We take privacy seriously and are fully compliant with the GDPR in all areas of our business. This page sets out how we use and protect personal information (including Images captured in our products).

I’m a brand, agency or client
I'm interested in how my guests’ data is used and protected.
I’m a customer, guest or end user
I'm interested in how my data is used and protected.

Info for Clients, Brands and Agencies

The GDPR stands for the General Data Protection Regulation and is a regulation in EU law on data protection and privacy for all individuals within the European Union.

Since it’s introduction in May 2018, the importance of handling data responsibly has never been more important, processors and controllers of data (like The Story Box Co. and sometimes our clients) have new responsibilities to adhere to. The good news is we’re ready for the GDPR and have worked hard to make keeping compliance simple. The information here is designed to answer frequently asked questions on the topic.

1. How will you ensure that the regulations are adhered to at our event?

The Story Box Co. has a robust and regularly updated data protection management policy in place. From a practical perspective, we ensure compliance at your event or activation by adhering to these key principles:


  1. All Guests will be required to give their consent to a Privacy Notice. This Privacy Notice will be written specifically for your event/activation and will be written in plain English. The Privacy Notice will clearly set out who we are, exactly what data we’re collecting, how it will be used, who it will be shared with, for how long it will be retained, whether it will be shared outside of Singapore, the Guest’s rights and who they can contact for further information or if they have a complaint.
  2. Data is then handled strictly in line with the Privacy Notice and our strict data protection policy. This includes only using and sharing data legitimately and legally for the purposes stated in the Privacy Notice.
  3. We put in place additional controls for protecting minors, we do this by restricting their participation which generally means only allowing them to participate if they’re accompanied by and/or have consent from a parent/guardian.
  4. Data is only retained for as necessary or for as long as we’re allowed as per the Privacy Notice.
  5. Records are kept to demonstrate compliance.

2. What are our/my responsibilities?

When The Story Box Co. are operating a Photo Experience of Photo Booth at your event or activation, we’ll ensure that the primary operation is compliant with the GDPR, this is our responsibility.


You too will have responsibilities if we’re sharing data with you, this is optional. If data is shared with you, we will require you to ensure that that data is processed and stored legally, in line with all relevant regulations and the Privacy Notice under which it was collected. If you need further advice on you your responsibilities on the GDPR, we recommend seeking independent advice from a professional such as a lawyer specialising in data protection.

3. What types of data can be shared with us/me?

Data can be collected from guests and shared with you providing that this is properly detailed in the Privacy Notice. This data can include the images captured along with a variety of useful other data such as email addresses, names, survey answers, opt-ins and more.

End-User Privacy Policy

1. Who we are

The Story Box Co. is registered in Singapore under the company name Photostory. Our registered office is [email protected], 50 Gambas Crescent #08-04 Singapore 757022. We are registered on the ACRA and company registration number (UEN) is 53258659W.

2. Information we collect

By “information” we mean all of the personal information about you that we collect, use, share and store. In this context, information can also include imagery (photos, GIF, animations and video footage, where you are identifiable, captured when using our products). The information we hold will vary according to the relationship you have with us.

3. How we use & share Information

Data Protection law requires us to have one or more of the following reasons for using your information:


    • ‘Contract performance‘ – the information needed to deliver a product or service you have booked/ordered from us, e.g. we’ll use your email address to communicate with you if you make a booking for a photo booth with us.
    • ‘Legal obligation‘ – we are required by law to process your information, e.g. to verify your identity.
    • ‘Legitimate interest‘ – we’re allowed to use your information where, on balance, the benefits of us doing so are legitimate and not outweighed by your interests or legal rights e.g. we have an interest in knowing what our customers do and don’t like so we can offer better products and services.
    • ‘Consent‘ – in some cases we may obtain your consent to use information in a particular way or where the law requires consent to be obtained, e.g. if you use one of our products (like a photo booth) at an event and you consent to your an email address being added to a mailing list in order for you to receive communications in the future. Whenever ‘consent’ is the only reason for us using the information you have the right to change your mind and change or withdraw your consent.


