Privacy policy for the cloud product Webinterface and add-ons

easescreen cloud products are subject to the EU General Data Protection Regulation (GDPR) and are GDPR-compliant.

easescreen Webinterface data is stored per cloud service on highly available and secure servers in a certified data center in Austria that is certified according to ISO 27001, ANSI/TIA 942, EN 50600, and ISO 20000 (Raiffeisen Rechenzentrum GmbH).

For the organizational handling of the provision of easescreen cloud products we internally use and offer some (for the customers partly optional) services (support & ticket system, license management, easescreen content distribution systems, knowledge base and tools for teaching/training). Details on data processing and data protection on these systems can be found further down in this document.

All personal data you provide in easescreen (cloud) products is always provided on a voluntary basis. Personal data transmitted by customers within the scope of easescreen services is stored and used by easescreen exclusively for administrative purposes and in order to (be able to) provide the offered services. easescreen does not use this data for its own purposes/advantages, nor does it pass on personal data to third parties.

The easescreen Webinterface currently offers the fields first name, last name, e-mail address, and (profile) picture for identifying the user, as well as preferences in the system (language setting).

In easescreen license management, the phone number of a company contact person can also be stored for each company or licensee.

The systems offered are designed purely for professional use and are therefore generally not available to children.

We do not request any personal data that is particularly sensitive. The data that is requested is necessary for (business) operations and the fulfillment of the services purchased, as well as for the associated customer service. For example, an e-mail address may be used for purpose-related mailings (e. g. notifications of maintenance windows and updates).
All data collected will only be stored, processed, and used for the relevant business purpose.

The legal basis for the processing of personal data is: contract fulfillment, legitimate interests, and consent. The business purpose is to enable the licensee to use the products (or enable interested parties to test the products) and, if necessary, to provide appropriate support where required.

We process personal data, where necessary, only for the duration required for the business purpose, in particular for the duration of the entire business relationship (i.e. at least until the end of the business relationship or termination of the license agreement) and, as a rule, for a further six months beyond that, so that the customer does not lose their existing content data, even in the event of accidental payment delays or ordering errors in the delivery/distribution chain, for example.
In any case, we only store the data in accordance with the statutory or contractual retention and documentation obligations.

A digital signage project will be deleted from the easescreen Webinterface six months after the usage (contract) end. At the same time, all associated personal user data will also be deleted from our cloud services.

The deletion of personal/user-related data only occurs if this data is no longer required elsewhere. In cases e. g. where a user is still a member of another test (project) or a project that is still running, or when he continues to use additional services (such as the knowledge base – see below for details) his data will not be deleted.

In any case, your data is only accessible to authorized, authenticated easescreen employees who have been explicitly trained in data protection issues.

We will not disclose your data without your express consent.
Exceptions to this include, in particular:

If we are required to hand over your data by law or court order.
In the event of suspected criminal or inappropriate behavior, data may be passed on to authorities or legal advisors.
Disclosure to a processor and sub-processor in accordance with our instructions for the provision of a service.

As part of the functionality of the easescreen Webinterfaces, content to be displayed is transmitted to distribution servers and then on to the display devices.
This data or content distribution takes place either directly to the (end) customer's systems or, optionally, via easescreen content distribution servers, but in any case without personal (user) (data) reference.

We expressly point out that we do not check, either automatically or manually, whether you (or, where applicable, your colleagues, employees, or customers) process data subject to data protection within the scope of the digital signage services ordered from us and hosted by us (and whether this data is then also distributed to devices/screens).

Since the data you intend to process in the easescreen digital signage cloud services is prepared for public display on screens or comparable display devices, the easescreen cloud services require that you, as a licensee of the easescreen cloud services, ensure that you only use and process data whose use, processing, and storage is legal.
In particular, make sure that you have taken any necessary data protection measures (such as obtaining the consent of a concerned person to be allowed to process his data).

