Privacy Policy

Last modified: September 26, 2026

INTRODUCTION

Solodigitalis Inc. and its affiliates and subsidiaries (collectively, the Company, we, us, or our) respect your privacy and are committed to protecting personal information in accordance with this policy.

This policy describes the personal information we collect, the purposes for which it is collected and used, the means of collection, the categories of persons who may have access to it, the circumstances in which it may be communicated outside Quebec, the rights available to the person concerned, and the contact information for our Privacy Officer. Our Terms require each Operator that collects Guest personal information through an event to provide the disclosures required by applicable law at or before collection and to identify the Operator as the person responsible for that collection. We do not control an Operator's independent compliance with those requirements, and this allocation does not limit obligations that apply directly to us.

• The types of information we may collect, or that users of our Platform may provide, when they make a purchase through or in connection with, register with, access, or use our websites and applications. These include booth.events, shared.gallery, wifibooth.com, solodigitalis.com, and the Booth.Events, Wifibooth, SoloLink, and BluePrint mobile applications. BluePrint was renamed SoloLink, but this policy continues to apply to BluePrint. We refer to these websites and applications collectively and individually, as applicable, as the Platform.
• Our practices for collecting, using, maintaining, protecting, and disclosing that information.

This policy explains how we handle personal information when we provide the Platform to Operators, when the Platform processes information about Guests, and when another individual visits or otherwise interacts with a website or other part of the Platform. In this policy, Operator means the individual or organization that creates and manages an account and configures or runs an event using the Platform, for example, a photo booth business, event organizer, or host. Guest means an individual whose photograph or video is taken at an Operator's event and who may optionally enter contact information, such as an email address or phone number, to receive a copy of that content. Website User means an individual who visits or otherwise interacts with a website or other part of the Platform but is not acting as an Operator or Guest. Depending on the circumstances, an individual may be an Operator, a Guest, a Website User, or more than one of these.

For Guest personal information processed through an event, the Operator determines the purposes and material means of the processing. The Operator instructs us to process that information as necessary to provide the Platform and the features the Operator uses, selects, configures, or activates, as further documented in the Terms, the applicable Data Processing Addendum, and any other written instructions agreed by the parties. Our Terms require the Operator to provide required notices and obtain any consent or other lawful authority required before collection. We process that information on the Operator's behalf and in accordance with those documented instructions, except where we independently determine the purposes and means of processing, including for account administration, security, fraud prevention, and legal compliance. We do not control an Operator's independent compliance with its notice and consent obligations, and this allocation does not limit obligations that apply directly to us.

We use personal information relating to Operators, Guests, and Website Users only in accordance with this policy unless otherwise required or permitted by applicable law. Before we collect personal information for our own purposes, we determine that the information is necessary for an identified purpose and limit our collection, use, disclosure, retention, and access to what is necessary and proportionate for that purpose. Our Terms require Operators to apply corresponding necessity and proportionality requirements to personal information for which they are responsible. We do not control an Operator's independent compliance with those requirements.

For information about where we process and store data, data residency options, and our current list of sub-processors, please refer to our Data Processing and Residency Statement: https://booth.events/data-processing

Under applicable privacy laws, personal information generally includes information about an identifiable individual. Certain business contact information used solely to communicate with an individual in relation to the individual's employment, business, or profession may be excluded from some statutory protections. Whether an exclusion applies depends on the applicable law and the purpose for which the information is collected, used, or disclosed.

This policy applies only to information we collect in this Platform and in email, text, and other electronic communications sent through or in connection with this Platform.

This policy does not apply to information that an Operator or Guest provides directly to an independent third party, or that an independent third party collects for its own purposes, as described under Third-Party Information Collection. It also does not apply to information provided to us through a website that has a separate privacy policy. This exclusion does not apply where the third party processes personal information on our behalf or on an Operator's behalf through the Platform.

Websites outside the Platform and independent third parties may have their own privacy policies. Operators and Guests should review the applicable policy before providing personal information directly to those websites or third parties.

