PRIVACY POLICY

This Privacy Policy applies to personal information we collect:

• directly from you;

• automatically when you use our website, where applicable;

• when you use a Photomatica booth;

• when you request delivery of digital photos by email;

• when you pay for analog photo strip scanning services;

• when we provide event photography or photo booth services to a host or organizer; and

• when you communicate with us.

This Privacy Policy does not apply to third-party websites, payment processors, venue operators, or other third parties that may have their own privacy notices and practices.

Applicability. Photomatica has elected to proceed on a conservative basis as if certain state privacy laws, including the CCPA/CPRA and other state privacy laws, may apply to it, without making or implying any determination that those laws definitively apply to Photomatica. Certain rights and processes described in this Privacy Policy, including the state-specific privacy rights and opt-out preference signal mechanisms described in Sections 9 and 10, are provided only to the extent the corresponding state privacy law applies to Photomatica. Where a particular law does not apply to Photomatica, any related rights or processes described here are offered as a matter of policy and do not reflect a determination that the law applies. Photomatica will comply with each applicable privacy law to the extent it is subject to that law.

Notice at Collection. At or before the point of collection, Photomatica provides consumers with a notice describing the categories of personal information collected, the purposes for which it will be used, whether email addresses may be disclosed to venues or brand clients for their own marketing or promotional purposes, the retention period, and a reference to this Privacy Policy and consumer rights. These notices, together with this Privacy Policy, constitute Photomatica’s notice at collection under applicable privacy law.

The categories of personal information we collect depend on how you interact with us.

A. Information Collected Through Photo Booth Sessions

When you use one of our photo booths, we may collect:

• Photographs and image files created during the session. Booths that do not collect email addresses display a printed privacy notice on the booth.

• Transaction information related to the purchase of a booth session, where applicable, including information submitted in connection with a refund request (such as booth location and the last four digits of the customer's credit card or Apple Pay ID number, as submitted by the customer for transaction matching purposes);

• Venue and session details, such as booth location, date, and time of use (applicable to digital booth sessions; analog booths do not capture this information); and

• Email address, but only if you voluntarily provide it to receive your photos. Photomatica may use these email addresses for its own purposes, including photo delivery and marketing where permitted by law. Where a booth is hosted at a venue or operated as part of a branded activation or brand buyout, and where the applicable venue or brand client has opted into Photomatica's email sharing, your email address may also be disclosed to the venue or sponsoring brand client, consistent with the notice provided at the time of collection. Customers may enter their email or skip.

B. Information Collected for Analog Photo Strip Scanning Services

At certain museum-style or similar locations, customers may pay to have analog photo strips scanned. In connection with those services, we may collect:

• Scanned image files;

• Email address used to send the scans. Scan-station email addresses are currently used only by Photomatica and are not disclosed to venues or brand clients. If Photomatica enables its email sharing for scan stations in the future-for example, where a scan station is operated at a venue or as part of a branded activation or buyout-scan-station email addresses may be disclosed to the applicable venue or brand client for their own marketing purposes, but only where that party has opted into email sharing and consistent with the notice provided at the time of collection;

• Transaction information related to the scan purchase; and

• Storage-related metadata associated with delivery and storage of scans.

C. Information Collected for Event Services

When Photomatica provides services for weddings, birthdays, corporate activations, and similar events, we may collect:

• Photographs and image files created during the event;

• Email addresses of event hosts or clients for service coordination and communication. Event rentals do not involve the collection of guest or attendee email addresses at the booth. In private event buyout or branded activation contexts, guest email addresses may be submitted at the booth to facilitate digital photo delivery and, where applicable and disclosed at the point of collection, to send marketing communications from Photomatica and, where the buyout or activation includes email sharing, from the venue and/or sponsoring brand client; in those contexts, guest email addresses may be disclosed to the venue and/or sponsoring brand client consistent with the notice provided at collection;

• Event host or client contact details;

• Event-related logistical information needed to perform the services; and

• Storage-related metadata associated with the delivery and storage of event photos and galleries.