Example:
If you display photos on screens in which individual persons can be recognized, you must obtain their consent in advance for this display.

All responsibility and liability for the “content of the data” – unless provided by us – in particular with regard to publication and processing rights, confidentiality obligations, and reproduction rights, lies with you as the licensee of the easescreen cloud services.

We expressly point out that it is the responsibility of the users to keep their login information confidential. If you suspect that an unauthorized person may have gained access to your login details, please change all passwords immediately. easescreen does not check who logs in with your data and does not automatically detect whether “unusual” activities are taking place in your digital signage network.

During the usage of easescreen cloud services, certain additional data that is absolutely necessary from a technical or legal perspective (e. g. cookies and access logs) is stored automatically. Details on this (in relation to all of our web-based services) can be found at the end of this document.

In particular, the easescreen Webinterface application software processes some persistent data, including:

session cookies (for authentication)
history data on user actions
- last login
- actions performed (e. g. uploading/editing/publishing content)
user display preferences
- (last) selected dashlets
- (last) selected display filter

In addition, (depending on the usage of the system) third-party applications integrated into the Webinterface and third-party applications that can be used for displaying in the context of the Webinterface may process personal data that is relevant in concerns of data protection law.

Note:
Please note that the data processing methods of these third-party services may change at any time and that we have no influence whatsoever on such changes!
We only have access to publicly available information about these manufacturers' data processing methods.

Here are a few examples::

When you preview pull media (e. g. an external website) in the easescreen Webinterface, data (such as your IP address) is transmitted from your computer to the pull media server.
The maps used in the easescreen Webinterface (which can display the locations of POV Clients) are based on Google Maps.
Google (Maps) uses certain cookies, e. g. to store the last selected map area.
The easescreen Webinterface may download fonts from web servers. By default, this only happens from easescreen cloud servers under the conditions set out in this privacy policy. However, fonts from third-party providers may also be integrated (at the explicit request of the customer or on the instructions of the project administrators of the respective licensee). In this case, data is also exchanged with these third-party servers, over which easescreen has no control.
Two-factor authentication can be used to access the easescreen Webinterface. Third-party programs are used on the customer side to generate the required one-time password (= TOTP).
How this third-party software handles your data (e. g. how it stores the “shared secret” or how it handles the online time required to generate the TOTP) is beyond the control of easescreen.
In the easescreen Webinterface, you can use widgets, some of which can access external third-party services, e. g.
- The Weather widget transmits the selected location of/for the "playback computer" to an external service provider. This service provider does not receive any personal data, but could establish a link between implicitly transmitted data, such as your IP address, and the weather query location.
- When you use the YouTube widget, YouTube (respectively its provider Google) exchanges data with your device as soon as you use the preview in the Webinterface. This includes, for example, your IP address. If you have a YouTube account and are logged into Google in your browser, Google, as a third-party provider, can log that you have “accessed” a video, for example.
- If you use the Instagram widget, this provider will also record your current IP address or possibly other data, e. g. whether a tracking cookie is present.
- If you use the Excel or Word widget, the referenced document is processed by Microsoft and, possibly, header data (such as the “author” field) is read.

For the provision of easescreen cloud application services in the certified data center of our subcontractor Raiffeisen Rechenzentrum GmbH, 8074 Raaba-Grambach, AT,
we rely on the services of our data processor
Oswald Systemlösungen, 8042 Graz, AT.

Content distribution via easescreen systems

If the customer uses optional additional cloud/content distribution services (e. g. Management Server, HTML5 Server, etc.) available and hosted by easescreen, these servers and services are operated by our German processor (dogado GmbH, 44263 Dortmund, Germany) and are set up and maintained directly by the easescreen team (on the service side).
No personal data is processed by or on these distribution servers, nor is any personal data transmitted to these servers at any point in the process chain.

We cannot guarantee or accept liability for the content of the data, in particular that which is uploaded by customers themselves for presentation purposes, with regard to compliance with data protection law and other relevant publication rights (copyright, etc.)!