Please read this policy carefully to understand our practices for collecting, processing, and storing personal information. Our Terms require Operators to make this policy, or an equivalent privacy notice describing the relevant processing, available to Guests and to obtain any consent or other lawful authority required before collecting or directing us to process Guest personal information. An Operator's or Guest's use of the Platform does not constitute consent where applicable law requires separate affirmative consent. Where Quebec law requires consent, the enterprise requesting it must present the request separately from other information when made in writing and must obtain consent that is clear, free, informed, specific, and limited to the period necessary for the stated purposes. Express consent is required for sensitive personal information where prescribed by law. For a person under 14 years of age, consent must be obtained from the holder of parental authority or tutor unless the collection is clearly for the person's benefit. We do not control an Operator's independent compliance with these requirements. This policy may change from time to time (see Changes to Our Privacy Policy). We will notify Operators and Guests of material changes as required by applicable law and obtain consent where required for a new collection, use, or disclosure of personal information for which we are responsible.

INFORMATION WE COLLECT AND HOW WE COLLECT IT

We collect personal information in different ways depending on whether it concerns an Operator, a Guest, or a Website User. We collect Operator information directly from the Operator and automatically when the Operator uses the Platform. We process Guest information on behalf of an Operator through an Operator-configured event, including through a Guest's direct interaction with an event experience, and through automated technologies or interactions when a Guest accesses the Platform during or after such an event. We may collect information directly from a Website User who contacts us, submits information, or uses an available website feature, and automatically when a Website User visits or interacts with a website or other part of the Platform.

• We collect information through direct interactions with Operators and Guests accessing features of our Platform as part of or following an Operator event experience. Operators provide information by completing forms, configuring events, taking or uploading photographs, and corresponding with us. Guests may provide information by entering contact information, responding to surveys, accessing a gallery, uploading content where enabled, or corresponding with us.
• We collect information automatically when an Operator uses the Platform or when a Guest accesses an event experience or features following such an experience, including usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies.

The types of information that we collect include:

• Personal information that may identify an Operator or Guest, directly or indirectly, such as a name, mailing address, email address, telephone number, internet protocol address, user name or similar identifier. Operator information may also include billing and account information and other identifiers used to administer or contact the Operator.
• Personal information inherent in or contained in photographs, videos, and other materials that an Operator or Guest uploads to the Platform or that the Platform creates during an event experience.
• Business-related information concerning an Operator or an Operator's personnel, including title, duties, business address, business email address, and business telephone number.
• Non-personal information that does not identify an Operator, Guest, or other individual, directly or indirectly, such as statistical or aggregated information. We may derive statistical or aggregated information from personal information, but we treat it as non-personal information only where it no longer permits an individual to be identified, directly or indirectly.
• Technical information associated with an Operator or Guest interaction, including login information where an account is used, device type, time zone setting, and usage details.

Information Provided to Us

Operators provide account, business, billing, and event-configuration information and may direct the Platform to collect or process photographs, videos, contact information, survey answers, and other event data concerning Guests. Guests may also provide information directly when interacting with an Operator event experience, for example by entering an email address or phone number to receive a link, accessing a gallery link, posting content where enabled, or otherwise using interactive features made available through the Platform. When an Operator or Guest downloads, registers with, accesses, or uses the Platform, we may therefore ask for or collect the information described below.

• Operators and Guests may provide information through Platform forms. Operators may provide information when registering for an account, subscribing to services, configuring an event, entering a contest or promotion, requesting further services, or reporting a problem. Guests at an Operator event may provide information when accessing an event or gallery link, entering contact information, posting material where enabled, or requesting assistance.
• Records and copies of correspondence from an Operator or Guest who contacts us, including the email address or telephone number used for the correspondence.
• Responses that an Operator or Guest provides to a survey made available through the Platform for the stated research, service, event, or other purpose.
• Details of transactions carried out by an Operator or other purchaser through the Platform and information required to fulfil an order. We may require financial information before an Operator or purchaser places an order through the Platform.
• Search queries submitted by an Operator or Guest through the applicable Platform feature.

Operators and Guests may also choose to provide information for distribution, publication, or display on public areas of apps, websites, or other destinations they access through the Platform. We refer to information voluntarily submitted for those purposes as User Contributions, including Guest Photographs as defined in our terms of use. User Contributions may be accessible to persons selected by the Operator or Guest, to recipients of a shared link, or to the public, depending on the applicable settings. Operators and Guests should review those settings before posting or sharing. Although we apply security measures to the Platform, we cannot control the actions of recipients after content has been shared with them.

Automatic Information Collection and Tracking Technologies

When an Operator uses an account, app, or dashboard, when a Guest accesses an event experience or public gallery, or when a Website User visits or interacts with a website or other part of the Platform, the Platform may automatically collect the information described below. The categories collected may vary according to the device, feature, and role involved.

