CCTV AND AUDIO SURVEILLANCE PRIVACY NOTICE

Photobooth in Hungary

Date of issue: 2025.08.01.
Last updated: 2026.02.01.

I. GENERAL PROVISIONS 

The purpose of this Privacy Notice is to provide data subjects with clear and comprehensive information regarding the processing of their personal data in connection with the CCTV and audio surveillance system operated in the photo booths of Photobooth in Hungary.

The Company operates photo booths at various locations around Hungary. The CCTV and audio surveillance system described in this Privacy Notice operates in all photo booths operated by the Company to which the system is installed.

The processing of personal data is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council („GDPR”) and the applicable Hungarian data protection legislation.

The Company is committed to processing personal data in accordance with the following principles:

• lawfulness, fairness and transparency;

• purpose limitation;

• data minimisation;

• accuracy;

• storage limitation;

• integrity and confidentiality; and

• accountability.

The CCTV and audio surveillance system is operated for security and operational purposes only. The system is not operated for marketing, advertising, customer profiling, behavioural analysis, facial recognition or biometric identification.

II. APPLICABLE LEGISLATION

The processing described in this Privacy Notice is primarily governed by:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 („General Data Protection Regulation” or „GDPR”);

• Act CXII of 2011 on Informational Self-Determination and Freedom of Information („Hungarian Privacy Act” or „Infotv.”);

• Act V of 2013 on the Civil Code of Hungary, where applicable; and

• other applicable Hungarian and European Union legislation relating to privacy, personal data protection, electronic surveillance and the protection of property and persons.

Where applicable, the Company also takes into account relevant guidance and recommendations issued by the competent Hungarian data protection supervisory authority and the European Data Protection Board.

III. DEFINITIONS

For the purposes of this Privacy Notice, the definitions of the GDPR shall apply. In particular:

„Personal data”

Any information relating to an identified or identifiable natural person.

„Processing”

Any operation or set of operations performed on personal data, including collection, recording, storage, consultation, retrieval, use, disclosure, transmission, restriction, deletion or destruction.

„Data Controller”

The natural or legal person which determines the purposes and means of the processing of personal data.

„Data Processor”

A natural or legal person which processes personal data on behalf of the Data Controller.

„Data Subject”

The identified or identifiable natural person to whom personal data relates.

„Third party”

A natural or legal person other than the data subject, the Data Controller, the Data Processor or persons authorised to process personal data under the direct authority of the Controller or Processor.

The definitions contained in Article 4 GDPR shall apply in all other respects.

IV. DETAILS AND CONTACT INFORMATION OF THE DATA CONTROLLER

For the processing described in this Privacy Notice, the Data Controller is:

Photos and more kft. (address: 6000 Kecskemét, Nyíri út 38/C, e-mail: hello@photoboothinhungary.com, website: www.photoboothinbudapest.com)  from here on mentioned as Data Controller.

For privacy-related requests concerning the CCTV and audio surveillance system, data subjects may contact the Company using the above contact details.

V. CCTV AND AUDIO SURVEILLANCE

The used cameras are EZVIZ cameras connected to the EZVIZ CloudPlay cloud service. The surveillance system operates on a 24-hour-a-day, 7-day-a-week continuous recording basis, where both video and audio may be recorded.

The camera is installed inside the photo booth and is intended to monitor the interior of the photo booth. The camera has a physical field of movement of approximately 180 degrees. The camera configuration and intended field of view are limited to the interior of the photo booth. Depending on the configuration of the individual photo booth, the camera may capture:

• the photobooth screen;

• the entrance or doorway of the photo booth;

• the seating bench positioned opposite the screen; and

• persons present inside the photo booth.

The camera is not able to monitor public areas outside the photo booth or passing pedestrians as all booths have curtains in the entrance. The camera system is not used for facial recognition, biometric identification or automated identification of individuals.

Audio functionality

Audio recording is currently enabled. The audio functionality enables authorised Company employees to communicate with persons inside the photo booth through the camera system where this is necessary for operational or security purposes. The audio system is not used for unrelated monitoring or for analysing conversations for commercial purposes.

V.1. LEGAL BASIS OF THE PROCESSING

The primary legal basis for the processing of personal data through the CCTV and audio surveillance system is the legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR.

The Company’s legitimate interests include:

• protection of the Company’s photo booths and equipment;

• protection of Company property;

• prevention and detection of theft;

• prevention and detection of vandalism;

• prevention and investigation of damage;

• investigation of security incidents;

• investigation of technical incidents;

• protection of persons using or operating the photo booths;

• provision of operational assistance through the audio communication function; and

• establishment, exercise or defence of legal claims.