D. Information Collected Through the Website

When you use our website, we may collect:

• Information you submit directly, such as through contact forms, inquiry forms, booking requests, or other website forms;

• Basic technical and usage information collected automatically through your browser or device, such as IP address, browser type, device information, pages viewed, and approximate geolocation derived from IP address; and

• Cookie and similar technology data, to the extent such technologies are used on the website.

Our website does not currently collect job applications directly.

We collect personal information directly from you, such as email addresses entered at booths for photo delivery (including in branded activation or buyout contexts), event host or client contact details for service coordination, contact forms, event inquiries, photo strip scan requests, refund requests submitted via email or QR code, and direct email communications. We also collect certain information automatically from your use of the website, including device, browser, cookie, and usage information. We may receive information from venue partners or event hosts, including event details, service logistics, and client instructions, and from payment or technology service providers, such as transaction confirmations and delivery and storage support. Where a minor uses our services, we may collect information from a parent or guardian, such as an email address submitted for a minor's photo delivery.

We may use personal information for the following business and commercial purposes:

• to operate, provide, and improve our Services;

• to capture, process, store, and deliver photos;

• to scan analog photo strips and deliver digital scans;

• to send requested photos or scans by email;

• to fulfill event-related services;

• to process or record transactions and to process refund requests submitted via QR code or email;

• to respond to inquiries and customer service requests;

• to maintain and secure our systems and website;

• to detect, investigate, or prevent misuse, fraud, or unlawful activity;

• to comply with legal obligations; and

• where permitted by law, to send promotional or marketing communications from Photomatica and, where applicable, to support marketing by participating venue spaces and, in the context of branded activations or brand buyouts, by the sponsoring brand client; and to use analog photo strips for Photomatica's own promotional and marketing purposes where the customer has provided opt-in consent at the photo strip scan station.

Email addresses provided at a booth or scan station may be used by Photomatica to deliver the requested photo or scan and, where permitted by law, for Photomatica's own marketing communications, as further described in Sections 2, 4, 5, and 6. Email addresses collected at scan stations are currently used only by Photomatica and are not disclosed to venues or brand clients; if Photomatica enables its email sharing for scan stations in the future, scan-station email addresses may be disclosed to a participating venue or brand client for that party's own marketing purposes, but only where the party has opted into email sharing and consistent with the notice provided at collection. Customers may opt out of Photomatica's own marketing emails at any time by using the unsubscribe link in any marketing email or by contacting us at privacy@photomatica.com. Separately, and as described in Section 10, customers may opt out of the disclosure of their email address to venues and brand clients for those parties' own marketing purposes.

Where a customer has provided explicit opt-in consent at the point of service, Photomatica may use the customer's analog photo strip for its own promotional and marketing purposes, including on social media, its website, and in advertising or promotional materials. Photomatica will not use photographs of identifiable minors for such purposes without the prior express consent of a parent or legal guardian. For information on retention, storage, and consent withdrawal applicable to photo strips used for promotional purposes, see Section 7.

Photomatica will not use photographs from private events (including weddings, corporate events, and similar occasions) for its own promotional or marketing purposes unless the parties subsequently execute a separate consent agreement for such use. If a client, event organizer, or brand sponsor uses event photos for marketing, promotional, or other public-facing purposes, that party is solely responsible for obtaining any permissions or consents required and for compliance with applicable law.

We may disclose personal information to several categories of recipients for the following purposes. Email addresses may be disclosed to venue spaces hosting our experiences and, in branded activation or buyout contexts, to sponsoring brand clients, but only where the applicable venue or brand client has opted into Photomatica's email sharing; such disclosure is limited to email addresses only and is consistent with the notice provided at collection. Email addresses collected at scanning stations are currently used only by Photomatica and are not disclosed to venues or brand clients; if Photomatica enables its email sharing for scan stations in the future, scan-station email addresses may be disclosed to participating venues or, in branded activation or buyout contexts, sponsoring brand clients for their own marketing purposes on the same opt-in and notice-at-collection basis described above. Email addresses, delivery information, and related engagement data may be disclosed to Photomatica’s internal marketing systems and email platforms for photo delivery, list management, and marketing administration. Email addresses, photographs, photo strip scans, transaction-related data, and website data may be disclosed to service providers for email delivery, cloud storage, hosting, IT support, website functionality, security, and operations. Event photos and related deliverables may be disclosed to event clients or hosts for performance of contracted event services. Scanned images and related metadata may be disclosed to cloud storage providers for storage and fulfillment of analog photo strip scanning services. We may also disclose relevant information to professional advisors, legal authorities, and transaction counterparties in connection with legal compliance, dispute resolution, protection of rights, and business transactions.

