Legal notice and Privacy Policy

1. Data Controller

In accordance with article 10 of Law 34/2002, of 11 July, on Information Society Services and Electronic Commerce (LSSI-CE):

Name: PROMO-TIENDA, S.L. ("PROMOTIENDA")
Address: Avda. Paral·lel, 110, 08015 Barcelona (Spain)
Tax ID (CIF): B60840675
Phone: +34 93 329 74 64
Email: comercial@promotienda.es
Registered with: Barcelona Commercial Registry, Volume 28,140, Folio 10, Sheet B-131680
Privacy contact: privacidad@digitalsignagerds.com

2. Scope

This Legal Notice and Privacy Policy governs:

The corporate website www.digitalsignagerds.com.
The SaaS application rds.digitalsignagerds.com ("the Application"), which allows business customers to manage digital signage devices, playlists, media content and the associated billing.
The Android app Digital Signage RDS, which turns an Android screen into a digital signage player managed from the Application (see section 3a).

3. Data we process and purposes

Category	Data	Purpose	Legal basis (GDPR)	Retention
User account	name, username, email, password (hash), language, company, role	Create and maintain the account, authenticate the user, provide the service	Performance of a contract (art. 6.1.b)	For the duration of the contract + 2 years
Security and 2FA	login attempts, last login, 2FA codes sent by email, trusted-device cookie	Protect the account against unauthorised access	Legitimate interest (art. 6.1.f) and statutory security obligation	12 months for access logs
Billing data	company name, tax ID (NIF/CIF), billing address, Stripe customer ID, subscription history	Manage billing and subscription payments	Performance of a contract (art. 6.1.b) and legal obligation (art. 6.1.c)	6 years from the last transaction (art. 30 Spanish Commercial Code, tax legislation)
Customer content	images, videos, playlists, devices, locations	Provide the contracted functionality	Performance of a contract (art. 6.1.b)	For the duration of the contract + 90 days
Marketing communications	email, name, language, consent flag (`marketing_consent`), consent timestamp, unsubscribe token	Sending newsletters and promotional communications by email	Consent (art. 6.1.a GDPR; art. 21 LSSI-CE)	Until consent is withdrawn or unsubscription is requested
Terms acceptance	date and version accepted	Evidence of contractual consent	Legal obligation (art. 6.1.c)	Contractual limitation period (5 years, art. 1964 Spanish Civil Code)
Activity logs	user actions, IP address, date/time	Audit, security, fraud prevention	Legitimate interest (art. 6.1.f)	12 months
Contact data (web form)	name, email, phone number (optional), message	Respond to the request	Consent (art. 6.1.a)	1 year from the last communication
Free tools on the website (queue display, welcome screen, readability checker, QR code menu)	email address, language, tool used, source page and campaign parameters (utm, gclid); the screen created (the queue room or welcome screen identifier) and its edit links, stored only as a cryptographic hash; for welcome screens, a copy of their key, encrypted with AES-256-GCM under a key kept in the server configuration, outside the database (whoever controls the server could decrypt it and read the screen); if you import a welcome screen into your Application account, its key is also stored there encrypted, under a key outside the Application database (whoever controls that server could decrypt it); if you tick the optional news box, the date and the wording you accepted (no IP address)	Send you the tool’s result (your screen links and private edit link, or the report summary); resend the links when you ask (“Recover your screens”); send you, over the following week, two emails with tips about the tool you used; if you register in the Application with the same verified email and accept it, import into your account the screens you opened from the links in your email; and, only if you tick the box and confirm it with the link we email you, send you RDS news and offers	Performance of your request for the free service (Art. 6.1.b) for the result, the links and the import; legitimate interest (Art. 6.1.f) for the two tips emails, with an unsubscribe link in each; consent (Art. 6.1.a GDPR; Art. 21 LSSI-CE) for news and offers	Each screen’s data and links, while the screen exists (a queue room is deleted after 24 hours without use; a welcome screen when it expires, after 1 to 30 days); your email on the website, until 30 days after no screen or pending email remains. The record of the email and the tool used, 24 months; if you accepted news, until you unsubscribe