• Usage details. When an Operator accesses or uses an account, app, or dashboard, or when a Guest accesses an event experience or public gallery, we may automatically collect details of that interaction, including traffic data, location data where applicable, logs, other communication data, and the resources accessed or used through the relevant interface.
• Device information. When an Operator or Guest interacts with the Platform, we may collect information about the device and internet connection used for that interaction, including a unique device identifier, IP address, operating system, browser type, mobile network information, and, where available and relevant to the feature, the device telephone number.
• Stored information and files. With permission, an Operator-facing app may access metadata and other information associated with files stored on the Operator's device, including photographs, audio and video clips, contacts, and address book information. A Guest-facing experience may access files or metadata only when the Guest selects or uploads content or otherwise enables the applicable feature.
• Location information. Operator-facing apps may collect real-time device location when an Operator activates or uses a location-dependent feature. Guest-facing experiences may collect location only after the required notice has been provided and the Guest has activated the relevant function or otherwise provided the consent required by applicable law. We may also process location contained in photograph metadata at an Operator's direction. Our Terms require the Operator to provide required notices and have lawful authority for that processing. We do not control an Operator's independent compliance with those requirements.

The technologies we use for this automatic data collection may include:

• Cookies or mobile cookies. A cookie is a small file placed on the device used to access the Platform. Operators and Guests may use the available browser, device, or Platform controls to manage optional cookies. Disabling optional cookies may affect certain non-essential features, but cookies that are strictly necessary to provide a requested service or event experience will remain active.
• Web beacons. Pages of the Platform and emails sent to an Operator or Guest may contain small electronic files known as web beacons, clear gifs, pixel tags, or single-pixel gifs. These technologies may allow us to measure visits or message opens and to compile related Platform statistics, such as the popularity of content and the integrity of systems and servers. We use them only as permitted by applicable law and subject to any required consent.

We may collect statistical information about how Operators and Guests use the relevant Platform interface. Where that information identifies or can reasonably be associated with an individual, we treat it as personal information. We use usage information to operate, secure, troubleshoot, and improve the Platform and, where permitted, to personalize the relevant Operator-facing or Guest-facing experience for the purposes described below.

• Estimate usage patterns.
• Store an Operator's account preferences and, where permitted, a Guest's event-experience preferences so that we can customize the relevant parts of the Platform.
• Speed up, improve or optimize our services.
• Recognize an Operator when the Operator signs in or uses the Platform and, where applicable, recognize a Guest during an event or gallery interaction.

Operators and Guests may manage optional automatic collection through the controls described below. Some information is necessary to provide a requested Platform feature or event experience and cannot be disabled for that interaction. Location-based features will not function without the required location information, and location information required for a purchase or requested feature will be collected only as permitted by applicable law.

Third-Party Information Collection

Where we use technology that includes functions allowing an individual to be identified, located, or profiled, we will inform the affected person of the use of that technology and of the means available to activate the function before it is used, as required by applicable law. Profiling includes collecting or using personal information to evaluate characteristics such as preferences, interests, behaviour, location, or movements. Our Terms require Operators to provide corresponding notices for technology they configure or use for their own purposes. We do not control an Operator's independent compliance with those requirements. Privacy settings for products or services we offer to the public are configured to provide the highest level of confidentiality by default, except for settings controlled directly by the user.

When Operators or Guests use the Platform or its content, certain third parties may collect information about them or their devices. On Guest-facing galleries and other public Guest experiences, non-essential analytics, advertising, and similar tracking technologies are disabled unless and until any consent required by applicable law has been obtained. These third parties may include:

• Analytics companies.
• The manufacturer of the device used by an Operator or Guest to access the Platform.
• The mobile or other communications service provider used by an Operator or Guest to access the Platform.
• Advertisers, advertising networks, and advertising servers used in connection with Operator-facing services. We do not permit these providers to use Guest personal information for behavioural advertising.

These third parties may use cookies or similar technologies to collect information when an Operator or Guest uses the Platform. The information may be associated with personal information or may concern online activity over time and across websites, apps, or other online services. We use non-essential third-party tracking technologies only as described in this policy and, where required, after obtaining consent.

Operators may use the advertising controls described under Choices About How We Use and Disclose Personal Information. We do not use Guest personal information for behavioural advertising.

