Privacy Policy
PRIVACY POLICY
Effective from 08.01.2026, last updated 26.10.2026
1. WHO WE ARE
1.1. The controller of your personal data is Peegel Stuudio OÜ (registry code 17396441), Tatari 64, 10134 Tallinn, Estonia – the self-service photo studio MyReflection ("We").
1.2. For questions and requests, write to us at team@myreflection.eu.
1.3. This policy explains what data we collect, why we use it, how long we keep it and what rights you have. There is a separate section about your photos and gallery (sections 4 and 5).
2. WHAT DATA WE COLLECT
2.1. Booking details: name, email address, phone number, chosen package, time and language. For a company invoice, also the company name, registry code and address. We cannot accept a booking without these details.
2.2. Payment details: amount, time and payment status. We never see or store your card or bank account details – the payment takes place with the payment provider.
2.3. Photos: the pictures you take yourself in the studio.
2.4. Technical data: IP address, device and browser type, pages visited and cookies (see section 9).
2.5. Communication: emails and messages you send us, and your feedback.
3. WHY WE USE YOUR DATA
3.1. To fulfil your booking and provide the service (contract): confirmation, key box code, reminder, gallery link and invoice.
3.2. Customer support: to answer your questions and solve problems (contract, legitimate interest).
3.3. Accounting (legal obligation).
3.4. Security and preventing misuse (legitimate interest): for example, preventing gallery links from being guessed, and security cameras in the studio.
3.5. Marketing only with your consent – for example, photos you have shared with us (section 5).
3.6. We do not sell your data or use it for automated decision-making.
4. YOUR PHOTOS AND GALLERY
4.1. Your photos belong to you. There is no photographer in the studio – you take the pictures yourself. We do not look at your photos or use them without your permission. If there is a technical problem with your gallery (e.g. it does not open), we may access it only to fix the problem. We are also obliged to hand over data if required by law (e.g. by the police).
4.2. Photos are saved on the studio computer and uploaded over a secure (encrypted) connection to our server in Estonia. We send the gallery link to your email.
4.3. Your gallery is private. Its address contains a random code. We never make your gallery public, and search engines are not allowed to index it. Anyone who has the link can open the gallery – share it only with people you trust, and never publicly. Guessing gallery links is technically blocked.
4.4. Your gallery is available for 14 days. One day before deletion, we send you a reminder so you can download your photos. After that, the photos are deleted automatically from both our server and the studio computer. Photos that came out too dark (e.g. due to a lighting fault) are kept on the studio computer for up to 3 days so they can be recovered.
4.5. You decide how long your photos are kept:
– You can delete individual photos in your gallery. They disappear from the gallery immediately and from the studio computer within 14 days at the latest.
– With the "Delete gallery" button, we delete the whole gallery from our server immediately and from the studio computer within a few minutes.
Deleted photos cannot be recovered – we do not keep backups of gallery photos.
4.6. At workshops, we may take photos and videos for marketing purposes, but we ask participants for their consent beforehand.
5. "SHARE WITH US" – PHOTOS YOU HAVE SHARED WITH US
5.1. In your gallery, you can tap "Share with us" next to any photo. By doing so, you consent to us showing that photo on MyReflection's Instagram and in the virtual gallery on myreflection.eu. Consent is voluntary and applies only to that one photo.
5.2. By sharing, you confirm that you are in the photo and that everyone in it agrees to it being shared.
5.3. We never add your name or contact details to the photo. The photo is not sold or given to third parties.
5.4. We keep a copy of the shared photo and the consent details (time, gallery, language, version of the terms valid at the time of consent, and your IP address in irreversible form) in a separate folder until you withdraw your consent. For security, we back up this folder. Deleting your gallery, or its expiry, does not delete shared photos.
5.5. You can withdraw your consent at any time: while your gallery is available, with the "Stop sharing" button; afterwards, by writing to team@myreflection.eu. We will then delete the copy (including from the backup) and remove the photo from Instagram and the virtual gallery as soon as possible, and within 30 days at the latest.
6. WHO WE SHARE DATA WITH
We share data only with partners who help us provide the service and are obliged to protect it:
– Zone Media OÜ (Estonia) – server hosting and sending emails;
– Montonio – payment service (bank links);
– Meta Platforms (Facebook, Instagram) – measuring website visits and publishing shared photos on Instagram;
– Telegram – internal notifications to the studio owner (only the booking number and time, without your name or contact details);
– partners through whom you booked or bought a gift card (e.g. Nomipass, kingitus.ee) – only the details of that booking or gift card;
– our accountant and public authorities, where required by law.
Some partners (e.g. Meta) may process data outside the European Union. In that case, safeguards approved by the European Commission apply.
7. HOW LONG WE KEEP DATA
– Photos: 14 days (see section 4.4), unless you delete them earlier.
– Photos shared with us: until you withdraw your consent.
– Booking and invoice details: 7 years (Estonian Accounting Act).
– Communication: as long as needed to resolve your question, but no longer than 3 years.
– System logs: 60 days.
– Security camera recordings: 24 hours (overwritten automatically).
– Database backups: 90 days.
8. SECURITY
8.1. The website uses a secure connection (SSL). The server is located in Estonia.
8.2. Only authorised persons have access to the data.
8.3. Gallery links are protected against guessing, and search engines are not allowed to index galleries.
8.4. There are security cameras in the studio to protect the property. Recordings are overwritten automatically within 24 hours. We only view a recording if damage or another incident has occurred in the studio.
9. COOKIES
9.1. Essential cookies: language choice and gallery language. The site does not work properly without them.
9.2. Statistics: an anonymous visit ID and a campaign link ID, so we can see how the site is used and where visitors come from. We store IP addresses only in irreversible form. This data is not shared with anyone.
9.3. Marketing: the Meta (Facebook) pixel, to measure how well our ads perform. It is loaded only if you click "Accept" in the cookie window.
9.4. You can change your choice at any time with the "Cookie settings" link at the bottom of the page. You can also delete cookies in your browser settings.
10. YOUR RIGHTS
You have the right to:
– know what data we hold about you and receive a copy of it;
– have your data corrected;
– have your data deleted, unless the law requires us to keep it (e.g. invoices);
– restrict or object to the processing of your data;
– receive your data in a machine-readable format;
– withdraw your consent at any time.
Write to us at team@myreflection.eu. We will reply within 30 days.
If you believe we have violated your rights, you can contact the Estonian Data Protection Inspectorate (www.aki.ee).
11. CHANGES
We may update this policy from time to time. The current version and its date are always on this page. If there are significant changes, we will let you know by email.