Privacy Policy

1 Introduction & Scope

This Privacy Policy explains how Studio Photuna ("we," "us," or "our") collects, uses, stores, shares, and protects your personal data when you use our Korean-style photobooth business software platform, including our website, desktop application, event services, and any related tools or features (collectively, the "Service").

This Policy applies to all users of the Service, including registered photobooth operators, their staff, event guests whose photos are captured, and general website visitors. By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy.

This Privacy Policy is drafted in compliance with Republic Act No. 10173 (the Data Privacy Act of 2012) and its Implementing Rules and Regulations, the General Data Protection Regulation (GDPR) (EU Regulation 2016/679), and the UK General Data Protection Regulation (UK GDPR) as retained and amended under the UK Data Protection Act 2018, in each case where applicable to you.

2 Our Role as Data Controller and Processor

Studio Photuna plays different legal roles depending on what data is involved. Understanding this distinction matters because it determines who you should contact first, and who is legally responsible for what.

• We are the Data Controller for: your operator account information (name, email address, billing details, and usage data), general website visitor data, and any support enquiries you send us. We decide why and how this data is processed, and this Privacy Policy governs it directly.
• We are a Data Processor for: guest photographs and event session data captured through the photo booth. This data is processed strictly on the instructions of the booth operator who ran the event, under the Data Processing Agreement set out in our Operator Agreement.
• Booth operators are the Data Controllers for their guests' photos and event data. If you are a business running a Studio Photuna–powered photo booth at your event, you decide why photos are taken and how they are used, and you are legally responsible for that decision. We simply process the data on your behalf and under your instructions.

In practice, this means booth guests should generally raise questions about a specific event or photo session with the operator who ran that event first, though we also provide a direct route to us — see Section 10 and Section 11 below.

3 Data Controller Information

The personal information controller (as defined under RA 10173) and data controller (as defined under the GDPR and UK GDPR) responsible for the processing described in Section 2 above is:

Studio Photuna
Email: support@studiophotuna.com
Address: [INSERT REGISTERED BUSINESS ADDRESS]

For all data protection inquiries, you may contact our Data Protection Officer at dpo@studiophotuna.com.

4 What Personal Data We Collect

We collect the following categories of personal data depending on how you interact with the Service:

• Account Information: Full name, email address, phone number, company or business name, profile avatar, and login credentials when you register for an operator account.
• Event & Booking Data: Event names, dates, venues, client details, booking configurations, template selections, and event-specific settings.
• Photos & Media: Guest photographs, photostrip compositions, individual portrait crops, and any digital media captured or uploaded through the photobooth system during events.
• Payment Information: Billing details, subscription plan selections, transaction records, payment reference numbers, and payment confirmation data. We do not directly store full payment card numbers.
• Device & Usage Data: IP addresses, browser type and version, operating system, device identifiers, access timestamps, pages visited, features used, and general usage analytics.
• Cookies & Similar Technologies: Session identifiers, preference cookies, and analytics tracking data as further described in Section 12 of this Policy.

Some of this data is mandatory and some is voluntary. Providing your name and email address is required to create an operator account — without it, we cannot provide the Service to you. Providing a valid payment method is required to access paid subscription tiers. Guest photo capture, by contrast, is entirely voluntary: guests who prefer not to be photographed may decline on the booth consent screen and will not be photographed or otherwise processed.

5 How We Use Your Data

We process your personal data for the following purposes:

• Service Delivery: To provide, operate, and maintain the photobooth software platform, including event setup, photo capture, printing, QR sharing, and digital gallery access.
• Billing & Subscriptions: To process payments, manage subscription plans, generate invoices, issue license confirmations, and handle refund or dispute requests.
• Communication: To send transactional emails such as booking approvals, account notifications, password recovery, subscription alerts, and support responses via notification@studiophotuna.com.
• Legal Compliance: To comply with applicable laws, regulations, and legal processes, including tax reporting under the Bureau of Internal Revenue (BIR) and responding to lawful government requests.
• Service Improvement: To analyze usage patterns, diagnose technical issues, improve platform features, and develop new functionalities based on aggregated and anonymized insights.