We do not control the independent practices of third parties that collect personal information for their own purposes. Questions about an advertisement or targeted content should be directed to the responsible provider. For information about controls available to Operators and Guests, see Choices About How We Use and Disclose Personal Information. This statement does not limit our responsibilities for service providers that process personal information on our behalf or on an Operator's behalf through the Platform.

HOW WE USE INFORMATION

If we use personal information to make a decision based exclusively on automated processing, we will provide the notices and information required by applicable law, including information about the personal information used and the principal factors and parameters underlying the decision. Where required by law, the affected person may request correction of the personal information and submit observations to a person in a position to review the decision. This paragraph applies only to automated decisions made by us and does not describe or govern decisions made independently by an Operator.

We use Operator personal information to provide and administer accounts and subscriptions, process transactions, secure and improve the Platform, communicate about products and services, and market to Operators where permitted by law. We process Guest personal information as necessary to provide the Platform and the event experience, media-delivery, gallery, sharing, security, and support features the Operator uses or enables, in accordance with the Operator's documented instructions, including its use of the Platform, and the applicable Data Processing Addendum. We may also conduct the limited quality-assurance review of a limited sample of recently uploaded Guest photographs described below to verify that the Platform is functioning properly. To the extent we independently determine the purpose and means of that review, we are responsible for ensuring that it is necessary, proportionate, transparent, appropriately safeguarded, and permitted by applicable law. We otherwise process Guest personal information for our own purposes only where we independently determine the purposes and means of processing and the specific purpose is expressly described in this policy and permitted by applicable law.

• To provide the Platform and its content to Operators and to provide Operator-configured event experiences and related content to Guests.
• To provide an Operator or Guest with information, products, or services that the person requests from us.
• To fulfil the purposes for which an Operator or Guest provided the information, the purposes described when the information was collected, or another purpose authorized by that person or otherwise permitted by law.
• To provide notices about an Operator's account/subscription, including expiration and renewal notices.
• To carry out our obligations and enforce our rights under contracts with Operators or other contracting parties, including for billing and collection, and to comply with legal requirements.
• To notify Operators about Platform updates and changes to products or services made available to them, and to notify Guests about material changes affecting an event experience or service they requested where required by law.
• To improve, test, troubleshoot, and support the Platform and Guest event experiences using information processed for the purposes described in this policy. For quality assurance, authorized personnel may view a limited, rotating sample of recently uploaded Guest photographs, currently displayed through a query that returns a limited selection of the most recent photographs, solely to confirm that capture, upload, display, and delivery functions are operating properly. This review does not create an additional copy or separate archive of the photographs.
• For marketing to Operators where permitted by law. We do not use Guest personal information for marketing. We process Guest personal information as necessary to provide the event-related media, gallery access, sharing, security, and support features used, selected, configured, or activated by the Operator, in accordance with the Operator's documented instructions, including its use of the Platform. Any processing of Guest personal information for a purpose we determine independently is limited to a specific purpose expressly described in this policy and permitted by applicable law.
• To allow Operators to configure and use interactive, social media, and other Platform features, and to allow Guests to participate in the event or sharing features an Operator enables.
• For another purpose with the consent of the Operator or Guest whose personal information is involved, where consent is the required lawful basis.

Usage information helps us operate, improve, and personalize the relevant Operator-facing or Guest-facing experience through the purposes listed below.

• Estimate usage and usage patterns.
• Store an Operator's account preferences and, where permitted, a Guest's event-experience preferences so that we can customize the relevant parts of the Platform.
• Speed up, improve or optimize our services.
• Recognize an Operator when the Operator signs in or uses the Platform and, where applicable, recognize a Guest during an event or gallery interaction.

We may use device location information and location information contained in photograph metadata to provide printing troubleshooting, facilitate payments, prevent and investigate fraud or repudiation, operate location-dependent Platform features, maintain security, analyze and improve the Platform, and market goods and services to Operators where permitted by law. We do not use Guest location information for marketing. For location processing performed on an Operator's behalf, our Terms require the Operator to provide any required notice and obtain any required consent or other lawful authority. Where we determine the relevant purpose and means of location processing, we will obtain any consent required by applicable law before the use.

We may use Operator personal information to contact Operators about our goods and services, or those of third parties, where permitted by law. We do not send marketing communications to Guests solely because they appear in event content. An Operator or other marketing recipient may unsubscribe by using the mechanism in the message or by emailing hello@booth.events. For more information, see Choices About How We Use and Disclose Personal Information.