Free AI QR code menu (free tool on the website)	the photos or PDF of the menu the visitor uploads; the menu text extracted from them (venue name, sections, dishes, descriptions, prices, allergens and tags) and any changes made to it; the menu identifier and its edit key, which the menu service keeps only as a cryptographic digest (hash) and this website, so it can resend the links, encrypted with AES-256-GCM under a key held outside the database; the email address and campaign data of the previous row; to limit abuse, a cryptographic digest (HMAC) of the IP address	Reading the menu with an AI model and turning it into a digital menu that the visitor reviews and corrects; publishing it on a web page with its QR code once the visitor gives an email address, and keeping it so it can be changed; sending the links and the emails of the previous row; limiting the number of uploads per IP address. To read the menu, a downscaled copy of each page, without metadata, is sent to Anthropic (Claude) and, if it is unavailable, to Google (Gemini) (section 5). Uploaded files are not stored	Performance of your request for the free service (Art. 6(1)(b)); legitimate interest (Art. 6(1)(f)) in preventing abuse of the service	Photos and PDFs: not stored; deleted when reading finishes, within seconds. Unpublished draft: 72 hours after the last change. Published menu: until you delete it from your edit link or after 12 months with no visits and no edits. IP digest: 48 hours. Email: as in the previous row
Call booking (Calendly)	name, email address, the other fields of the Calendly booking form, time zone, IP address and the chosen date and time	Arranging and holding the free 30-minute call with an engineer, and following it up commercially	Consent (art. 6.1.a) given when booking; legitimate interest in the commercial follow-up (art. 6.1.f)	2 years from the call, unless you ask for erasure sooner
Support chat (rds.digitalsignagerds.com)	the messages you write in the chat and their translations, the language, the page you write from and, if you are signed in, your user and company identifiers; also an anonymous identifier assigned by the chat widget itself	Answering your questions with an AI assistant based on the RDS documentation, translating messages between your language and the team's, and handing the conversation to a person when you ask or the assistant cannot help. Answers are written by Anthropic's Claude AI model (section 5), which receives the message, the latest turns of the conversation and documentation excerpts; once a person on the team is handling the conversation, Claude may also draft a suggested reply for them from your question and the documentation. Google Gemini (section 5) receives each message to classify it (a question about RDS, a request to talk to a person, an unrelated topic, an attempt to manipulate the assistant, or abuse), to compute the numerical representation used to search the documentation excerpts, and to translate messages; if Claude is unavailable, Gemini also writes the answer. Neither receives your name, email address or identifiers. So that the support team can follow them and step in, every conversation is copied, translated into Spanish where needed, to the team's inbox on Telegram (section 5)	Legitimate interest in answering your questions (art. 6.1.f) and, if you are a customer, performance of the contract (art. 6.1.b)	For as long as needed to handle the question and as support history; you can request erasure at any time (section 10)
3D Maps AI assistant	the questions a venue's visitors pick or type on the map; that venue's published information (places, categories, descriptions, tags and opening hours); to limit the number of questions, a cryptographic hash of the IP address that is kept in memory only	Answering visitors' questions with the venue's places and offering them the route. It is off by default and each venue switches it on. It is not intended to receive personal data, and the assistant itself asks visitors not to enter any. The question and the venue information are sent to the AI model (Google Gemini, section 5)	Legitimate interest (art. 6.1.f) in answering the visitor's question	Typed questions are not stored, only counted per day. Answers to suggested questions are kept for up to 30 days, with no visitor data; the IP hash is not stored
Corporate site visit statistics (no cookies)	per page view: path, language, source as a category (and, where applicable, the referring domain and the campaign name), screen class (phone, tablet or computer), time the tab was visible, scroll percentage, sections reached and buttons clicked, with a random number that only exists while the page is open; on account creation, the source category and the entry page. No cookies, no IP address, no user agent and no click identifier; the time of each page view only to the hour	Understanding what visitors do on the site, especially after an ad, and how many reach sign-up and create an account, to improve the site and our campaigns (details in the Cookie Policy, section 4.5)	Legitimate interest (art. 6.1.f)	Page-view data 90 days; after that, only aggregated daily counts. The source stored with an account, like the rest of the account data
Web server access and error logs (corporate site and Application)	for every request: IP address, date and time, the requested address with its parameters (including, if present, an ad click identifier such as `gclid` and campaign tags), the address of the referring page and browser details (user agent); in the error logs, the IP address, requested address and referring page of requests that fail	Security (detecting attacks and abuse) and running the service (diagnosing errors). Not combined with the visit statistics and not used to build profiles (details in the Cookie Policy, section 4.5)	Legitimate interest (art. 6.1.f)	At most 15 days

