GDPR & Data Protection

1) Scope & Roles

Controller: For our website, user accounts, billing, customer support, marketing, security, product analytics/telemetry, and similar first-party processing, TIMONIX DOO, the operator of AdCast Digital Signage, acts as the data controller.

Processor: When personal data is processed through AdCast Digital Signage on behalf of a business customer, TIMONIX DOO acts as a data processor and the applicable business customer acts as the data controller. That processing is governed by our Data Processing Addendum (DPA).

We have not appointed a Data Protection Officer as we do not meet the statutory criteria. You may contact us at privacy@adcast.app.

2) What Personal Data We Process (Controller)

• Account & Identity: name, email, password hash, organization, country.
• Billing: payment token/ID, last-4, VAT/tax info, invoices (via payment provider).
• Device & Display: device/display IDs, OS/version, app version, screen size/orientation, IP address, coarse location (from IP).
• Service Telemetry: playlist/ad playback events, timestamps, error/crash logs, performance metrics.
• Support & Communications: tickets, chat/email content, attachments, feedback.
• Marketing Preferences: newsletter opt-in/out, campaign/UTM data (only if non-essential cookies/SDKs are consented).
• Cookies & Online IDs: strictly necessary cookies; non-essential analytics/ads only after consent.
• Push Notification Token: FCM device token generated by Firebase Cloud Messaging when you grant notification permission; used solely to deliver push notifications to your device.

3) Purposes & Lawful Bases

When we act as a processor, the customer is the controller and determines the lawful basis; we process only on documented instructions (see DPA).

4) Cookies & Consent

• Strictly necessary cookies/SDKs run without consent.
• Non-essential analytics/ads/experimentation do not load until you consent. “Reject all” is as prominent as “Accept all”; no pre-ticked boxes. Consent can be changed any time.
• Consent is managed via AdCast Consent Manager (in-house) with categories and logged choices.

Manage your choices: Cookie Settings· Read our Cookie Policy

5) Recipients & Sub-Processors

We use vetted vendors under data-processing agreements and appropriate safeguards. We disclose the minimum necessary data for the stated purposes. Customers will be notified of material sub-processor changes as required by the DPA.

6) International Transfers & TIAs

When personal data is transferred outside the EEA/UK (e.g., to the United States), we rely on the European Commission’s Standard Contractual Clauses (and UK Addendum where applicable), apply supplementary measures (encryption, access controls, data minimization), and document transfer impact assessments for significant transfers. Where a vendor participates in an adequacy framework (e.g., EU–US Data Privacy Framework), we may rely on it in addition to SCCs where appropriate.

7) Security (Art. 32)

• Encryption in transit (TLS) and at rest (e.g., S3 SSE); key management.
• Least-privilege access, RBAC/MFA, audit logging, and monitoring.
• Network segmentation, WAF/CDN protections, throttling/rate limiting.
• Secure SDLC: code review, dependency scanning, secret hygiene.
• Incident response playbooks, on-call procedures, evidence collection.
• Backups and disaster recovery with periodic restore testing.
• Vendor due diligence and contractual security obligations.

8) Data Retention

We keep personal data only as long as necessary for the purposes described above or to meet legal obligations, then delete or irreversibly anonymize it.

TIMONIX DOO retains personal data only for as long as necessary for the purposes for which it was collected or processed, including providing and securing the AdCast Digital Signage services, fulfilling contractual obligations, resolving disputes, and complying with applicable legal obligations.

9) Your Rights (EEA/UK)

You can request access, rectification, erasure, restriction, portability, and objection, and you may withdraw consent at any time (withdrawal does not affect prior lawful processing). We respond within one month (extendable by two months for complex requests) and may verify your identity.

How to exercise: use our GDPR request form or email privacy@adcast.app.

You may lodge a complaint with your local supervisory authority (EU list via the EDPB; UK: ICO).

10) Children

AdCast is not directed to children and should not be used by individuals under the age of 16 without parental consent where required by law.

11) Automated Decision-Making

We do not make decisions producing legal or similarly significant effects solely by automated means. If this changes, we will provide meaningful information and a right to human review.

12) Data Breach Notification

We assess suspected personal-data incidents without undue delay. Where required, we notify the competent supervisory authority within 72 hours and affected individuals without undue delay.

13) Changes

We may update this page to reflect legal, technical, or business developments. We will indicate the “Last updated” date and, where appropriate, notify you.

14) Contact

TIMONIX DOO
Carkovacka 30v
34206 Donja Sabanta, Serbia
Email: privacy@adcast.app
Phone: +381 63 302 531

Appendix A - Processor Activities (Summary for Customers)

Subject matter & duration: operation of AdCast Player and related services for the term of the customer agreement.

Nature & purpose: storage, transmission, processing of media/playlists, device telemetry, and related support.

Types of data: device/display IDs, playback timestamps/events, IP address, user/admin account details in the customer workspace, support content.

Categories of data subjects: customer admins and users, and display operators, to the extent their personal data is processed through the Services.

Customer responsibilities: provide a lawful basis and transparent notices to end users, configure retention, and honor data-subject rights requests directed to them as controller.

AdCast obligations: process only on documented instructions; confidentiality; security measures; sub-processor controls; assist with data rights, DPIAs, and incidents; delete/return data at end of services; audits per the DPA. See /dpa.