograph is used as the public cover on our gallery homepage, where the title may also be visible. The remaining photographs require the viewing password. Identifiable images selected for public promotion follow the separate permission policy below. Downloads have separate controls; a download PIN alone is not viewing protection. Someone with access may still make a screenshot or share an image or password. Existing galleries may retain their earlier viewing arrangements; contact us about an image or privacy concern.

The gallery is available for at least one year. We may retain gallery copies and backup photographs on our Mac for longer to help customers who later request older images, while storage allows and retention remains appropriate. Availability after the first year is not guaranteed. Please download and keep your own copies. The one-year access promise does not mean all copies are automatically deleted at that point. Contact info@instapicphotobooth.co.uk about an image or a privacy concern. Pixieset describes its own platform processing in its privacy policy.

Photographs used for promotion

We may use selected photographs taken at events, including our equipment and setups, on our website, social media and other promotional materials. Where people are identifiable, we will obtain their separate permission before using those photographs for marketing. For identifiable children, we will seek permission from a parent or guardian and respect the child’s wishes.

Marketing permission is optional and does not affect your booking. Accepting these terms does not give permission on behalf of all guests. Permission can be withdrawn by emailing info@instapicphotobooth.co.uk; we will stop future use and remove the relevant photographs from online marketing we control.

We keep a record of permission and any withdrawal so that we can respect your choice. This marketing policy is separate from the event gallery’s viewing arrangements.

Where information is processed

The booking database is hosted in London. Some of the services supporting the Hub, emails, payments and galleries also process information outside the UK, including in the United States, the European Economic Area and Canada. Selecting a London database does not keep every part of those services in the UK.

The providers’ published data-processing terms describe international-transfer protections, including recognised adequacy arrangements and contractual safeguards where applicable. Vercel, Resend and the database provider’s terms include UK transfer provisions. Pixieset’s published terms describe international processing and transfer safeguards; its current onward-processing details are available from Pixieset. Payment providers also explain their own processing in the notices linked above. You can contact info@instapicphotobooth.co.uk for details of the safeguards applying to your information and how to obtain a copy.

Keeping your information

We keep information needed to manage active enquiries and bookings, meet accounting obligations and resolve complaints or claims. Necessary sole-trader accounting records are normally kept for at least five years after the relevant 31 January tax-return deadline; a longer period may apply to a late return, tax enquiry or unresolved claim. This does not mean every message, security log or photograph is an accounting record.

We consider whether an enquiry is still active, whether information is needed to explain an agreed booking or transaction, and whether a specific legal or security issue remains unresolved. Our review policy is to review unsuccessful enquiries after 12 months without customer contact, and routine security and email-delivery records after 90 days, retaining records still needed for an active issue or required financial/contract evidence. Older photo sets are reviewed annually after their first year, considering their continuing customer-retrieval purpose and privacy needs; public display and private backups are assessed separately. These are review points, not a promise that every copy is deleted on that date. Supplier-held records have their own retention arrangements.

Sign-in and cookies

The Hub uses essential cookies to sign you in and protect your account. Sign-in links expire after 15 minutes and can be used once. Normal account sessions last up to 12 hours and may refresh while used. The optional owner “Keep me signed in” setting has a fixed 30-day limit or ends when signed out. The Hub currently has no advertising or analytics integration. Payment providers' separate checkout pages use their own technologies.

Your choices and rights

You may ask to access or correct your information, and you may have rights to deletion, restriction or a portable copy depending on the circumstances. You can object to processing based on our legitimate interests. Where we rely on consent, you can withdraw it. Some records must be retained despite a deletion request. Contact us using the email above; you can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint.

We need the booking and contact information requested to arrange and provide your event. If you do not supply essential details, we may be unable to prepare the quote or booking. You can update incorrect details by contacting us. We will update this notice when our use of information materially changes.