The Company considers the surveillance system necessary and proportionate to these purposes. The recording period is limited to the period considered reasonably necessary for the Company’s security purposes.

Access to recordings is restricted to authorised Company employees.

The Company has therefore assessed the legitimate interests pursued, the necessity of the processing and the potential impact on data subjects.

The Company does not rely on consent as the primary legal basis for the security surveillance system.

V.2. PURPOSE OF THE PROCESSING

The CCTV and audio surveillance system is operated exclusively for security and operational purposes.

The purposes of the processing are:

1. protection of the Company’s property and equipment;

2. prevention and detection of theft;

3. prevention and detection of vandalism;

4. prevention and investigation of damage to the photo booth;

5. investigation of security incidents;

6. investigation of technical incidents;

7. protection of persons inside the photo booth;

8. providing operational assistance to customers through the audio communication function;

9. establishment, exercise and defence of legal claims; and

10. where legally permitted or required, providing relevant recordings to competent authorities, insurers or legal representatives.

The CCTV and audio recordings are not used for:

• advertising;

• marketing;

• targeted advertising;

• customer profiling;

• behavioural analysis;

• facial recognition;

• biometric identification;

• automated decision-making; or

• commercial analysis of customers.

The recordings are also not used to analyse or evaluate the photographs or GIFs produced by the photo booth. The CCTV system is a separate security system from the photographic function of the photo booth.

V.3. DURATION OF THE PROCESSING AND RETENTION PERIOD

The CCTV system uses the EZVIZ CloudPlay service for cloud-based storage and playback of recordings. The Company’s currently applicable EZVIZ CloudPlay subscription provides up to 7 days of video history.

Accordingly, under normal circumstances, CCTV and audio recordings are retained for a maximum period of 7 days, after which they are automatically deleted or overwritten in accordance with the applicable CloudPlay functionality.

The Company considers this retention period proportionate because it allows sufficient time to identify and investigate security, technical or property-related incidents while limiting the period for which individuals’ personal data is retained.

Preservation of recordings relating to incidents

If a recording captures an incident such as:

• theft;

• attempted theft;

• vandalism;

• damage;

• an accident;

• a security incident;

• a technical incident; or

• another event giving rise to a potential legal claim,

the relevant recording may be separately preserved beyond the standard seven-day retention period.

Such recording will be retained only for as long as reasonably necessary for:

• investigation of the incident;

• identification of relevant circumstances;

• an insurance claim;

• cooperation with law enforcement;

• legal proceedings;

• establishment, exercise or defence of legal claims; or

• compliance with a legal obligation.

Once the relevant purpose has ceased to exist, the preserved recording will be deleted without undue delay.

V.4. CATEGORIES OF PERSONAL DATA PROCESSED

The surveillance system may process the following categories of personal data:

Personal data	Purpose of processing
Video images	Security and property protection
Audio recordings	Security and operational communication
Date and time of recording	Identification and investigation of incidents
Photo booth/location identifier	Identification of the relevant photo booth and incident
Information incidentally visible/audible in the booth	Security and incident investigation

The system does not intentionally collect:

• identity documents;

• payment card details;

• bank account details;

• telephone numbers;

• e-mail addresses; or

• other unrelated personal information.

The Company does not intentionally seek to collect special categories of personal data. If special-category information is incidentally captured in a recording, the Company does not intentionally analyse or use such information for any separate purpose.

V.5. DATA TRANSFERS AND RECIPIENTS

The Company does not routinely disclose CCTV or audio recordings to third parties. Where disclosure is necessary and lawful, relevant recordings may be provided to:

• police and other law enforcement authorities;

• courts;

• competent public authorities;

• insurers;

• legal advisers and lawyers;

• competent regulatory authorities; and

• other persons or organisations where disclosure is necessary for the establishment, exercise or defence of legal claims or is otherwise required or permitted by law.

Only recordings relevant to the particular purpose will be disclosed where reasonably practicable. The Company does not sell, license or otherwise commercially exploit CCTV or audio recordings.

V.6. EZVIZ CLOUDPLAY, DATA SECURITY AND PROCESSING

The Company uses EZVIZ (EZVIZ Europe B.V., Address: Dirk Storklaan 3,  2132 PX Hoofddorp  The Netherlands, www.ezviz.com,  support.eu@ezviz.com, ) cameras and the EZVIZ CloudPlay service for the storage and management of CCTV recordings, EZVIZ processes the video and audio data on behalf of the Data Controller for the purposes determined by the Company: EZVIZ acts as Data Processor.