Categories Disclosed for Business Purposes. In the preceding 12 months, Photomatica has disclosed the following categories of personal information to service providers and contractors for business purposes: identifiers, commercial information, visual information, internet or other electronic network activity information, and approximate geolocation or other location-related information, where applicable. If Photomatica has not disclosed a category of personal information for a business purpose in the preceding 12 months, that category is not listed above.

Categories Sold or Shared. Photomatica does not disclose personal information for cross-context behavioral advertising or targeted advertising. To the extent the disclosure of email addresses to participating venues and, in branded activation or buyout contexts, sponsoring brand clients for their own marketing purposes is treated as a "sale" under applicable state privacy law, the only category of personal information involved is identifiers (specifically, email addresses), and the only categories of third parties to whom that information is disclosed are participating venues and sponsoring brand clients. Photomatica does not sell or share the personal information of consumers it knows to be under 16 years of age.

Sensitive and Biometric Data. Photomatica does not sell sensitive personal data or biometric data, and does not process personal data to infer sensitive characteristics. Photographs captured in our booths are not processed to uniquely identify an individual and are therefore not "biometric data" under the Texas Data Privacy and Security Act or similar state laws. Accordingly, the specific notices required under Texas law for the sale of sensitive or biometric personal data do not apply to Photomatica. Photomatica does not use or disclose sensitive personal information for purposes that would require a right to limit under California law. Where Photomatica collects any data that may be considered sensitive under applicable law, it does so only as necessary to provide the Services and in accordance with applicable consent requirements.

When an adult submits an email address, Photomatica may use it to send the requested photo or scan, confirm or administer the transaction, include the address in Photomatica's marketing email systems, and, where the applicable venue or brand client has opted into Photomatica's email sharing, disclose it to the associated venue space and, where applicable, the sponsoring brand client, consistent with the notice provided at collection. Each initial delivery email will identify that it was sent because the customer requested photos or scans from a Photomatica photo booth and will include a reference to this Privacy Policy. Each marketing email will include an unsubscribe link or other simple mechanism to opt out of Photomatica's marketing communications. For further detail on how email addresses are collected and used, see Sections 2, 4, and 5.

We retain personal information for only as long as reasonably necessary for the purposes described in this Privacy Policy, unless a longer period is required or permitted by law.

Digital photo booth photographs are retained for 24 hours after capture, unless a shorter period applies or longer retention is reasonably necessary for troubleshooting, legal compliance, or dispute resolution.

Email addresses collected at booths or scan stations are retained in Photomatica's marketing systems and email platforms for as long as the individual remains an active subscriber or until a valid opt-out or deletion request is received and processed. Following receipt of a valid opt-out request, the email address will be suppressed from active marketing use within fifteen (15) business days. Following receipt of a verified deletion request, the email address will be deleted from active systems within forty-five (45) calendar days, subject to any applicable legal hold or compliance exception. A suppression record may be retained for a reasonable period to prevent inadvertent re-subscription.

Analog photo strip scan files are retained for a period of up to ninety (90) days following delivery of the scans to the customer, after which they are deleted or de-identified, unless longer retention is required for dispute resolution, legal compliance, or at the customer's request. Scan files stored with third-party cloud storage providers are subject to Photomatica's deletion instructions and those providers' applicable data handling practices.

Where a customer has provided opt-in consent at the analog photo strip scan station for Photomatica to use their photo strip for promotional or marketing purposes, the photo strip will be retained in Photomatica's marketing folder for as long as the consent remains in effect, or for a maximum of three (3) years from the date of consent, whichever is earlier. Upon receipt of a verified consent withdrawal request, the photo strip will be removed from the marketing folder within forty-five (45) calendar days and will not be used for promotional purposes going forward. A record of the consent and its withdrawal may be retained for a reasonable period for compliance and recordkeeping purposes.

