Privacy policy
Our job is photographing people. Data protection is our raw material, not a formality.
This document explains what we collect, why, and what you can ask of us.
Data controller
Michael Wagner — instabox.lu, 18 rue Prince Henri, L-4929 Käerjeng, Luxembourg. michael@instabox.lu — +352 661 254 125
Questions about your data reach me directly.
1. When you contact us
Our form collects your name, email address, phone number, the type of event and your message.
Why — to reply and prepare your quote. Legal basis — performance of a contract, or pre-contractual steps at your request. How long — as long as it takes to handle your enquiry and support the booking. We don't build a prospect database and we don't keep completed enquiries.
Accounting records and invoices are kept for ten years, as Luxembourg law requires.
We don't sell data and we don't pass any on for advertising.
2. Photos taken at your event
This is the most important part of this document.
When we set up a photobooth, your guests photograph themselves. The images appear on the booth screen, are printed on site if you chose that option, and are sent by email, SMS or QR code to guests who ask for them.
Taking part is voluntary. You get photographed by choosing to stand in front of the booth.
Who decides what. The organiser decides to bring in a photobooth and tells their guests it will be there. We provide the equipment, the on-site host and the image processing.
No facial recognition. Our booths have no face-based identification: no selfie photo search, no face matching, no face database. What gets processed is the image, never the person's identity.
AI processing. Background replacement and AI effects are performed by our photobooth software, Snappic (Algoritmo Software Inc.), and its technical providers. These providers are based outside the European Union. Transfers are covered by the European Commission's Standard Contractual Clauses (Decision 2021/914) and by a data processing agreement with that provider. The competent supervisory authority for that provider is the Irish Data Protection Commission.
The full list of technical providers involved is available on request at michael@instabox.lu.
Online galleries. By default, we don't keep a gallery after the event. If you ask for one, it's password-protected and deleted whenever you ask. Our technical provider may store the images on its own servers for a limited period under its data processing agreement; we can request their deletion.
Want a photo gone? Write to us. We delete it — no justification needed, no discussion.
3. Photos we publish
Some event photographs appear on this site and on our social media, to show our work. They're published with the event organiser's agreement.
If you recognise yourself in a published photo and would rather not: one message to michael@instabox.lu and it comes down. No conditions, no delay.
4. When you visit this site
We use measurement and advertising tools. You choose which via the cookie banner, and you can change your mind any time through "Cookie settings" at the foot of the page.
Tool / What it does / Category
Wix / runs the website / essential
Microsoft Clarity / understand how visitors use the site / analytics
Google Analytics / visitor statistics / analytics
Google Ads / measure our advertising / marketing
Meta (Facebook / Instagram) / measure our advertising / marketing
LinkedIn Insight / measure our B2B advertising / marketing
Essential cookies make the site work. Everything else only fires if you agree. If you decline, the site works exactly the same.
Some of these providers are based in the United States. Transfers rely on the European Commission's Standard Contractual Clauses and on the EU–US Data Privacy Framework.
5. Your rights
The GDPR gives you the right to know what data we hold about you, to correct it, to have it deleted, to restrict its use, to receive it in a readable format, and to object to its processing.
An email to michael@instabox.lu is enough. We reply within a month, usually much sooner. No forms, no registered letters.
If our answer doesn't satisfy you, you can contact the Commission nationale pour la protection des données (CNPD), 15 boulevard du Jazz, L-4370 Belvaux — cnpd.lu.
But again: talk to us first. It's almost always quicker.
6. Changes
If we change this document in any significant way, we'll update the date below.
Last updated — 11.08.2026