Backups. We keep backups only so that we can restore the service after a failure. The database is backed up every night: those copies, including the ones held in the weekly server snapshots (the last 4 snapshots are kept), remain for up to about 5 weeks, and an encrypted copy of each night's backup is also kept off-site at Amazon Web Services in the EU (Paris, France), where it cannot be changed or deleted for 30 days and is deleted automatically after 40 days. Files stored on our servers (such as uploaded content) are backed up every day, and each copy is kept for 35 days. A copy of any data in this policy can therefore remain in a backup for up to about 6 weeks after it is deleted or the period stated for it ends; after that, it is deleted automatically.

3a. Android app (Digital Signage RDS)

This section applies to the Android app Digital Signage RDS, both the version published on Google Play (package com.digitalsignagerds.app) and the APK downloaded directly from the Application; where the two differ, this is stated. The app turns an Android screen into a digital signage player managed from the business customer's RDS account. It shows no advertising and does not sell data. It does not share the data listed below with third parties beyond the processors listed in section 5 (hosting on Amazon Web Services). To estimate an approximate location, it may also send the screen's public IP address to the IP geolocation service ipwho.is (see "Approximate location from the IP address").

Data the app sends to RDS

The app sends the following data to the RDS server the screen is paired with:

Category	Data	Purpose	Legal basis (GDPR)	Retention
Device and status	device and screen identifiers, model, Android version, app version, storage, network, uptime	Show the status of each screen in the account owner's panel, deliver its content and provide support	Performance of a contract (art. 6.1.b)	While the customer's account remains active
Location	location of the screen: from the device's location services if the location permission is granted and a position is available; otherwise, an approximate location estimated from the device's public IP address (see below)	Show in the account owner's panel where the screen is installed	Performance of a contract (art. 6.1.b)	While the customer's account remains active
Touch interaction	taps on the screen (position and time)	Produce the account owner's interaction reports	Performance of a contract (art. 6.1.b)	While the customer's account remains active
Playback records	which files were played and when: content type and identifier, file name, start time, duration and the reason playback ended, including files played from USB drives or local folders	Produce the account owner's playback reports	Performance of a contract (art. 6.1.b)	While the customer's account remains active
Remote screenshots	an image of the whole display (Android 11 or later, with the accessibility service enabled) or otherwise of what the app itself is displaying, when requested from the panel (in the Google Play version, only if the operator has accepted; see below)	Check what the screen is displaying and provide remote support	Performance of a contract (art. 6.1.b)	72 hours by default
Logs and diagnostics	app logs and diagnostic data	Detect and fix faults and provide technical support	Performance of a contract (art. 6.1.b)	While the customer's account remains active

Approximate location from the IP address

When the screen does not have the location permission, or has it but no position is available, the app sends the device's public IP address to the IP geolocation service ipwho.is to estimate an approximate location, and reports that approximate location to the RDS server. This applies to both versions of the app. ipwho.is receives the IP address the request is made from.

Screenshots and the accessibility service

Remote screenshots are taken when an authorised user of the RDS account requests them from the panel. On Android 11 or later, with the app's accessibility service enabled, the app uses Android's AccessibilityService API, which captures the whole display. Otherwise (Android versions earlier than 11, or when the service is not enabled) the app captures an image of what it is itself displaying: its own window, including any web page or media it is showing. Images are sent only to the RDS server the screen is paired with and are deleted after 72 hours by default.