6 Legal Bases for Processing

Under RA 10173 (Data Privacy Act of 2012):

• Consent: Where you have given clear and voluntary consent for the processing of your personal data for one or more specific purposes (Section 12(a), RA 10173).
• Fulfillment of Contract: Where processing is necessary for the performance of a contract to which you are a party, or in order to take steps at your request prior to entering into a contract (Section 12(b), RA 10173).
• Legitimate Interest: Where processing is necessary for our legitimate interests or those of a third party, provided that such interests are not overridden by your fundamental rights and freedoms (Section 12(f), RA 10173).
• Legal Obligation: Where processing is necessary for compliance with a legal obligation to which we are subject, including BIR tax regulations and NPC compliance requirements (Section 12(c), RA 10173).

Under the GDPR and UK GDPR (where applicable):

• Consent (Article 6(1)(a)): Where you have given explicit consent to the processing of your personal data.
• Performance of a Contract (Article 6(1)(b)): Where processing is necessary for the performance of our service agreement with you.
• Legitimate Interests (Article 6(1)(f)): Where processing is necessary for our legitimate business interests, such as fraud prevention and service improvement, balanced against your rights.
• Legal Obligation (Article 6(1)(c)): Where processing is required to comply with EU, UK, or Member State law.

7 Data Sharing & Third Parties

We do not sell your personal data. We may share your data with the following third-party service providers (sub-processors) who assist us in operating the Service, each acting as a data processor on our behalf:

• Supabase, Inc. (United States) — Provides our database infrastructure, user authentication, and file storage. Data is secured through row-level security policies and encryption at rest.
• Vercel, Inc. (United States) — Provides web hosting, edge delivery, and serverless function infrastructure for the Studio Photuna platform.
• Stripe, Inc. (United States) — Processes subscription billing and payment card transactions for Studio Photuna software plans.
• PayMongo (Philippines) — Processes card and e-wallet payments for event booking deposits.
• PayPal (United States) — Processes international payments for event booking deposits.
• Xendit (Southeast Asia) — Processes payments for event booking deposits.
• GCash (Mynt — Globe Fintech Innovations, Inc.) (Philippines) — Processes local e-wallet payments for event booking deposits.
• Google Fonts (Google LLC) — Delivers web fonts used on our platform. Your browser may send requests to Google servers, which may include your IP address.

We require all third-party processors to maintain appropriate security measures and to process personal data only in accordance with our documented instructions and applicable data protection laws. As Studio Photuna grows into new markets, we may engage additional regional payment processors or infrastructure providers. This list is kept current — any material addition will be reflected here with an updated "Last Updated" date, and operators will also be notified in accordance with the sub-processor notice provisions in our Operator Agreement.

8 Cross-Border Data Transfers

Some of our third-party service providers are located outside the Philippines, particularly in the United States. When your personal data is transferred outside the Philippines, we ensure that adequate safeguards are in place in accordance with the requirements of the National Privacy Commission (NPC) and RA 10173.

For transfers of personal data from the European Economic Area (EEA), we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms recognized under the GDPR (Article 46), to ensure an adequate level of data protection.

For transfers of personal data from the United Kingdom, we rely on the UK's International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, issued by the Information Commissioner's Office under Section 119A of the UK Data Protection Act 2018.

We continuously monitor NPC advisories, EU and UK guidance, and other applicable circulars on cross-border data transfers to ensure ongoing compliance.

9 Data Retention Periods

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law. Our specific retention periods are as follows:

• Account Data: Retained for the duration of your active account plus 5 years after account closure or last activity, to comply with regulatory and legal obligations.
• Event Photos & Session Data: Guest photostrips and associated session data are retained for a period that depends on the operator's subscription plan at the time of the event, set out in the table below.
• Payment & Transaction Records: Retained for 10 years from the date of the transaction, in accordance with Bureau of Internal Revenue (BIR) record-keeping requirements and applicable tax regulations.
• Cookies & Tracking Data: Retained in accordance with the durations specified in our Cookie Policy (see Section 12).

Your specific retention period is disclosed on the consent screen shown at the booth before your session begins. After the applicable retention period, photos and session data are permanently and irreversibly deleted from our servers. Once any retention period expires, personal data is securely deleted or anonymized so that it can no longer be associated with you.

