GDPR Compliance

This page explains how BrandPacks Limited ("BoothHQ", "we", "us", or "our") complies with the European Union General Data Protection Regulation (Regulation (EU) 2016/679) and the United Kingdom GDPR. It works alongside our Privacy Policy and Terms & Conditions, and serves as our customer-facing Data Processing Addendum (DPA) for business customers who use BoothHQ to handle personal data about their own end clients.

Who is the controller and who is the processor

GDPR distinguishes between the controller (who decides why and how personal data is processed) and the processor (who handles the data on the controller's behalf). Within BoothHQ those roles work like this:

— When you sign up for a BoothHQ account, BrandPacks Limited is the data controller for your account-holder information — your name, email, billing details, and how you use the product.

— When you use BoothHQ to manage your own clients (their bookings, photo galleries, invoices, contracts), you are the data controller and BrandPacks Limited acts as your data processor. We only process that data on your documented instructions, as set out in the Data Processing Agreement section below.

Data Processing Agreement (DPA)

For business customers using BoothHQ to process personal data about their own end clients, this section forms the customer-facing terms of our Data Processing Agreement under Article 28 GDPR. By using BoothHQ to handle personal data on behalf of your end customers, you and BrandPacks Limited agree that:

(a) Subject matter — we process your personal data solely to provide the BoothHQ service as described in our Terms & Conditions.

(b) Duration — for as long as your account is active, plus the retention period set out in our Privacy Policy.

(c) Nature and purpose — hosting, storing, organising, transmitting, and otherwise processing the personal data you upload, in order to deliver the booking, invoicing, gallery, contract, and communication features of the service.

(d) Categories of personal data — names, email addresses, phone numbers, postal addresses, event details, photographs, payment metadata (Stripe handles card data directly), and any other information you choose to record about your clients.

(e) Categories of data subjects — your end customers (the people who book, pay, or communicate with you through BoothHQ).

(f) Our obligations — we will process the data only on your documented instructions, ensure that personnel with access are bound by confidentiality, implement the technical and organisational measures listed below, assist you in responding to data-subject requests, notify you of any personal-data breach without undue delay, delete or return your data on termination of the service, and make available all information necessary to demonstrate our compliance with Article 28.

(g) Sub-processors — we maintain an up-to-date public list of every sub-processor we engage. By accepting these terms you give general written authorisation for us to use those sub-processors, and we will give you reasonable advance notice of any intended addition or replacement that affects Customer Data, giving you a reasonable opportunity to object.

A signed PDF copy of our Data Processing Agreement is available on request — email [email protected].

Your rights as a data subject

Under the GDPR and UK GDPR, every individual whose personal data we process has the following rights:

— Right of access (Article 15): confirm whether we hold data about you and obtain a copy.
— Right to rectification (Article 16): correct inaccurate or incomplete data.
— Right to erasure (Article 17): request that we delete your data, subject to limited legal exceptions.
— Right to restriction (Article 18): limit how we process your data.
— Right to data portability (Article 20): receive your data in a structured, machine-readable format.
— Right to object (Article 21): object to processing based on our legitimate interests, including direct marketing.
— Rights in relation to automated decision-making (Article 22): BoothHQ does not use solely-automated decision-making that produces legal or similarly significant effects.
— Right to withdraw consent: where processing relies on consent, you can withdraw it at any time without affecting the lawfulness of prior processing.

How to exercise your rights

If you hold a BoothHQ account, the fastest way to exercise your rights is from inside the product:

— Download a copy of your data — Account Settings → Privacy → "Download my data". This produces a portable archive that satisfies Article 20.
— Delete your account — Account Settings → Privacy → "Delete my account". This soft-deletes immediately and permanently erases your data after 30 days, in line with Article 17.

If you are not a BoothHQ account holder — for example, you are a client of one of our customers — please contact your booking provider in the first instance. They are the data controller for your booking, gallery, invoice, or contract record, and we can only act on their instructions. If they do not respond, you can email [email protected] and we will make reasonable efforts to assist them in handling your request.

For all other rights requests, email [email protected]. We will respond within one calendar month, as required by Article 12(3). We may need to verify your identity before fulfilling a request.

Our lawful basis for processing

Where we process personal data as a controller, we rely on one or more of the lawful bases set out in Article 6 GDPR:

(a) Performance of a contract — to deliver the BoothHQ service to you under our Terms & Conditions.
(b) Legitimate interests — to secure, improve, and market the service to existing customers, balanced against your fundamental rights.
(c) Consent — where you have actively opted in (for example, marketing emails or non-essential cookies).
(d) Legal obligation — where we must keep records to comply with tax, accounting, or other statutory requirements.

You can withdraw any consent you have given at any time by emailing [email protected] or using the unsubscribe link on any marketing message.

International transfers

Some of our sub-processors are located outside the European Economic Area or the United Kingdom — primarily in the United States. Where we transfer personal data to a country not recognised as offering an adequate level of protection, we rely on the European Commission's Standard Contractual Clauses (Module Two: controller-to-processor, or Module Three: processor-to-processor, as appropriate) and, for transfers from the UK, the UK International Data Transfer Agreement or the UK Addendum to the SCCs. We carry out transfer impact assessments where they are required, and apply additional technical measures (encryption in transit and at rest) regardless of destination.

Sub-processors

We maintain a public list of every third-party vendor that processes personal data on our behalf, including each vendor's purpose, what categories of data are handled, and the primary processing location. Sub-processors are bound by GDPR-aligned contractual obligations — data-processing agreements, Standard Contractual Clauses where relevant, audit and breach-notification requirements. The list is updated whenever it changes, and account holders are notified at least 30 days before a new sub-processor begins handling personal data.

The complete, up-to-date list of our sub-processors is available here: Sub-processors.

Technical and organisational measures

We implement security measures appropriate to the risks of the processing, in line with Article 32 GDPR. These include:

— Encryption in transit (TLS 1.2+) and encryption at rest for stored backups and sensitive credential fields.
— Role-based access controls inside the application, with team-scoped data isolation enforced at the database layer.
— Audit logging of administrative actions and authentication events.
— Regular automated backups stored in a separate region, with documented restore procedures.
— Vulnerability management on framework and dependency updates, with security patches applied promptly.
— Confidentiality obligations for personnel with access to production systems.
— Vendor due diligence before onboarding any new sub-processor.

We continually review and improve these measures as the threat landscape evolves.

Data-breach notification

If we become aware of a personal-data breach affecting your data, we will notify you without undue delay and, where required by Article 33 GDPR, within 72 hours of becoming aware of it. Notifications will describe the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures we are taking. Where you act as controller of the affected data, you remain responsible for any onward notification to your end customers and to your supervisory authority.

Right to lodge a complaint

If you live in the European Economic Area or the United Kingdom and you believe we have not handled your personal data in line with the GDPR or UK GDPR, you have the right to lodge a complaint with your local supervisory authority. We would, however, appreciate the chance to address your concerns first — please email [email protected] so we can put it right.

Changes to this page

We may update this page from time to time to reflect changes in our practices or in the law. Material changes are announced to account holders by email or via an in-product notice, and the "Effective" date at the top of the page is updated accordingly.

Contact us

For any question about GDPR compliance, to request a signed Data Processing Agreement, or to exercise any data-subject right, please contact:

BrandPacks Limited
Unit 1603, 16th Floor, The L. Plaza
367–375 Queen's Road Central
Sheung Wan, Hong Kong
Email: [email protected]

We respond to all GDPR enquiries within 30 days, in line with Article 12(3).