Privacy policy

What this is about

This policy describes which data is processed when you use rinovasignage.at and the associated player software, why, and what rights you have. The legal basis is the General Data Protection Regulation (GDPR).

No automated decision-making, including profiling, takes place.

Account data

On registration we collect: company name, e-mail address, password (stored only as an irreversible hash) and optionally contact person, phone number and country.

Purpose: providing the account, billing, contact in case of faults.
Legal basis: performance of contract (Type. 6(1)(b) GDPR).
Retention: for the life of the account; thereafter until statutory retention periods expire (in Austria seven years for invoice data).

Company name, e-mail address and password are required to conclude the contract – without them no account can be set up. The other details are optional.

Screen (player) data

Every registered player regularly reports technical values to the server:

• device identifier, software version, screen resolution, model
• IP address (public and local), network type, Wi-Fi name and signal strength
• temperature, uptime, free storage, power supply status
• last played content and play duration (“proof of play”)
• a still image of the screen content at regular intervals and on request

Purpose: operating and monitoring playback, fault reports, proof of playback towards advertisers.
Legal basis: performance of contract (Type. 6(1)(b) GDPR).
Retention: still images are overwritten; playback logs are deleted after 12 months; the IP address of a player is deleted 90 days after its last contact.

Important note for operators: the still image shows what is currently on the screen. Please set up the screen so that no personal data of third parties appears on it. The player captures only the displayed content – it has no camera or microphone and does not record people or their behaviour.

Uploaded content

We store the images, videos and texts you upload for delivery to your screens. We do not review or analyse this content. You are responsible for the rights to it.

Legal basis: performance of contract (Type. 6(1)(b) GDPR).
Retention: until you delete it or the account is deleted.

Server logs

On every access the web server stores the IP address, time, requested address and browser identifier. This serves security and troubleshooting (legitimate interest, Type. 6(1)(f) GDPR) and is deleted after 14 days.

Cookies

We use only technically necessary cookies – no tracking, no advertising cookies, no analytics:

• SIGSESS – keeps you logged in during your visit; ends when the browser is closed
• sig_lang – remembers the chosen language; one year

As only necessary cookies are used, no consent banner is required. Legal basis: performance of contract for the login (Type. 6(1)(b) GDPR) and legitimate interest in secure operation (Type. 6(1)(f) GDPR).

Processors

All processing of account and screen data takes place within the EU. A data processing agreement is in place with Hetzner.

About the map: anyone opening the technical overview or the portal with the location map loads map tiles directly from OpenStreetMap – or from Esri if OpenStreetMap does not respond. Their server thereby learns the viewer's IP address and the requested map section (legitimate interest in a clear display of locations, Type. 6(1)(f) GDPR). No account or device data is transmitted.

Disclosure

We do not sell data and do not pass it on for advertising purposes. Data is disclosed only to the service providers listed above, as far as necessary for operation, or where we are legally obliged to.

Transfers to third countries

Account and screen data do not leave the EU. Only in three cases do recipients outside the EU receive data: Esri (USA) receives the viewer's IP address when fallback map tiles are loaded – Esri is certified under the EU-US Data Privacy Framework (adequacy decision, Type. 45 GDPR). Let’s Encrypt (USA) receives only the domain name for the encryption certificate. Telegram (UAE) receives fault alerts containing only device names, site labels and states. In the latter two cases no personal data is transferred.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You may object to processing based on our legitimate interests on grounds relating to your particular situation (Type. 21 GDPR). A short message to office@smartinfodisplay.at is sufficient.

If you believe we are not processing your data lawfully, you may lodge a complaint with the Austrian Data Protection Authority (dsb.gv.at).

Retention and operation

Audit log (who changed what, with IP address; legitimate interest in traceability and security, Type. 6(1)(f) GDPR): 24 months; deleted accounts remain only as a number. Web server logs: 14 days. Playback logs: 12 months. Technical readings of the installations (brightness, temperature, switching states) are condensed to hourly values after 90 days; the raw values are archived pseudonymised (device number only) and encrypted on a Hetzner Storage Box so that evaluations remain possible years later. Live images of the screens are available only to signed-in users of the respective account. Service photos and signatures document the service work and are kept for the duration of the contract.

Account administrators can download all data of an account at any time as a file (JSON) under Settings. On request we delete an account completely – a message to office@smartinfodisplay.at is sufficient.

Security

The connection is encrypted end-to-end via HTTPS. Passwords are stored only as hashes, VNNOX credentials are encrypted. Two-factor login is available for accounts and mandatory for administrative accounts. The server receives automatic security updates and is backed up daily.