Privacy policy

What this is about

This policy describes which data is processed when you use rinovasignage.com and the associated player software, why, and what rights you have. The legal basis is the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Croatian GDPR Implementation Act.

Account data

On registration we collect: company name, e-mail address, password (stored only as an irreversible hash) and optionally contact person, phone number and country.

Purpose: providing the account, billing, contact in case of faults.
Legal basis: performance of contract (Type. 6(1)(b) GDPR).
Retention: for the life of the account; thereafter until statutory retention periods expire (in Croatia eleven years for accounting records).

Screen (player) data

Every registered player regularly reports technical values to the server:

• device identifier, software version, screen resolution, model
• IP address (public and local), network type, Wi-Fi name and signal strength
• temperature, uptime, free storage, power supply status
• last played content and play duration (“proof of play”)
• a still image of the screen content at regular intervals and on request

Purpose: operating and monitoring playback, fault reports, proof of playback towards advertisers.
Legal basis: performance of contract (Type. 6(1)(b) GDPR).
Retention: still images are overwritten; playback logs are deleted after 12 months.

Important note for operators: the still image shows what is currently on the screen. Please set up the screen so that no personal data of third parties appears on it. The player captures only the displayed content – it has no camera or microphone and does not record people or their behaviour.

Uploaded content

We store the images, videos and texts you upload for delivery to your screens. We do not review or analyse this content. You are responsible for the rights to it.

Retention: until you delete it or the account is deleted.

Server logs

On every access the web server stores the IP address, time, requested address and browser identifier. This serves security and troubleshooting (legitimate interest, Type. 6(1)(f) GDPR) and is deleted after 14 days.

Cookies

We use only technically necessary cookies – no tracking, no advertising cookies, no analytics:

• SIGSESS – keeps you logged in during your visit; ends when the browser is closed
• sig_lang – remembers the chosen language; one year

As only necessary cookies are used, no consent banner is required.

Processors

All processing of account and screen data takes place within the EU. A data processing agreement is in place with Hetzner.

About the map: anyone opening the technical overview with the location map loads map tiles directly from OpenStreetMap. Their server thereby learns the viewer's IP address and the requested map section. No account or device data is transmitted.

Disclosure

We do not sell data and do not pass it on for advertising purposes. Data is disclosed only to the service providers listed above, as far as necessary for operation, or where we are legally obliged to.

Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. A short message to zop@rineo.hr is sufficient.

If you believe we are not processing your data lawfully, you may lodge a complaint with the Croatian Data Protection Agency (AZOP) (azop.hr).

Security

The connection is encrypted end-to-end via HTTPS. Passwords are stored only as hashes, VNNOX credentials are encrypted. Two-factor login is available for accounts. The server receives automatic security updates and is backed up daily.