Google Play version (com.digitalsignagerds.app): before any screenshot can be taken, by either method, the app shows a prominent disclosure on the screen, and images are captured only if the operator accepts it. If the operator declines, the app remains fully functional. In this version the accessibility service declares only the capability to take screenshots: it receives no accessibility events, reads no window content, performs no actions and is not an accessibility tool.

APK downloaded directly from the Application: this version shows no disclosure and does not ask for acceptance. A screenshot is taken, by the method described above, on every request from the panel, whether or not the accessibility service is enabled. Its accessibility service configuration is broader than the Google Play version's (for example, it is declared to receive accessibility events).

Local content, credentials and security

Images and videos on USB drives or in local folders are played on the device itself; the files are not uploaded to any server. Their playback records, including each file's name, are sent as described above.
RDS account credentials entered in the app are used only to authenticate with RDS.
The app sends data to the RDS server over HTTPS (TLS).

Retention and deletion

Data sent by the app is kept while the customer's RDS account remains active, except screenshots, which are deleted after 72 hours by default. Deletion can be requested through the account owner or by writing to privacidad@digitalsignagerds.com, as described in section 10.

4. Source of the data

The data is provided by the data subject themselves, whether when registering for the Application, when using it, or when contacting PROMOTIENDA.

5. Disclosures to third parties and data processors

In order to provide the service, PROMOTIENDA relies on the following data processors, with which it maintains contracts under article 28 GDPR:

Processor	Service provided	Location
Amazon Web Services EMEA SARL	Hosting of the Application (EC2), database and backups	Ireland (EU); off-site copy of the database backups: France (EU)
Amazon Web Services EMEA SARL (SES)	Transactional and marketing email relay	Ireland (EU)
Stripe Payments Europe, Ltd.	Payment processing and subscription management	Ireland (EU) + United States
Soluciones Corporativas IP, S.L.U. (DonDominio)	Secondary SMTP relay	Spain (EU)
Calendly LLC	Booking of the free 30-minute call with an engineer (calendar embedded on the corporate site)	United States
Google Cloud EMEA Limited (Gemini API)	AI model that, in the support chat, classifies each message, computes the numerical representation used to search the documentation excerpts and translates messages; writes the answers of the 3D Maps assistant; translates restaurants' menus in Digital Menu at the restaurant's request; and stands in for Claude (Anthropic) when it is unavailable: it then writes the chat answers and, at the request of the venue administrator or the restaurant, translates texts in the 3D Maps editor and generates the Digital Menu design. We use the paid service, for which Google states that it does not use prompts or responses to improve its products, and processes them under its Data Processing Addendum for Products Where Google is a Data Processor In the free QR code menu tool, it reads the photos or PDF of the menu when Claude is unavailable (section 3).	Ireland (EU); the data may be stored transiently or cached in other countries where Google or its agents have facilities (section 6)
Anthropic Ireland, Limited (Claude API)	AI model (Claude) that writes the answers of the support chat and the draft replies suggested to the team when a person is handling a conversation; translates texts in the 3D Maps editor at the venue administrator's request; and, at the restaurant's request, generates the design of its menu in Digital Menu from the restaurant's name, the description it writes and its current design. We use the paid API, governed by Anthropic's Commercial Terms, under which Anthropic may not train models on the content we send, and by its Data Processing Addendum. Anthropic deletes API inputs and outputs within 30 days, unless the law requires it to keep them or they are flagged for violating its usage policy, in which case it may keep them for up to 2 years In the free QR code menu tool, it reads the photos or PDF of the menu the visitor uploads to extract its text (section 3).	United States; the model may also run in other countries (section 6)

Calendly LLC relies on its own sub-processors inside the embedded calendar — Cloudflare, OneTrust, Stripe, Google (reCAPTCHA and the Google Identity Services identity library) and Airbrake — as well as on a device-fingerprinting service of its own. What each of them receives, for what purpose and which cookies it sets — if any — are set out in section 4.4 of the Cookie Policy.