Event photos and related deliverables are retained and made available to the client, event organizer, or brand sponsor for an access or claim period of up to [__] days following delivery of the final event gallery or completion of the applicable event services, unless the applicable event services agreement specifies a different period or longer retention is required for legal compliance or dispute resolution. After the access or claim period, Photomatica may permanently delete event photos and related deliverables and has no obligation to restore them or provide additional copies. Once event photos are delivered or made accessible to the client, event organizer, or brand sponsor, that party is responsible for its own use, storage, retention, disclosure, and legal compliance with respect to those photos.

Website inquiry data, including contact form submissions and booking inquiries, is retained for up to two (2) years from the date of submission to support ongoing communications, operations, and recordkeeping, unless a shorter period is appropriate given the nature of the inquiry or a valid deletion request is received.

Transaction records retained by Photomatica are limited to transaction date, time, and location information, and, in connection with refund requests, the last four digits of the customer's credit card or Apple Pay ID number as submitted by the customer for transaction matching purposes. Photomatica does not have visibility into or control over customers' full credit card or payment account data, which is held solely by Photomatica's third-party payment processor. Transaction data processed by the payment processor is subject to that processor's own data retention practices, over which Photomatica does not exercise control. Photomatica retains its own transaction records in accordance with operational needs, including accounting, refunds, disputes, tax, and legal compliance.

Photomatica’s website may use cookies, local storage, analytics tools, and similar technologies to:

• keep the website functioning;

• understand site traffic and user interactions;

• improve website performance and user experience; and

• support basic website analytics and performance monitoring.

You may be able to control cookies through your browser settings.

The website currently uses only first-party functional and analytics cookies and similar technologies. It does not use third-party advertising, retargeting, or cross-context behavioral advertising cookies or pixels.

Do Not Track. Some web browsers transmit "Do Not Track" (DNT) signals to the websites you visit. Because no common industry or legal standard for recognizing or honoring DNT signals has been finalized, Photomatica does not currently respond to DNT signals. This DNT disclosure is separate from, and does not address, opt-out preference signals such as the Global Privacy Control, which are described in Section 10. Photomatica will continue to monitor developments and may update this Privacy Policy if a uniform standard is adopted.

If you are a California resident, you have the following rights under California privacy law, subject to applicable exceptions and verification requirements:

• the right to know the categories of personal information we collected about you;

• the right to know the categories of sources from which the information was collected;

• the right to know the business or commercial purposes for collecting, using, disclosing, selling, or sharing personal information;

• the right to know the categories of third parties to whom personal information was disclosed;

• the right to access the specific pieces of personal information we hold about you and to obtain a copy of that information in a portable and, to the extent technically feasible, readily usable format, in certain circumstances;

• the right to delete personal information, subject to exceptions;

• the right to correct inaccurate personal information, as applicable;

• the right to opt out of the sale or sharing of personal information, if applicable (as further described in Section 10);

• the right to limit the use and disclosure of sensitive personal information, where applicable; and

• the right not to receive discriminatory treatment for exercising your privacy rights.

When submitting a privacy rights request, please include your name, the email address or phone number associated with your Photomatica interaction, your state of residence, and the type of request. When submitting by email, please include “Privacy Rights Request” or “Opt-Out Request” in the subject line to help us route your request efficiently; this is a suggestion and not a condition of submission. We may need to verify your identity before processing requests to know, delete, or correct; opt-out requests do not require identity verification. We will confirm receipt of requests to know, delete, or correct within ten (10) business days and provide a substantive response within forty-five (45) calendar days, subject to a permitted extension with notice. For opt-out request processing timelines and related details, see Section 10. An authorized agent may submit requests on your behalf with written authorization signed by you or a valid power of attorney.

