1. Introduction

This Privacy Policy explains how we collect, use, store and share personal data when you use the Kiosk Caricature Crafter service (the “Service”), and describes your rights under the EU General Data Protection Regulation (Regulation (EU) 2016/679, “GDPR”) and Hungarian Act CXII of 2011 on Informational Self-Determination and Freedom of Information.

The Service is an unattended self-service kiosk. You take a photo of yourself at the kiosk, an artificial intelligence system generates a cartoon caricature and a short humorous caption from it, and the result is printed for you on the spot.

2. Data Controller

The controller responsible for your personal data is:

• PERIMEDEUS Tanácsadó Korlátolt Felelősségű Társaság (PERIMEDEUS Kft.)
• Registered office: 8264 Szigliget, Eötvös Károly utca 7., Hungary
• Company registration number (cégjegyzékszám): 19-09-522862
• Tax number (adószám): 23381438-2-19
• Email: info@caricatorture.com

We have not appointed a Data Protection Officer. Please use the contact address above for all data protection matters.

3. What Data We Process

Your photograph (selfie). When you start a session, the kiosk camera takes a photo of you. This image is used solely to generate your cartoon caricature. We do not use it to identify you, we do not perform facial recognition or any other biometric matching, and we do not use it to infer anything about you. It is not published anywhere and is not shared with anyone other than the recipients listed in section 8.

The generated caricature and caption. An AI-generated cartoon image and a short humorous caption are created from your photo and printed for you.

Payment data. Payments are handled by Stripe Payments Europe, Ltd. ("Stripe"). We never receive or store your card details; they are processed in Stripe's secure systems. We receive only a payment identifier confirming that a payment succeeded.

Invoicing data. A receipt is issued for each purchase through Billingo, as required by Hungarian tax law.

Fraud-prevention and technical data. Stripe's payment-security and fraud-prevention system (Stripe Radar) processes information about the payment session in order to detect payment fraud. Our hosting and database infrastructure also processes standard connection data (such as IP address) needed to operate the Service securely.

People in the background. The kiosk camera is aimed at the person using it and framed narrowly. Other people who happen to pass behind you may incidentally appear in the photograph. We do not identify, index or separately retain such incidental images; they are deleted together with the photograph as described in section 10.

4. Purposes and Legal Bases

We process personal data on the following legal bases (GDPR Article 6):

We do not process your personal data for analytics, profiling, advertising or marketing.

5. Providing Your Data

You are not obliged to be photographed. However, the photograph is technically necessary to produce a caricature, so if you do not wish to be photographed we cannot provide the Service. There is no other consequence of declining, and you can stop a session at any point before payment.

6. Automated Decision-Making

The caricature and caption are generated automatically by an artificial intelligence system. This is a creative output only. We do not carry out profiling, and no automated decision is made about you that produces legal effects concerning you or similarly significantly affects you within the meaning of GDPR Article 22.

The printed image is artificially generated and is labelled as such, in line with Article 50 of Regulation (EU) 2024/1689 (the EU AI Act).

7. Children

The Service may be used by children accompanied by a parent or guardian. Under Hungarian law, the age at which a child can consent to information society services on their own is 16.

If you are under 16, please use the kiosk only together with your parent or guardian, who should start the session on your behalf. Where we become aware that a photograph of a child was taken without a parent or guardian present, we will delete it on request without delay.

Parents and guardians can exercise all of the rights in section 11 on behalf of their child using the contact details in section 2.

8. Recipients

Processors — these providers process personal data on our behalf, under a data processing agreement, and only on our instructions:

• Google Ireland Limited (Gemini API) — generates the caricature and caption from your photograph. Your photograph is not used to train Google’s models.
• Google Ireland Limited (Firebase) — hosting, database and infrastructure for the Service and kiosk coordination.

Independent controllers — these providers determine their own purposes for part of the processing, in particular to meet their own regulatory obligations:

• Stripe Payments Europe, Ltd. — payment processing and the Stripe Radar fraud-prevention service.
• Billingo Technologies Zrt. — issuing electronic receipts.

We do not sell personal data and we do not share it with anyone else, except where we are required by law to disclose it to a public authority.

9. International Transfers

Google may process data outside the European Economic Area, including in the United States. Where this happens, the transfer is protected by appropriate safeguards under GDPR Chapter V — the European Commission’s Standard Contractual Clauses and, where applicable, the EU–US Data Privacy Framework.

You can obtain a copy of the safeguards we rely on by contacting us at the address in section 2.

10. Data Retention

Deletion of photographs and caricatures is enforced automatically by our infrastructure, not manually. Photographs are never uploaded to any public location.

11. Your Rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate data;
• request erasure (“the right to be forgotten”);
• request restriction of processing;
• object to processing based on our legitimate interests;
• data portability.

To exercise these rights, contact us at info@caricatorture.com. We respond within one month. If your request is complex, we may extend this by up to two further months and will tell you if we do.

Please note that because photographs and caricatures are deleted automatically within an hour, in most cases we will no longer hold any image relating to you by the time a request reaches us.

12. Right to Lodge a Complaint

If you believe we have processed your data unlawfully, you may lodge a complaint with the Hungarian supervisory authority:

• Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
• 1055 Budapest, Falk Miksa utca 9-11.
• Web: naih.hu · Email: ugyfelszolgalat@naih.hu

You may also complain to the supervisory authority in your EU country of residence, or seek a judicial remedy before the competent court.

13. Cookies and Local Storage

The kiosk is a shared device. We therefore do not use any cookies or local storage for analytics, advertising or marketing.

Stripe’s payment-security and fraud-prevention system (Stripe Radar) runs during payment. These functions are strictly necessary to deliver a payment you have explicitly requested and to meet payment-security obligations, so they do not require your consent.

Any session data held on the kiosk is cleared at the end of each session, so nothing from your visit carries over to the next person.

14. Security

We apply appropriate technical and organisational measures to protect personal data, including encryption of data in transit, access controls limiting who can reach the systems holding personal data, automatic deletion of photographs and caricatures, and a locked, tamper-resistant kiosk enclosure.

15. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal reasons. The “Last updated” date above shows when it was last revised.

16. Contact

For any questions about this policy or your data, contact us at info@caricatorture.com.