License management

To use easescreen (cloud) products, you must purchase (at least) one product key. These product keys are recorded and managed on a company-specific basis.
We only record the (end customer) company name in the license database and assign it a non-personalized account and login ID. The company account data is stored indefinitely, as product keys are unique and valid forever.

When using the web-based online license management service (https://license.easescreen.com/) with the company-specific login ID, there is the (optional, voluntary) option of storing the name of a company contact (including e-mail address and telephone number) in the account details. However, this data does not have to be personal (example of a possible entry: Technical Department, tech_department@customer.com).

In any case, no sensitive personal data is collected. The above-mentioned voluntarily disclosed data (e. g. the company contact name) can be viewed and updated by registered customers and, if applicable, also by their (superior) dealer, updated, and, if necessary, corrected and deleted (self-service – also by the respective “pre-supplier(s),” who must also have an authenticated company account in the license management system).

Note:
Please be aware, that even if personal data (e. g. contact name or e-mail address) is corrected or deleted in the account details, this (old) data may still remain in backups for up to six months.

This license management service is hosted at the business premises of the easescreen co-owner (FeldTech GmbH, 8051 Graz, AT).

easescreen Knowledge Base (based on Zendesk Guide)

Our customers can find detailed information about easescreen products in the easescreen Knowledge Base, which is optional to use. Everyone is free to decide not to register in this system.

When you register for the first time (using an e-mail address and a password associated with that e-mail address), this e-mail address and a stored name, including the license/company status, are transmitted from the application server (in the RZZ data center) to the Zendesk Guide product, which is operated by our processor Zendesk, Inc. San Francisco, CA 94103, USA.

As soon as you use this (Zendesk) service, your e-mail address and name will be processed and stored there.

Note:
Please be aware, that when you use the comment function, your comments will be permanently visible to other users.

Zendesk offers features and support to help you handle your data in compliance with the GDPR. For details, see:
https://support.zendesk.com/hc/en-us/sections/4405298848154-Einhaltung-der-DSGVO

easescreen (online) courses

The online/remote training courses offered by the easescreen team are provided via the video conferencing product “Zoom” from Zoom Video Communications, Inc., San Jose, California 95113, USA.

You can access the privacy policy of Zoom Video Communications Inc. under https://www.zoom.com/en/trust/privacy/privacy-statement/

Online training courses (using integrated methods from Zoom Inc.) are usually recorded and made available to all participants immediately after the training course via a password-protected link in an e-mail. The recordings remain online in the “Zoom Cloud” for up to six months and can be viewed and listened to in their entirety (i. e. the entire recording, including all audio and video recordings of all training participants) by all training participants during this time after entering the password provided to them using the Zoom tool.

This will be explicitly pointed out in the invitation and again during the training, and consent to the recording is a prerequisite for participation in the training.

The name that must be provided in order to participate in or register for an online or in-person training course, as well as the e-mail address required for communication with you, will be stored by us for organizational purposes and used for:

Delivery of access data (to the course),
Announcement of any postponements,
Issuance and delivery of confirmations of participation.

This access data is managed using our event management tool from
eyepin GmbH, 1190 Vienna, Austria.
Details on data protection can be found at https://eyepin.com/en/privacy-policy/, which is also made known to all users directly in the registration forms.

Since participation in the training courses leads to personal easescreen certifications, we permanently store the names and contact details provided by the participants, as well as any other data they voluntarily provide (e. g. telephone number) and, in particular, the training level (= completed/finished training courses) in our customer relationship management system (Microsoft Dynamics/NAV/CRM), which is operated by our processor
Anteos GmbH, 1190 Vienna, AT
(Details on data protection under https://edv-wien.at/), and serviced/administrated by our sub-processors
SoHo – Unzeitig e.U., 1040 Wien, AT
and
ic innovative software GmbH, 95326 Kulmbach, DE

Support-/Ticket-System

All easescreen customers are free to open a support ticket directly at easescreen via (normal, unencrypted) e-mail or telephone.