DISCLOSURE OF PERSONAL INFORMATION

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction.

We may disclose Operator personal information and Guest personal information as described below. Where we process Guest personal information on an Operator's behalf, disclosures necessary to provide the Platform and the features the Operator uses or enables are made in accordance with the Operator's documented instructions, including its use of the Platform, and the applicable Data Processing Addendum. Where we independently determine the purposes and means of a disclosure, the specific purpose and lawful basis are identified below.

• To our subsidiaries and affiliates.
• According to applicable law, to a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Solodigitalis Inc.'s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Solodigitalis Inc. about Operators, Guests, customers, and users is among the assets transferred.
• To contractors, service providers, and other third parties we use to support our business, such as analytics and search engine providers that help us optimize and improve our services. We require them, through the terms governing the service or other legally binding commitments, to protect personal information and process it only for authorized purposes and in accordance with applicable privacy and data protection laws. The specific protections vary by provider and service.
• To fulfil a purpose for which an Operator or Guest provided the information or, where we process Guest personal information on an Operator's behalf, to provide the Platform and the features the Operator uses, selects, configures, or activates in accordance with the Operator's documented instructions, including its use of the Platform.
• For another purpose disclosed to the relevant Operator or Guest when the information is collected, or disclosed by the Operator to the Guest where the Operator directs the processing.
• With the consent of the Operator or Guest whose personal information is involved, where consent is the required lawful basis.
• To artificial intelligence service providers where necessary to provide an AI-enabled feature used or enabled by an Operator. Where Guest personal information is involved, we make the disclosure in accordance with the Operator's documented instructions, including its use of the Platform, and the applicable Data Processing Addendum. Any disclosure we make for a purpose we determine independently is limited to a specific purpose expressly described in this policy and permitted by applicable law.
• To comply with any court order, law, or legal process, including to respond to any government or regulatory request, according to applicable law.
• To enforce our rights under contracts with Operators or other contracting parties, including the Platform terms of service, and for billing and collection.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Solodigitalis Inc., our customers, or others. This includes exchanging information with other companies and organizations for fraud prevention and credit risk reduction.

We may transfer Operator personal information and Guest personal information to contractors, service providers, and other third parties that support the Platform. Where Guest personal information is involved, we process and disclose it as necessary to provide the Platform and the features selected or configured by the Operator, in accordance with the Operator's documented instructions, including its use of the Platform, and the applicable Data Processing Addendum. Details about processing locations, data residency options, and our current list of subprocessors are provided in our Data Processing and Residency Statement: https://booth.events/data-processing.

An Operator may configure the Platform to copy event photographs to a connected Dropbox, Google Drive, or SmugMug account, or to transmit session details, including a Guest's email address, phone number, and survey answers, to a webhook address designated by the Operator. The Operator's connection, configuration, or activation of that feature constitutes its documented instruction for us to make the transmission, subject to the Terms and the applicable Data Processing Addendum. Once the information reaches the Operator-selected destination, that destination and the Operator's use of it are outside our control and are not governed by our retention or deletion schedules. Our Terms require the Operator to ensure that the destination, transmission, notices, permissions, security measures, retention practices, and responses to individual rights requests comply with applicable law. We do not control the Operator's independent compliance with those requirements. This allocation does not limit any obligation that applies directly to us as a processor or service provider.

We do not use quality-assurance review as general content monitoring and do not undertake to review all event content. If authorized personnel encounter content that they reasonably believe may be unlawful, exploitative, or otherwise prohibited by our Terms, they may restrict access, preserve information where permitted or required by law, notify the relevant Operator where appropriate, and make disclosures to law-enforcement, child-protection, or other competent authorities where required or permitted by applicable law. Content that is prohibited by our Terms but not unlawful may be restricted or removed in accordance with those Terms. Any review, preservation, restriction, removal, or disclosure will be limited to what is reasonably necessary for the applicable security, legal, support, or enforcement purpose.

TRANSFERRING PERSONAL INFORMATION

We may process and store Operator and Guest personal information in the jurisdictions described in our Data Processing and Residency Statement. When personal information is processed or stored outside the jurisdiction in which the affected person resides, it may be subject to the laws of that location and may be accessible to its governments, courts, law-enforcement authorities, or regulators.

