Privacy
Privacy notice
Version 1.0 · In force from 18 October 2026
This notice explains how we handle personal data on this website and in the PartyPhotoPaint app at events. We operate this website. At events, the organiser is the data controller and we act as their data processor.
1. Who handles your data
Provider: Datastart Kft. (registered seat: 1091 Budapest, Haller utca 64., Hungary, company registration number: 01-09-726914, VAT number: HU13274355), "we" below. E-mail: privacy at partyphotopaint dot com. We are not required to appoint a data protection officer and have not appointed one.
2. This website
The site is static: no cookies, no analytics, no advertising pixels, no social media embeds. Your language choice is kept in your own browser (localStorage) and never leaves your device. See the cookie notice.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Server logs: IP address, time, page requested, browser identifier | Running the site, investigating faults and attacks | Legitimate interest (GDPR Art. 6(1)(f)): secure operation | 30 days at most |
| If you write to us: name, e-mail address, the message, event details | Preparing quotes and communicating with you | Steps prior to a contract (Art. 6(1)(b)), or legitimate interest | 2 years from the quote; under the contract if one is signed |
| Organiser account: e-mail address, the times you signed in and your browser sessions | Signing in (a mailed link instead of a password) and notices about your own events | Providing the service, performance of a contract (Art. 6(1)(b)) | Until the account is closed, then at most 30 days in the backups |
| Product news: your e-mail address and when you agreed, if you asked for news about the service | Telling you what is new in the service | Consent (Art. 6(1)(a)), which you may withdraw at any time | Until you withdraw it |
3. At the event
During the game guests make drawings and photographs. A photograph is personal data and carries the likeness of the people in it. The organiser of the event is the controller for this material: they decide whether the game runs, who may take part, and how long the pictures are kept. We process it on their instructions under a data processing agreement.
| Data | Purpose | Retention |
|---|---|---|
| Drawings, photographs and the AI versions of them | The game, the gallery, the guest book and the album | As agreed with the organiser; by default 400 days after the event, and sooner if deletion is asked for |
| Nickname, note written on a picture | Identifying the picture in the gallery | With the picture |
| For e-mail sharing: e-mail address, time of acceptance, IP address, version of the text accepted | Sending a link to the picture and recording who received it and which terms they accepted | Until claims become time-barred, 5 years at most |
| Operational log (uploads, generations, deletions) | Troubleshooting, investigating misuse and keeping records of deletions | 1 year at most |
Taking part is voluntary: nobody has to draw or be photographed. If someone changes their mind, their picture can be deleted on the spot by the organiser.
4. Artificial intelligence and transfers
We use external AI providers to process drawings and photographs (currently OpenAI and OpenRouter, and the image models they make available). The picture is transferred to them for processing, which in some cases means processing outside the European Union, including in the United States. Such transfers rely on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses. Under those contracts, pictures sent through the API are not used to train models.
AI-generated text and images are deliberately exaggerated and intended for entertainment. They are not factual statements about the people shown.
5. Who may receive your data
- Hosting and server provider: Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany; the data stays in the EU).
- E-mail provider: Színes Web Médiafejlesztő Kft. (1137 Budapest, Szent István park 6., Hungary). It sends our e-mails and keeps our mailbox.
- AI providers as in section 4.
- The event organiser and the staff they appoint.
We do not sell your data and we do not use it for advertising.
6. Your rights
You may ask for a copy of the data we hold about you, for incorrect data to be corrected, for data to be deleted, for processing to be restricted; you may object to processing based on legitimate interest, and ask for your data in a portable form. You may withdraw consent at any time, which does not affect processing carried out before the withdrawal.
For requests about pictures from an event, please contact the organiser. You can also contact us; we will forward your request and help the organiser respond. We respond within one month.
You may complain to the Hungarian supervisory authority (Nemzeti Adatvédelmi és Információszabadság Hatóság, 1055 Budapest, Falk Miksa utca 9–11., post: 1363 Budapest, Pf. 9., ugyfelszolgalat@naih.hu, naih.hu), to the authority of your own country of residence, or to a court.
7. Security
The server is reachable over an encrypted connection (HTTPS), operator screens are password protected, and pictures are available through unique links that we do not publish. An event gallery is available to the guests of that event as the organiser decides.
8. Changes
If we make a substantive change to this notice, we will publish an updated version with its effective date. Previous versions are available on request.