This support and ticket service is operated at the business premises of the easescreen co-owner (FeldTech GmbH, 8051 Graz, AT) and is not accessible to persons outside the company (e. g. via self-service web UI) and is only accessible to internal support staff with a personalized, password-protected login.

When you open a new support case or write/reply to an existing ticket (e. g. by sending an e-mail to support@easescreen.com or license@easescreen.com), the entire content of this e-mail is recorded in our internal system, i. e. in this case, your e-mail address, but also any other information you have voluntarily provided (e. g. your landline or mobile phone number in your signature).

We guarantee that we will treat all data we receive from you as confidential and use it only for the specified purpose.

In order to provide our support services in the best possible way, we store and link your e-mails and the data they contain together with other data provided to us (including data received by telephone or in person, where applicable) (e. g. company name or address) and, where necessary, synchronize this data with the company accounts in our license database (see above).
In order to be able to access the history of previous cases in future support cases, all support tickets and the associated company and contact details, as well as the e-mails sent to us, will be stored for the duration of the validity of the product keys associated with the support case.

Data security

The protection of your data and, in particular, the security of your personal data is very important to us. We therefore use extensive technical and organizational (security) measures to protect your personal data managed by us against accidental or intentional manipulation, loss, destruction, or access by unauthorized persons. In particular, our employees who process personal data or have access to it are obliged to maintain data confidentiality.

In addition, our employees are contractually obliged to only disclose personal data from data processing on instruction and to maintain data confidentiality even after termination of employment.

The technical security measures used to protect your data are regularly reviewed and, if necessary, updated to reflect the latest technology. These principles also apply to companies that process and use data on our behalf and in accordance with our instructions.

All of our web-based services use cookies exclusively for technically necessary purposes (for example, to store the desired display presentation order or an active login session).

If you decide not to allow these cookies, some functions (including essential ones) will not work and the use of the respective services will not be possible or will be very limited.

Access to the websites of the cloud Webinterface and other web-based services is always based on state-of-the-art transport encryption (SSL/TLS).

For quality assurance and troubleshooting purposes, all underlying web servers log the following data (in the server log) when a connection is established:

IP address of the requesting computer
Time of request, referrer (website from which the request was initiated, if applicable)
Browser type and operating system (version)

These log files are generally stored for 14 days, but are deleted after six months at the latest, e. g. in the event of an error or support request.

All our partners and subcontractors have committed themselves to comply with the applicable data protection regulations. Corresponding data processing agreements have been concluded in accordance with the GDPR.

Information on your rights (as a concerned person):

Under the GDPR, you have certain rights (with regard to your personal data), such as the right to access and (let) rectify your data. Under certain circumstances, you (also) have the right to restrict/minimize or erase your data, as well as the right to transfer data.

If you would like to exercise any of these rights or learn more about the GDPR (for easescreen cloud products and additional services), please direct your specific request to your dealer or to us directly:

Per post:
easescreen // FeldTech GmbH
Göstingerstrasse 70
8051 Graz

Per Phone:
+43 (0)316 584530

Or per e-mail:
datenschutz@easescreen.com

We may have to need to ask certain information in order to confirm your identity and ensure that the inquirer has the right to access the requested personal data (or exercise any of the other mentioned rights). This is a security measure to ensure that personal data is not disclosed to any person who is not entitled to receive it.

If you believe that we are using your data in an impermissible manner, you can lodge a complaint with the Austrian Data Protection Authority.

To ensure that this privacy policy always complies with current legal requirements, we reserve the right to make changes or additions to our privacy policy at any time. Please also note that we are constantly developing the easescreen (cloud) services; accordingly, parts of the privacy policy may change if this is necessary, for example, if we provide new or additional services.

Therefore, you should consult the privacy policy regularly to stay informed about the latest versions.