    Here are the circumstances under which we use & share Information:

    • Managing and Communicating with you about a Booking or order for Products or Services

    (Contract Performance, Legitimate Interest)

    If you book services or buy products with us, we collect and use Information like your email address, phone number and event details in order to deliver products and services. We may also share Information with third parties and contractors in order to do this, for instance, we use a courier to deliver products to you, we will share your contact and delivery address details with them.

    We also record some calls for training and quality assurance purposes, we may refer to call recordings to check the accuracy of information we hold.

    Sending you emails, SMS messages or other communication after using one of our products or taking part in one of our experiences at an event.
    If you use one of our products or participate in an experience we’re running at an event, we may send you an email, SMS or other message enabling you to access your photo/animation or video. We’ll only do this where you ask us to do this by entering your contact information during your experience. We often use the services of third-party developers/software providers in order for us to do this.

    Providing our clients/sponsors with statistics and data captured from our products and experiences at their events.
    (Legitimate Interest, Consent).
    When we provide photo products and experiences to events, we’re usually doing this on behalf of a client or sponsor who has paid us to do so. Sometimes we will share anonymous statistics with our Clients / Sponsors in order for them and us to better understand how successful/popular the product or experience was. Clients/sponsors may also ask us to collect Information for their own marketing or business purposes (such as subscribing you to an email newsletter or using your photo/animation/video for advertising purposes), we will always make you aware of this and obtain your consent before sharing any personal information with our Clients or Sponsors.

    Taking photographs and/or recording video footage of our products in use at events for reportage and marketing purposes (including social media).
    (Legitimate Interest, Consent).
    We have a legitimate interest in being able to showcase our work and our products and services. We also have a legitimate interest in keeping our followers up to date on social media and building our following.
    We sometimes do this by capturing photos and/or videos of our products and experiences in use at the events we work at. Sometimes we will publish this photos/video content publicly on platforms such as our website or via our own social media accounts.
    We’ll always respect guests privacy and seek the required permissions before commencing any form of photography or filming for these purposes. In almost all cases, we’ll make guests aware of our photography/filming notices by at least prominently displaying notices and gain consent where we’re required to.

    Improving our services, identifying products and services that you may find useful.
    (Legitimate Interest, Consent).
    The range of products and services we offer is constantly evolving. We may use the information we hold to improve our products or identify trends in their popularity, for instance, our website uses cookies and reporting software which enables us to see which products are most frequently looked at.
    We also have a legitimate interest in telling you about our products, services and any new developments that we think may interest you, but only where we are permitted to do so. For some marketing activity, we will need to ask for your consent to use your information. We don’t want to send you irrelevant or excessive information, so we’ll use the information we hold particularly profile information, to decide what to tell you, and how and when we’ll do this.
    You have a legal right to tell us at any time that you don’t want us to use the information we hold in this way or to withdraw any consent that you have given to us.
    We’ll only get in touch with the ways you’ve told us are acceptable to you. If you’ve said you don’t want to see marketing information, you’ll not receive it. You can opt in to, or out of, receiving marketing information at any time by contacting us in the usual way.
    Recovering money that is owed to us
    (Legitimate Interest).
    We have a legitimate interest in recovering debts that are due to us if there isn’t a satisfactory plan in place to repay them. We may instruct a debt collection agent or solicitor to act for us in recovering the debt, including by bringing legal proceedings in the courts and we’ll provide relevant information to them to help recover any money that is owed to us.
    Preventing crime and protect our team & property
    (Legitimate Interest, Legal Obligation).
    We have a duty of care and legal obligation to protect our team and we have a legitimate interest in protecting our property. We store CCTV footage at our premises and may share Information we hold with relevant authorities in the event of a crime affecting us or one of our stakeholders has been committed or is suspected.