V.7. PERSONS AUTHORISED TO ACCESS THE DATA

Access to the EZVIZ account and recordings is restricted to authorised Company employees and can be accessed only with an encrypted password.

Unauthorised employees, customers, members of the public and other third parties do not have access to the recordings. Persons authorised to access recordings are required to maintain confidentiality and may access the recordings only for legitimate Company purposes.

Access may be provided to external recipients only where this is necessary and lawful.

EZVIZ states that it implements technical and organisational security measures in connection with its services, including encryption and other security controls.

VI. RIGHTS OF DATA SUBJECTS

Data subjects may exercise the rights provided by the GDPR, subject to the conditions and limitations established by applicable law.

In particular, data subjects may have the right to:

1. Right to information

To receive information about the processing of their personal data.

2. Right of access

To request access to personal data concerning them and to obtain a copy of such data, subject to the rights and freedoms of others. In the context of CCTV recordings, the Company may need to obscure or otherwise protect information relating to other individuals appearing in the recording.

3. Right to rectification

To request correction of inaccurate personal data.

This right has limited practical application to historical video and audio recordings, but may apply to associated information where relevant.

4. Right to erasure

To request deletion of personal data where the conditions of Article 17 GDPR are met.

The right to erasure is not absolute and may not apply where continued processing is necessary, including for the establishment, exercise or defence of legal claims.

5. Right to restriction of processing

To request restriction of processing in the circumstances provided for by Article 18 GDPR.

6. Right to object

Where processing is based on Article 6(1)(f) GDPR, the data subject has the right to object to processing on grounds relating to his or her particular situation.

The Company shall assess the objection in accordance with Article 21 GDPR.

7. Right to data portability

Where the legal requirements of Article 20 GDPR are fulfilled, the data subject may have the right to receive personal data in a structured, commonly used and machine-readable format.

This right will generally have limited application to CCTV footage.

VI.1. EXERCISING DATA SUBJECT RIGHTS

Requests concerning CCTV and audio recordings may be submitted to the Company via e-mail at: hello@photoboothinbudapest.com

To assist the Company in locating a particular recording, the requester should, where possible, provide:

• the approximate date;

• the approximate time;

• the relevant photo booth or location;

• a description of the circumstances; and

• any other information reasonably necessary to locate the recording.

Because recordings are normally retained for only 7 days, requests relating to a particular recording should be submitted as soon as possible.

The Company may request reasonable information to verify the identity of the requester where this is necessary to prevent unauthorised disclosure. Where a recording contains information relating to other persons, the Company shall take appropriate measures to protect their rights and freedoms.

VII. REMEDIES AND COMPLAINTS

If a data subject considers that the processing of his or her personal data infringes applicable data protection legislation, the data subject may first contact the Company using the contact details set out in this Privacy Notice.

The data subject also has the right to lodge a complaint with the competent data protection supervisory authority.

In Hungary, the competent supervisory authority is:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH) National Authority for Data Protection and Freedom of Information (address: 1055 Budapest, Falk Miksa utca 9-11., e-mail: ugyfelszolgalat@naih.hu, website: www.naih.hu)

VIII. CCTV INFORMATION SIGN

The Company have provided onsite information as sticker display inside the photobooth area covered by the surveillance system regarding the recording.

IX. ACCOUNTABILITY AND INTERNAL DOCUMENTATION

The Company shall maintain appropriate internal documentation concerning the processing described in this Privacy Notice.

Where applicable, this should include:

• a record of processing activities;

• a legitimate interest assessment;

• documentation concerning the camera positioning and field of view;

• documentation concerning the necessity and proportionality of audio recording;

• access-control arrangements;

• retention and deletion procedures;

• incident preservation procedures;

• processor agreements with relevant service providers; and

• documentation concerning international data transfers where applicable.

The Company shall periodically review the surveillance system to ensure that:

1. the camera’s field of view remains limited to the intended area;

2. the recording functionality remains necessary and proportionate;

3. the retention period remains appropriate;

4. access rights remain limited to authorised persons; and

5. the processing remains consistent with the purposes described in this Privacy Notice.

X. CHANGES TO THIS PRIVACY NOTICE

The Company may amend this Privacy Notice where necessary due to:

• changes to the surveillance system;

• changes to the EZVIZ CloudPlay service;

• changes to the retention period;

• changes to the purposes of processing;

• changes to applicable legislation;

• changes to processors or sub-processors; or

• changes to the Company’s organisational or technical measures.

The current version of this Privacy Notice shall be made available through: www.photoboothinbudapest.com

Budapest, 2025.08.01

Photobooth in Budapest