Personal information may be transferred across borders when we and our service providers deliver the Platform. Operator account and service data is hosted in the United States. Guest email and SMS delivery may involve providers in the United States. AI-enabled processing may occur in the countries identified for the applicable provider in our Data Processing and Residency Statement. Guest photographs may be delivered through a content delivery network whose edge locations are distributed globally and whose origin cache is located in France. Before personal information governed by Quebec law is communicated outside Quebec, the enterprise responsible for the information conducts a privacy impact assessment that considers the sensitivity of the information, the purposes and safeguards, and the legal framework applicable in the destination. The communication proceeds only where the assessment supports adequate protection, and it is governed by a written agreement addressing the assessment's conclusions and agreed safeguards. Other transfer mechanisms, including adequacy decisions and the European Commission's standard contractual clauses, are used where required by the law governing the transfer.

Operators and Guests may contact our Privacy Officer for further information about our service-provider practices, including processing outside Canada. Current processing-location and subprocessor information is also available in our Data Processing and Residency Statement. See Contact Information and Challenging Compliance.

We transfer personal information across borders only where permitted by applicable law and subject to the safeguards described above and in our Data Processing and Residency Statement. Where consent is legally required for a particular transfer made on an Operator's behalf, our Terms require the Operator to obtain that consent or other lawful authority before directing the transfer through its use or configuration of the Platform. Where we determine the purposes and means of the transfer, we will obtain any consent required by applicable law before the transfer.

CHOICES ABOUT HOW WE USE AND DISCLOSE PERSONAL INFORMATION

The controls available depend on whether the personal information concerns an Operator or a Guest and on the feature involved. Operators can manage account, marketing, tracking, and device settings through the applicable Platform controls. Guests can manage available tracking and event-experience choices through the relevant Guest interface and may exercise personal-information rights as described below.

• Tracking Technologies and Advertising. Operators and Guests can use the privacy controls available in the relevant Platform interface to manage non-essential cookies and similar technologies. Where applicable law requires prior consent, those technologies will not be activated unless the affected person consents. Consent may later be withdrawn through the available settings. Disabling optional technologies may affect certain non-essential features, but technologies that are strictly necessary to provide the requested service or event experience will remain active.
• Location Information. An Operator can use the applicable device or Platform controls to manage real-time location collection by an Operator-facing app, except where location information is required to complete a purchase or provide a feature requested by the Operator. A Guest-facing experience collects device location only where the experience requests it and the required permission or consent has been obtained. The Platform may also process location information contained in photograph metadata for the purposes described under How We Use Information. Blocking location access, removing metadata before upload, or declining a location-dependent feature may prevent the relevant feature from functioning properly.
• Promotional Offers from the Company. This provision applies to Operators and other persons who have subscribed to marketing communications, not to Guests solely because they appeared in event content. A recipient may unsubscribe from promotional email by using the unsubscribe link in the message or contacting us. This opt-out does not apply to transactional or service communications concerning an account, purchase, requested service, or event experience.

Where behavioural advertising applies to an Operator-facing service, third parties may offer additional controls over their collection or use of Operator information. We do not use Guest personal information for behavioural advertising. Operators can use available industry opt-out tools, including those offered by the Digital Advertising Alliance of Canada and the Network Advertising Initiative. Opting out of a network does not stop all advertising but may prevent that network from tailoring advertisements based on browsing preferences and usage patterns.

DATA SECURITY

The security of Operator and Guest personal information is important to us. We use physical, electronic, and administrative measures designed to protect that information against accidental loss and unauthorized access, use, alteration, and disclosure. Access to identifiable Guest photographs, including for quality assurance and support, is limited to authorized personnel with a work-related need to know, subject to confidentiality obligations and appropriate access controls. We periodically review access permissions and remove access when it is no longer required.

Access to photographs for quality assurance is restricted to authorized full-time employees and one authorized support contractor who require access for their duties and are subject to confidentiality and security obligations. Review is limited to what is reasonably necessary to identify whether the Platform is functioning properly. If the review identifies a technical or support issue, authorized personnel may contact the relevant Operator and may retain the affected photograph with the associated support record only where reasonably necessary to investigate, document, or resolve the issue. Any retained copy is access-restricted and deleted in accordance with the applicable support-record retention period unless longer retention is required or permitted by law.