10 Your Rights Under RA 10173

As a data subject under the Data Privacy Act of 2012, you have the following rights:

• Right to Be Informed: You have the right to be informed of the collection and processing of your personal data, including the purpose, scope, and method of processing.
• Right to Access: You have the right to obtain a copy of your personal data that we hold, along with information about how it has been used or disclosed.
• Right to Object: You have the right to object to the processing of your personal data, including processing for direct marketing, automated processing, or profiling.
• Right to Erasure or Blocking: You have the right to request the suspension, withdrawal, blocking, removal, or destruction of your personal data from our systems.
• Right to Damages: You have the right to be indemnified for any damages sustained due to inaccurate, incomplete, outdated, false, unlawfully obtained, or unauthorized use of your personal data.
• Right to Data Portability: You have the right to obtain your personal data in a structured, commonly used, and machine-readable format, and to have it transmitted to another data controller where technically feasible.
• Right to File a Complaint: You have the right to lodge a complaint before the National Privacy Commission (NPC) if you believe your data privacy rights have been violated.

To exercise any of these rights, please contact us at dpo@studiophotuna.com. We will respond to your request within 30 days, or as required by applicable law.

11 Your Rights Under GDPR and UK GDPR

If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following additional rights. References to "GDPR" and article numbers below apply equally to the UK GDPR as retained and amended under the UK Data Protection Act 2018, unless the context requires otherwise:

• Right of Access (Article 15): The right to obtain confirmation of whether your personal data is being processed and to access that data.
• Right to Rectification (Article 16): The right to request correction of inaccurate personal data or completion of incomplete data.
• Right to Erasure (Article 17): The right to request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to Restriction of Processing (Article 18): The right to request that we limit the processing of your personal data under certain circumstances.
• Right to Data Portability (Article 20): The right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
• Right to Object (Article 21): The right to object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent (Article 7(3)): Where we process your personal data based on your consent, you have the right to withdraw that consent at any time by contacting dpo@studiophotuna.com. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• Rights Related to Automated Decision-Making (Article 22): The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects or similarly significantly affects you.

Studio Photuna does not make decisions with legal or similarly significant effects based solely on automated processing, including profiling.

To exercise your GDPR or UK GDPR rights, contact our Data Protection Officer at dpo@studiophotuna.com. We will respond within 30 days of receiving your request. This period may be extended by two further months where necessary, taking into account the complexity and number of requests.

12 Cookies & Tracking Technologies

Our platform uses cookies and similar tracking technologies to enhance your experience, analyze usage, and support core functionality such as authentication and session management. For detailed information about the specific cookies we use, their purposes, durations, and providers, and how to manage your preferences, please see our Cookie Policy.

You can control and manage cookies through your browser settings. Please note that disabling certain cookies may affect the functionality of the Service.

13 Children's Privacy

Operator accounts. The Service is not intended for individuals under the age of 18. We do not knowingly register operator accounts for, or otherwise collect account-level personal data from, children under 18. If we become aware that we have inadvertently done so, we will take immediate steps to delete such data from our systems.

Booth guests. Photo booths operated by our customers may be used at events attended by children under 16. Operators are required by our Operator Agreement to: (a) obtain verifiable parental or guardian consent before allowing minors under 16 to use the booth, and (b) enable the minor-event mode in the dashboard, which adds age-appropriate consent language to the booth consent screen. Studio Photuna does not knowingly process photos of children under 13 without verified parental consent.

If you believe that a child has provided us with personal data without appropriate consent, please contact us at dpo@studiophotuna.com.

14 Data Security Measures

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption: Data is encrypted in transit using TLS/SSL protocols and at rest within our database systems.
• Access Controls: Strict role-based access controls and row-level security policies ensure that personal data is accessible only to authorized personnel and systems.
• Regular Security Audits: We conduct periodic vulnerability assessments and security reviews of our infrastructure, codebase, and third-party integrations.
• Incident Response: We maintain a data breach response plan and will notify affected data subjects and the NPC within the timeframes required by RA 10173 and the GDPR in the event of a personal data breach.

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security but are committed to maintaining industry-standard protections.

15 Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on our website with a revised "Last Updated" date and, where appropriate, by sending a notification to the email address associated with your account.

We encourage you to review this Privacy Policy periodically to stay informed about how we are protecting your personal data. Your continued use of the Service after any changes to this Policy constitutes your acceptance of the updated terms.

16 Data Protection Officer

Our designated Data Protection Officer (DPO) oversees compliance with this Privacy Policy, RA 10173, the GDPR, the UK GDPR, and all applicable data protection regulations. For any questions, concerns, or requests regarding your personal data or this Privacy Policy, please contact:

Data Protection Officer
Studio Photuna
Email: dpo@studiophotuna.com