How to Exercise California Privacy Rights

To submit a privacy request, contact us at:

• Email: privacy@photomatica.com

• Mail: 50 Otis Street, San Francisco, CA 94103

• Web Form: www.photomatica.com/privacy or via the "Your Privacy Choices" link in the website footer.

• Toll-Free Number: (800) 268-0415

For details on identity verification requirements, response timelines, and the use of authorized agents, see Section 9 above.

Photomatica does not sell or share personal information through third-party advertising, retargeting, or cross-context behavioral advertising pixels on its website. However, Photomatica may disclose email addresses collected through certain photo booth and scan station experiences to participating venues or, in branded activation or buyout contexts, sponsoring brand clients for their own marketing purposes, but only where the applicable venue or brand client has opted into Photomatica's email sharing, consistent with the notice provided at collection. This disclosure is limited to email addresses; photographs, session data, and other personal information are not disclosed to venue partners or brand clients for their own marketing or promotional purposes. To the extent applicable privacy law treats this email disclosure as a "sale" of personal information, consumers may opt out of this disclosure at any time using the methods below.

To the extent a state privacy law applies to Photomatica, the disclosure of email addresses to venues and brand clients for their own marketing purposes may constitute a "sale" of personal information under that law, even where no money is exchanged; it is not a disclosure for cross-context behavioral advertising. To the extent applicable, California residents, and residents of Colorado, Connecticut, Virginia, Texas, and certain other states, have the right to opt out of this disclosure at any time using the methods described below. Because Photomatica's website does not sell or share personal information online and does not use third-party advertising or retargeting pixels, there is currently no online sale or sharing activity for an opt-out preference signal, such as the Global Privacy Control (GPC), to act upon at the website level. The opt-out methods described below are the means by which consumers may opt out of venue and brand email disclosures for marketing purposes. If Photomatica's website data practices change, or if applicable law otherwise requires recognition of opt-out preference signals, Photomatica will treat a recognized signal as a valid request to opt out of the sale or sharing of personal information and will update this Privacy Policy and its processes accordingly.

To opt out of the sale or disclosure of your email address to venues and brand clients for marketing purposes:

• click the "Your Privacy Choices" link in the footer of our website, which will direct you to our privacy request mechanism; or

• contact us by email at privacy@photomatica.com or by mail at 50 Otis Street, San Francisco, CA 94103.

Once we receive your opt-out request, we will process it as soon as reasonably possible and no later than fifteen (15) business days from receipt, and in any event no later than required by applicable law. We will stop disclosing your email address to venue partners and brand clients for their own marketing purposes going forward, and we will honor your opt-out preference for at least twelve (12) months before seeking reconfirmation. An opt-out request does not affect our ability to use your email address solely to deliver the photo or photo strip scan you requested. We maintain records of privacy rights requests for a minimum of twenty-four (24) months, including the date and method of receipt, the nature of the request, the date of response, and the nature of the response.

Other State Privacy Rights. Residents of Texas, Colorado, Connecticut, Virginia, and other states with comprehensive privacy laws may, to the extent those laws apply to Photomatica, have the right to: (i) confirm whether Photomatica is processing their personal data and access that data; (ii) correct inaccuracies in their personal data, taking into account the nature of the data and the purposes of processing; (iii) delete personal data provided by or obtained about them; (iv) obtain a copy of their personal data in a portable and, to the extent technically feasible, readily usable format; and (v) opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects. As described in Sections 8 and 10, Photomatica does not engage in targeted advertising, the sale of personal data through online tracking, or such profiling; the relevant opt-out is the opt-out of the offline sharing of email addresses for marketing purposes, which may constitute a "sale" under certain state laws. Such residents may submit requests using the methods described in Sections 9 and 10 above. Photomatica provides more than one secure and reliable method for submitting requests and will respond within the time period required by the applicable state law, generally within forty-five (45) days of receipt, subject to any extension permitted by law.