In addition, the Android app (section 3a) sends data to the following third-party service:

Third party	Data it receives	Purpose
IP geolocation provider ipwho.is	the screen's public IP address	Estimating the screen's approximate location when the app has no location permission or no position available

The support chat (section 3) also sends data to the following third-party service:

Third party	Data it receives	Purpose
Telegram Messenger Inc. (Telegram, through its Bot API)	the conversation's messages (yours, the assistant's replies and the team's) and, where needed, their Spanish translation; the language, the site and the page you write from and, if you are signed in, your RDS user identifier, which the team can look up in any conversation	Delivering chat conversations to the support team, who follow and answer them from Telegram

If you accept them in the cookie banner, the corporate site also sends data to the following third-party services (details in section 4.4 of the Cookie Policy):

Third party	Data it receives	Purpose
Microsoft Corporation (Microsoft Clarity)	how you interact with the corporate site's pages (mouse movements, clicks, scrolling and the page content, with whatever you type into forms hidden), the page address, technical data about your device and browser, your IP address and the pseudonymous identifiers in its `_clck` and `_clsk` cookies	Visit recordings and heatmaps to understand how the site is used and improve it
Google Ireland Ltd. / Google LLC (Google Ads)	that you arrived from one of our ads and its click identifier, the pages you visit, your IP address and the identifiers in its advertising cookies; if you submit a form on a page where the tag is running (for example, the email field of the free AI QR code menu), an email address, phone number or postal address it detects there, sent as a SHA-256 hash, not as readable text. The tag also runs on the Application’s sign-up page, if you accept it there	Measuring the conversions of our advertising campaigns; Google can compare the hashed data with its own account data to attribute them. Involves an international transfer to the United States (Google LLC): see section 4.4 of the Cookie Policy

Additionally, data may be disclosed to the competent authorities when required by law.

6. International transfers

Calendly LLC (United States), which handles booking of the free 30-minute call with an engineer, processes the booking data in the United States. The Google advertising cookies described in the Cookie Policy may likewise involve a transfer to the United States; section 4.4 of the Cookie Policy states, for each third party, whether it loads before or after your consent is obtained. Both transfers are carried out under the Standard Contractual Clauses (Decision 2021/914) and, where applicable, under the EU-US Data Privacy Framework.

Google Cloud EMEA Limited (Ireland) provides the Gemini API used by the support chat, the 3D Maps AI assistant, Digital Menu's menu translation and, when Claude is unavailable, the 3D Maps editor's translation and the Digital Menu design (sections 3 and 5), and processes the data as a processor under Google's Data Processing Addendum. Under Google's terms, the data sent may be stored transiently or cached in any country where Google or its agents maintain facilities. For such transfers outside the EEA, the Addendum provides that the EU-U.S. Data Privacy Framework applies to transfers to certified Google entities in the United States, and the Standard Contractual Clauses (processor to processor) to transfers from Google to its subprocessors. The free QR code menu tool also uses it to read the menus visitors upload (section 3).

Anthropic provides the Claude API used by the support chat, the 3D Maps editor's translation and Digital Menu's AI design (sections 3 and 5). For customers established in the European Economic Area, such as PROMOTIENDA, the contracting party is Anthropic Ireland, Limited (Ireland), which processes the data as a processor under Anthropic's Data Processing Addendum, part of its Commercial Terms. The data is stored in the United States, and the model may run in the United States or in other countries where Anthropic has infrastructure. For such transfers outside the EEA, the Addendum incorporates the Standard Contractual Clauses approved by the European Commission (Decision 2021/914; Module 2, controller to processor, and Module 3, processor to processor). The free QR code menu tool also uses it to read the menus visitors upload (section 3).

Telegram Messenger Inc., which provides the messaging service in which the support team receives chat conversations (sections 3 and 5), is established outside the European Economic Area and processes this data under its own terms and privacy policy. According to that policy, the data of people who signed up for Telegram from the EEA or the UK is stored in data centres in the Netherlands, and Telegram may share personal data with its group companies in the British Virgin Islands and Dubai under standard contractual clauses approved by the European Commission.

