Privacy Notice
Last updated: 15 October 2026
1. Controller
Smilebox AS Organisation number: 831 431 962 Email: post@smilebox.no Phone: +47 455 797 70
2. Two groups of people
- Booking customer: the person or organisation that submits an enquiry or enters into a rental agreement.
- Guests: people photographed or filmed by Smilebox equipment at the event.
3. Booking-customer data (website and CRM)
We process name, email, phone, optional company, event type/date/place, product preference, message, language, referring page, campaign parameters in the link when present, and a technical submission id.
Purposes: respond to enquiries, provide quotes, deliver the assignment and invoice.
- Contract / steps prior to contract (Art. 6(1)(b))
- Legal obligation for accounting (Art. 6(1)(c))
- Legitimate interest in operating and securing the website (Art. 6(1)(f))
- Marketing (news and offers): only with separate consent (Art. 6(1)(a)), which can be withdrawn at any time
3b. Binding order and payment
An enquiry is not a binding order. We do not accept card or Vipps payments on smilebox.no.
4. Guest photos and video
The equipment may capture photos and video of guests. The booking customer’s contract with Smilebox is not, by itself, a contract legal basis toward the guests. For guests we assess lawful bases as follows:
| Purpose | What happens | Legal basis for guests |
|---|---|---|
| On-site capture | Recording as part of the experience | Legitimate interest (Art. 6(1)(f)) in delivering the agreed photo-booth/video experience, balanced against guests’ reasonable expectations at the event. Where consent is required (e.g. particularly sensitive situations or marketing use), it is obtained separately. |
| Individual delivery (default) | QR, email, SMS or similar to the individual | Privacy-friendly default. Legitimate interest in delivering the files to the person who requested them; consent where the sharing channel requires it. |
| Shared gallery (multiple guests) | Shareable link to the event album (fotoShare) | Requires a separate assessment of legal basis, access controls and any consent requirement before activation. Not the default. Where agreed: limited access (e.g. password / restricted guest access), and guests must be informed. |
| Smilebox’s own marketing | Use of guest images in Smilebox channels | Only documented consent (Art. 6(1)(a)) or another clear basis — not the default |
4b. Guest archive
The website does not publish an open guest archive.
5. Roles at different events
- Private events: Smilebox AS is the controller for capture, local storage on the equipment, the cloud gallery and deletion, because Smilebox determines the equipment, delivery format and deletion routine.
- Corporate / agency events (starting point): The booking customer determines the purpose of the photography (who attends, whether there is a shared gallery, and internal use). Smilebox provides the technical solution (LumaBooth/fotoShare), upload and deletion under written instructions. Where Smilebox processes guest media on behalf of the customer, a data processing agreement (DPA) with the booking customer must be in place before processing. Any different role split must be stated expressly in the quote/contract.
- Lumasoft LLC (LumaBooth / fotoShare Cloud, USA) is the vendor for Smilebox Light, Pro and 360. When Smilebox is the controller, Lumasoft is the processor under Lumasoft’s DPA (SCCs per Commission Implementing Decision (EU) 2021/914, and DPF where the recipient is listed). When Smilebox is the processor for a corporate customer, Lumasoft’s role as Smilebox’s sub-processor depends on coverage in the customer DPA with Smilebox and in Lumasoft’s terms — this must be confirmed contractually per engagement and is not automatically settled for every matter.
6. How guests are informed and how to request deletion
- Visible information at the booth/equipment (signage or on-screen text) that photos/video are taken, that files may be shared digitally, and how to contact us.
- The booking customer should inform their own guests or employees where appropriate, especially at corporate events.
- Individual sharing gives the recipient access to their own files. Shared galleries follow the agreed settings.
- Access/erasure: contact post@smilebox.no with the event date and, if possible, the gallery link or approximate time. We delete or restrict what we control. For corporate jobs where the customer is the controller, we may refer you to the customer or act on the customer’s instruction. Prints already taken home cannot be deleted digitally.
7. Gallery retention
- Default: 6 months from the event date.
- Alternative: 3 months when agreed.
- Longer: only by special agreement.
- Local copies on Smilebox equipment are deleted manually after confirmed delivery, within 7 days of the event when delivery is confirmed, and always before the equipment is handed to the next customer.
- Cloud galleries in fotoShare are deleted manually after the agreed deadline (6/3 months or a special agreement). Smilebox does not use automatic deletion. Completed deletions are documented. Backups held by Lumasoft/fotoShare may follow the vendor’s own documented deletion routines after the gallery is deleted in the service. Existing galleries and agreed retention periods are not changed without a new agreement.
8. Recipients / processors
Website enquiries are stored in Pipedrive. Supabase is not used to store new customer enquiries.
- Pipedrive – CRM for enquiries and follow-up (sole system for new website enquiries)
- Resend – email (receipts, notices and newsletter sign-ups)
- Vercel – hosting and technical logs
- Sanity – website content
- Lumasoft LLC (LumaBooth / fotoShare Cloud, USA) – software and cloud galleries for Smilebox Light, Pro and 360
9. Other retention
Pipedrive enquiries that lead to a quote or assignment are kept for as long as follow-up and the assignment require. Enquiries that do not lead to an assignment (e.g. lost/declined or with no further dialogue) are deleted or anonymised when the data are no longer needed for follow-up, and no later than 24 months after the last recorded activity — unless longer retention is required by law (e.g. Norwegian bookkeeping law, normally five years for accounting material). Marketing consent is kept until withdrawn.
10. Your rights
Access, rectification, erasure, restriction, portability, objection and withdrawal of consent where the conditions are met. Complaint: the Norwegian Data Protection Authority (datatilsynet.no). Contact: post@smilebox.no.
11. Cookies
We store your cookie choice in the browser and may remember the selected language. The banner also lets you save choices for analytics, marketing and personalisation, but the site does not currently load analytics or advertising scripts. Choices are stored for if such features are enabled later.
12. Changes and contact
When this text changes, the new version is published on this page with an updated date.
Questions: Smilebox AS, post@smilebox.no, +47 455 797 70.