Appeals. If Photomatica declines to take action on your privacy rights request, we will notify you of the reasons for the decision without undue delay. Where the applicable state privacy law provides a right to appeal (including in Texas, Colorado, Connecticut, and Virginia), you may appeal our decision within a reasonable period by contacting us at privacy@photomatica.com with "Privacy Rights Appeal" in the subject line, or by mail at 50 Otis Street, San Francisco, CA 94103. We will respond to your appeal in writing within sixty (60) days of receipt (or such other period required by applicable law) and will explain the reasons for our decision. If your appeal is denied, you may submit a complaint to the attorney general or other applicable regulatory authority in your state; Texas residents may contact the Office of the Texas Attorney General.

Photomatica’s services are offered to adults age 18 and older for direct participation involving email submission and related contact collection.

At the same time:

• minors may appear in photographs or use the physical booth experience; a privacy notice is displayed at the booth describing how photographs are collected and used, and photographs of minors are subject to the retention and deletion practices described in Section 7;

• a minor under 18 may receive the benefit of a photo delivery only through a parent or legal guardian’s email submission; and

• Photomatica does not intend for minors under 18 to submit email addresses or other direct contact information on their own.

Photomatica's website and online services are not directed at children under 13, and Photomatica does not knowingly collect personal information directly from children under 13. Consistent with this Privacy Policy, individuals between the ages of 13 and 17 are also not intended to submit email addresses or other direct contact information on their own, and a parent or legal guardian should do so on their behalf. A parent or legal guardian may contact us using the information in Section 16 to request deletion of a minor's personal information collected in connection with our services. If you believe a child under 13 provided personal information directly to Photomatica without appropriate parental involvement, please contact us and we will take appropriate steps to review and delete the information as required.

We use reasonable administrative, technical, and physical safeguards designed to protect personal information from unauthorized access, use, alteration, or disclosure. However, no system or method of transmission over the internet is completely secure, and we cannot guarantee absolute security.

Certain functions may be provided by third parties, including:

• payment processors;

• cloud storage providers;

• email delivery vendors;

• website hosting or analytics providers; and

• Google Drive or similar storage tools for photo strip scan-related files.

Those third parties may process personal information on our behalf or under their own privacy terms, depending on the service and relationship. Photomatica currently uses Cantaloupe, Inc. as its cashless payment technology provider. Photomatica does not have access to or visibility into customers' full credit card or payment account data, which is held solely by Cantaloupe. Cantaloupe's privacy policy, which governs Cantaloupe's collection, use, and retention of payment data, is available at https://www.cantaloupe.com/legal/cantaloupe-privacy-policy/. Photomatica may update its payment technology provider from time to time, and this Privacy Policy will be updated accordingly. To process a refund, Photomatica asks the customer to provide the last four digits of the credit card or Apple Pay account used for the transaction; Photomatica matches those digits against the transaction date, time, and location on file to identify and process the applicable refund. Refund requests are submitted by customers via QR code or email, and refund-related communications are handled by email.

Photomatica operates at venues and also provides services for private and hosted events. In those contexts:

• a venue or event host may receive access to photo-related deliverables or email addresses and delivery information;

• the venue or host may have its own privacy practices and notices; and

• individuals should review any venue- or event-specific disclosures provided at the point of collection. When Photomatica provides services at a private event, the event host or organizer is expected to ensure that guests are aware that a photo booth service will be present and that photographs and, where applicable, email addresses may be collected. A privacy notice will be displayed at the booth describing how information is collected and used.

Where a booth is deployed for a branded activation or hosted event, Photomatica may process data under instructions from the venue, brand partner, or event client, subject to Photomatica’s own legal obligations. In brand buyout contexts, email addresses collected at the booth may be shared with the sponsoring brand client consistent with the notice provided at the time of collection. For information on restrictions applicable to the use of photographs from private events for promotional or marketing purposes, see Section 4.

We may update this Privacy Policy from time to time. When we do, we will post the updated version on the website and revise the Last Updated date above. For material changes, we will provide at least thirty (30) days' advance notice by posting the updated policy with a future effective date, by email where we have a current email address on file, or by other reasonable means. Non-material changes will become effective upon posting.

If you have questions about this Privacy Policy or want to exercise privacy rights, please contact:

Photomatica Photo Booth Corporation 50 Otis Street San Francisco, CA 94103

Email: privacy@photomatica.com  

Website: www.photomatica.com/privacy