Stripe may process certain data in the United States. This transfer is carried out under the European Commission's Standard Contractual Clauses (Decision 2021/914) and, where applicable, under the EU-US Data Privacy Framework. Apart from the transfers described above and the IP geolocation lookup described in the next paragraph, processing takes place within the European Economic Area.

ipwho.is (IP geolocation used by the Android app; see sections 3a and 5). The legal entity operating ipwho.is and the location of its servers are not published. The service is delivered through Cloudflare, and the privacy policy of ipwhois.io, the provider behind it, states that user data may be stored on servers located in other countries. The screen's public IP address may therefore be processed outside the European Economic Area. No transfer mechanism, such as the Standard Contractual Clauses, is in place with this provider. To limit what is exposed, the app contacts ipwho.is only when the screen has no location permission or no position available, and only to estimate an approximate location; the request carries no data from the app. ipwho.is sees the public IP address the request comes from and the standard technical headers of an Android HTTPS request (such as the system user-agent string, which can include the Android version and device model).

Microsoft Corporation (United States), the provider of Microsoft Clarity, processes in the United States the visit data of those who accept it in the corporate site's cookie banner. That transfer is covered by the EU-US Data Privacy Framework, under which Microsoft is certified, and by standard contractual clauses.

7. Marketing communications (LSSI-CE)

PROMOTIENDA will send marketing communications by email only to users who have expressly granted their consent during registration or at a later stage (the "marketing_consent" checkbox).

Each message includes:

A clear identification of the sender.
An immediate unsubscribe link (one click, no login required) that withdraws consent (/unsubscribe.php?token=...).

The user may revoke their consent at any time without affecting the use of the contracted service.

The free tools on the website ask for an email to send the result and offer, separately, an optional unticked box to receive news. Without that box we only send the result, the links you ask for and two tips emails about the tool you used. Every one of them includes a one-click unsubscribe link (/herramientas/baja.php) that also stops those tips.

8. Security

PROMOTIENDA applies reasonable technical and organisational measures to preserve the confidentiality, integrity and availability of the data, including: encrypted communications (HTTPS/TLS), hashed password storage, two-factor authentication (2FA) — optional or mandatory depending on the role —, CSRF protection, role-based access control and activity logging.

9. Breach notification

In the event of a personal data security breach that poses a risk to the rights and freedoms of the data subject, PROMOTIENDA will notify the Spanish Data Protection Agency (AEPD) within a maximum of 72 hours (art. 33 GDPR) and, where appropriate, the affected data subject (art. 34 GDPR).

10. Rights of the data subject

You may exercise the following rights at any time:

Access, rectification, erasure ("right to be forgotten"), objection, restriction of processing and portability of the data.
Withdrawal of consent previously granted, with no retroactive effect.
Complaint to the Spanish Data Protection Agency (www.aepd.es).

Procedure: send a request by email to privacidad@digitalsignagerds.com, or by post to the address listed in section 1, together with a copy of an identity document. PROMOTIENDA will respond within a maximum of one month from receipt, extendable to two months depending on the complexity or number of requests.

11. Minors

Access to the Application is reserved to persons over 18 years of age or legal representatives of legal entities. PROMOTIENDA does not knowingly collect data from children under 14; if it detects that such data has been provided, it will delete it.

12. Intellectual and industrial property

All rights to the elements of the websites and the Application (trademarks, designs, texts, software, etc.) belong to PROMOTIENDA or its licensors, except for content uploaded by customers, who retain ownership of it. Full or partial reproduction without express authorisation is prohibited.

13. Links to other websites

PROMOTIENDA is not responsible for the content, practices or privacy policies of third-party websites linked from its services.

14. Governing law and jurisdiction

This policy is governed by Spanish law. The parties submit, waiving any other jurisdiction, to the Courts of Barcelona, except where the applicable regulations establish a different mandatory jurisdiction.

15. Amendments

PROMOTIENDA may modify this policy to adapt it to legislative or service changes. The date of update appears at the top of the document. If the changes substantially affect the processing, users will be notified with reasonable advance notice.