Where we process personal information on behalf of an Operator, our Data Processing Addendum governs that processing. It addresses documented instructions, confidentiality, security measures, subprocessors, cross-border transfers, assistance with data subject requests and breach obligations, audit information, return or deletion of personal information at the end of the services, and the other matters required by applicable data protection law.

The safety and security of Operator account information also depend on the Operator. Where we provide an Operator with a password, or the Operator chooses one, our Terms require the Operator to keep it confidential and not share it with unauthorized persons.

Transmission through the Internet and mobile platforms is not completely secure. We use measures designed to protect Operator and Guest personal information transmitted through the Platform, but no transmission method can be guaranteed to be secure. Operators and Guests should use available privacy and security settings and avoid sharing access credentials or links with unauthorized persons. This statement does not limit any obligation or liability that cannot lawfully be excluded.

We maintain procedures to identify, investigate, contain, document, and remediate privacy and security incidents. Where we process personal information for an Operator, we will notify the Operator without undue delay after becoming aware of an incident affecting that information and will provide reasonable assistance with investigation, risk assessment, notices, and communications. Where Quebec law applies and a confidentiality incident presents a risk of serious injury, the enterprise responsible for the personal information will promptly notify the Commission d'accès à l'information and the affected persons. We will maintain the confidentiality-incident register required by law and provide it to the Commission on request.

DATA RETENTION

Except as otherwise permitted or required by applicable law or regulation, we retain personal information only for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. Viewing a photograph through the limited quality-assurance query does not create an additional stored copy or extend the photograph's ordinary Platform retention period. If an authorized person saves a photograph because it is reasonably necessary to investigate or resolve a technical, security, abuse, or legal issue, the saved copy is retained only with the applicable incident or support record and only for as long as reasonably necessary for that purpose or as required or permitted by law. When an event or gallery is deleted, the source files are removed from active storage, but cached copies served through our content delivery network may remain retrievable through an existing link for up to seven days unless they are purged earlier. We treat those cached copies as retained personal information during that period and will implement an expedited purge where required to comply with a valid deletion request. When the purposes for which personal information was collected or used have been achieved, we destroy it or anonymize it where permitted by applicable law. Where Quebec law applies, information is treated as anonymized only where it is, at all times, reasonably foreseeable in the circumstances that it irreversibly no longer allows an individual to be identified, directly or indirectly, and the anonymization process complies with applicable statutory and regulatory requirements. Information that is merely de-identified remains subject to applicable privacy obligations. Notwithstanding anything to the contrary in this policy, we do not use Guest photographs or videos, or data derived from them, to develop, train, fine-tune, or improve any machine learning or artificial intelligence model. Current retention information is available in our Data Processing and Residency Statement at https://booth.events/data-processing.

CHILDREN'S PERSONAL INFORMATION

The Platform is intended for use by Operators and is not directed to children acting on their own. Children may nevertheless appear in photographs or videos created at events. Our Terms require the Operator to determine whether and on what basis a child's personal information may be collected, used, or disclosed, to provide any required notice, and to obtain verifiable authorization from a parent or guardian where required by applicable law. Under Quebec law, consent concerning a person under 14 must be given by the holder of parental authority or tutor unless the collection is clearly for the person's benefit. Other jurisdictions may apply different age thresholds, including a default age of 16 for certain consent-based online services under the GDPR, subject to local law. We do not control an Operator's independent compliance with these requirements, and this allocation does not limit obligations that apply directly to us. Children should not independently create an account, make a purchase, or submit contact information through the Platform where they are not legally able to do so. If a person believes that a child's personal information has been processed without the authorization required by law, the person may contact us at media@solodigitalis.com.

ACCESSING AND CORRECTING PERSONAL INFORMATION

It is important that the personal information we hold about Operators and Guests is accurate and current. Our Terms require Operators to keep their account and business information current. We do not control an Operator's independent compliance with that requirement. Operators and Guests may request access to or correction of personal information about them, subject to applicable law. Where we process Guest personal information only on an Operator's behalf, we may refer the request to the relevant Operator or assist that Operator in responding.

We may request specific information to confirm a requester's identity and authority and to locate the relevant personal information. We will provide access or make corrections where required by applicable law. Where we process Guest personal information only on an Operator's behalf, we may refer the request to the relevant Operator or assist that Operator in responding. Applicable law may permit or require refusal of access to some or all of the information, or the information may already have been destroyed, erased, anonymized, or de-identified under our retention practices. If access cannot be provided, we will explain why, subject to legal and regulatory restrictions.

