Privacy Policy

01Who we are

ONS Moments is a service operated by ONS in the Kingdom of Bahrain (“ONS”, “we”, “us”). We process personal data in line with the Personal Data Protection Law of the Kingdom of Bahrain (Law No. 30 of 2018) and the other laws that apply to us.

For any privacy question or request, write to support@onsbh.com.

This policy applies together with our Terms & Conditions and the Face Search Notice and, for photography companies, the Company Agreement signed when the account is created.

02Who is responsible for your data

Photography companies use ONS Moments to deliver the photos of the events they cover. For event photos and the galleries a company publishes, the photography company decides what is photographed, uploaded and shared. It is responsible for informing its client and the guests and for obtaining any consent the law requires. For this processing, ONS acts for the company as its technical service provider.

ONS is responsible for the data it processes for its own purposes: company accounts, guest accounts, the optional face search, payments, security and support.

03The data we collect

Photography companies and their teams

• Account details: company name, the authorized person's name, email, phone number and country, the names and emails of team members, and passwords, which we store only as secure hashes.
• The signed Company Agreement: the agreement text, the electronic signature, the date and time, and the IP address and browser used to sign.
• Coverage details: name, date and time, location and live stream links, cover image, settings and statistics.
• Billing records: purchases, amounts, discount codes and payment status. Card payments are made through our payment provider. We never see or store the full card number; if a company saves a card, we keep only a reference from the payment provider, the card brand and the last four digits.

Event photos

• Photos and edited photos uploaded from cameras, phones or the web console, with technical details such as file name, size and capture time.

Guests

• If you create a guest account: your name, email, phone number if you give it, your password (stored only as a secure hash) and your acceptance of our terms.
• The coverages you join and your activity in a gallery, such as the photos you save.
• Face search data, only if you choose to use it (see “Face search”).

Help requests

• If you send a help request or write to us: your name, company, email, phone or WhatsApp number and your message.

Technical data

• IP address, device and browser type, app version, language, pages and actions, and error and security logs.
• In the apps: a push notification token and the device name, and for camera connections, details such as the camera model, the connection type and the upload speed.
• Cookies and similar storage, as described below.

04How we use data

• To provide the Service: create and manage accounts, run coverages, receive photos from cameras, publish galleries, deliver photos to guests, and send the related emails and notifications (for example when your photos or edited photos are ready, when a camera disconnects, or before a gallery is deleted).
• To process payments, add photo credits and the welcome gift, keep accounting records and prevent fraud.
• To give support, including answering help requests and helping companies set up their cameras.
• To keep the Service secure: sign-in, limits on repeated sign-in, sign-up and help attempts, abuse prevention and the investigation of incidents.
• To improve the Service using aggregated statistics, such as visitor numbers and upload speeds.
• To comply with the law and answer lawful requests from competent authorities.

We do not sell personal data, we do not use it for advertising, and we use face data only to help a guest find their own photos.

05Legal bases

• Performing a contract: accounts, coverages, photo delivery, payments and support.
• Your consent: face search and push notifications. You can withdraw your consent at any time; this does not affect processing that took place before.
• Our legitimate interests: security, fraud prevention and improving the Service, in a way that respects your rights.
• Legal obligations: accounting and tax records and lawful requests.

06Face search

Face search is optional. You can view a public gallery without it.

• When you choose it, you take a selfie. We use it as a face reference and compare it with the faces in that coverage's photos to show you the photos you probably appear in. Only you see your results.
• When a photography company turns face search on for a coverage, the faces that appear in that coverage's photos are indexed so that guests who choose the feature can find their photos. These indexes are used only inside that coverage and are deleted when the coverage ends.
• The face comparison is carried out by Amazon Rekognition (Amazon Web Services) in its Asia Pacific (Mumbai) region, on our instructions. Your selfie is kept in our private storage.
• Your face reference is saved in your guest account, so you can use it in another coverage with one tap. It is never used in another coverage unless you choose.
• You can stop face search in a coverage, which deletes that coverage's copy and your matches there. You can also delete your face reference from your account, which deletes it from your account and from every coverage.
• A match is a help to find photos, not an identity check, and it can be wrong.
• If you are under 18, use face search only with the consent of a parent or guardian.

More details are in the Face Search Notice.

07Who we share data with

• The photography company: the photos and galleries of its coverages and aggregated statistics, such as visitor and match counts. It never receives your password or your face reference.
• Other guests: only what the company publishes in the gallery. Your face search results are private.
• Service providers who act on our instructions and under suitable contracts: Cloudflare (hosting, storage and delivery), Amazon Web Services (face comparison), Tap Payments (card payments, including Apple Pay), our email delivery provider, Apple (the iPhone app and its push notifications) and Google (the Android app).
• Content that a company adds, such as a YouTube live stream or a Google Maps location, is provided by those services under their own policies when you open it.
• Authorities and others, when the law requires it or to protect the rights, safety and security of our users, the public or ONS.
• A buyer or successor, if ONS is merged or sold, with the same level of protection.

08International transfers

Some of our providers process data outside the Kingdom of Bahrain, for example on Cloudflare's global network and in Amazon Web Services' Mumbai region. We transfer data only as the law permits and use providers that apply appropriate security and contractual safeguards.

09How long we keep data

• Coverage photos and face indexes: for the gallery period (30 days by default, plus any extension the company buys). They are then deleted automatically, and the company is notified 3 days before.
• Company accounts: while the account is active. When a company deletes its account, sign-in stops on all devices; user names, emails, phone numbers and passwords are deleted; and all coverages are closed, with their photos, galleries and face data deleted within minutes. We keep only payment records and the signed agreement, for as long as accounting and legal obligations require.
• Guest accounts: until you delete your account. Your face reference stays until you delete it or your account.
• Help requests and support emails: for as long as needed to handle the request and follow it up.
• Security records: for a short time. For example, the counters of repeated sign-in and sign-up attempts are stored only as one-way hashes and are cleared within a day.

10Security

We use HTTPS, passwords stored only as hashes, signed session cookies, access controls, temporary links to files, limits on repeated attempts and secure page headers. Card data is handled by a certified payment provider. No system is completely secure, so if you notice a security problem, please tell us at support@onsbh.com.

11Cookies and similar technologies

We use only the cookies and device storage the Service needs: sign-in sessions for the console and guest accounts, security tokens, and your language choice. We do not use advertising cookies or third-party analytics. If you play a YouTube live stream inside a gallery, YouTube may set its own cookies.

12Your rights

• You can ask to access, correct or delete your personal data, withdraw a consent you gave, object to certain processing, and learn how your data is processed.
• Many choices are in your hands: guests can delete their face data or their whole account from their account page, and companies can delete their account from the app (Account → Delete company account) or by email.
• For a photo a photography company published, contact that company first. We will help and pass on your request where needed.
• Write to support@onsbh.com. We may need to confirm your identity, and we answer within the time the law requires.
• You may also complain to the Personal Data Protection Authority in the Kingdom of Bahrain.

13Children

The Service is not aimed at children. Company accounts are for adults, and guest accounts and face search are for people aged 18 or over, or younger people with the consent of a parent or guardian. Children may appear in event photos; the photography company and the event host are responsible for obtaining the consent required.

14Changes to this policy

We may update this policy when the Service or the law changes. The date at the top shows the latest version. When a change is important, we announce it on the website, in the apps or by email, and we may ask you to accept the new version.

15Contact us

ONS Moments, Kingdom of Bahrain. Email: support@onsbh.com. Website: moments.onsbh.com.