An Operator or Guest who is concerned about our response or wishes to correct personal information may contact our Privacy Officer at media@solodigitalis.com. Where the information is processed only on an Operator's behalf, we may refer the matter to the relevant Operator or assist that Operator in responding.

Proper access and use of information provided on the Platform, including User Contributions, is governed by our terms of use.

OTHER PRIVACY RIGHTS

The rights available to an individual depend on the law that applies to the processing and may be subject to statutory conditions, limits, and exceptions. In addition to the access and correction rights described above and the right to withdraw consent described below, those rights may include:

• Deletion. An Operator or Guest may ask us to delete personal information that we hold about that person. We will delete it where required by applicable law, subject to any lawful retention ground or other exception. Where we process Guest personal information only on an Operator's behalf, we may refer the request to the relevant Operator or assist that Operator in responding. Operators and Guests may also request deletion of event data ahead of our normal schedules, as described in our Data Processing and Residency Statement.
• Portability. Where applicable law provides a portability right, an Operator or Guest may ask for eligible computerized personal information collected from that person in a structured, commonly used technological format. Where required by law and technically feasible, the information will be transmitted directly to another organization identified by the requester. Where we process Guest personal information only on an Operator's behalf, we may refer the request to the relevant Operator or assist that Operator in responding.
• Restriction and objection. Where applicable law provides these rights, an Operator or Guest may ask that specified processing of that person's personal information be restricted or may object to processing on particular lawful grounds, including direct marketing. Where we process Guest personal information only on an Operator's behalf, we may refer the request to the relevant Operator or assist that Operator in responding.
• Complaints. An Operator or Guest may raise a concern with our Privacy Officer. The person may also complain directly to the privacy regulator or supervisory authority with jurisdiction over the matter, including the Commission d'accès à l'information for matters governed by Quebec law, without first contacting us where applicable law permits.

De-indexation and re-indexation. Where Quebec law applies, an individual may ask us to cease disseminating personal information or to de-index a hyperlink attached to the individual's name that provides access to the information, where the statutory conditions are met. The individual may also ask us to re-index a hyperlink where the statutory conditions are met. Where the information is processed or published only on an Operator's behalf, we may refer the request to the relevant Operator or assist that Operator in responding.

Operators may exercise their rights concerning personal information that we hold about them by contacting our Privacy Officer. Guests may also contact our Privacy Officer about their personal information. Where we process Guest personal information only on an Operator's behalf, we may refer the request to the relevant Operator or assist that Operator in responding, as required by applicable law and our Data Processing Addendum. We may need to confirm the requester's identity before acting. If we cannot act on a request because of a legal limit or exception, we will explain why.

WITHDRAWING CONSENT

Where an Operator or Guest has provided consent for a collection, use, disclosure, or transfer of that person's personal information, the person may withdraw that consent where permitted by law. To request withdrawal, contact us at media@solodigitalis.com. Where we process Guest personal information on an Operator's behalf, we may refer the request to the relevant Operator and will implement the Operator's resulting documented instructions as required by applicable law and the Data Processing Addendum. Where we determine the purposes and means of the processing, we will address the withdrawal request directly. Withdrawal may prevent us or the Operator from providing a particular product, service, or event feature, and the applicable impact will be explained when the request is addressed.

CHANGES TO OUR PRIVACY POLICY

We may update this policy from time to time. We will post the revised policy on this page and identify the date of the latest revision. If a change materially affects how we handle personal information, we will provide any additional notice and obtain any consent required by applicable law.

Our Terms require Operators to maintain an active and deliverable account email address and to review updates posted to this policy. We do not control an Operator's independent compliance with those requirements.

CONTACT INFORMATION AND CHALLENGING COMPLIANCE

Solodigitalis Inc.'s Privacy Officer is responsible for overseeing our privacy practices and compliance with applicable privacy laws. Any individual, including an Operator, Guest, or Website User, may contact the Privacy Officer at media@solodigitalis.com with questions, comments, complaints, or requests concerning this policy or personal information handled by us. Where we process Guest personal information only on an Operator's behalf, we may refer the matter to the relevant Operator or assist that Operator in responding.

We have procedures in place to receive and respond to complaints or inquiries about our handling of personal information and our compliance with this policy and with applicable privacy laws. To discuss our compliance with this policy, please contact our Privacy Officer using the contact information listed above.