Privacy Notice

Last updated: 24 September 2026

SignVision CMS (“the Service”) processes limited personal data to provide digital signage management and playback services to your organization. This notice explains what we process, why, and your rights.

1. Data Controller

The organization (tenant) that created your account, operating the Service, is the data controller. The Service is operated on behalf of your organization, which determines the purposes of processing.

2. What We Process

• Account data — username, email address, full name, role, and account creation date.
• Security data — hashed passwords, multi-factor authentication status, and account lockout records.
• Activity data — audit log entries (login, content changes, configuration changes) including timestamp and IP address, retained in line with our retention schedule.
• Device data — signage screens registered to your organization, their settings, and playback logs.

3. Why We Process It

• To authenticate you and secure your account (including MFA).
• To provide and manage digital signage content and playback.
• To keep security and audit records, and to comply with applicable law.
• To operate, maintain, and improve the Service.

4. Legal Basis

Processing is based on contract (providing the Service you requested), legitimate interests (security, fraud prevention, and operational management), and legal obligations (retention of records where required).

5. Data Retention

We retain data only as long as necessary. Audit logs are retained for a maximum of one year, playback logs for 90 days, device status logs for 30 days, and monitoring screenshots for 24 hours. Account data is retained while your account is active. Data is retained on servers located in the Kingdom of Saudi Arabia.

6. Your Rights

Under the Saudi Personal Data Protection Law (PDPL) you have the right to:

• Access your personal data — you can view and export it from your My Data page.
• Rectification — request corrections to inaccurate data.
• Deletion — request deletion of your data, subject to legal retention requirements.
• Object / Restrict — object to or restrict certain processing.

To exercise these rights, contact your organization’s administrator.

7. Sharing

We do not sell personal data. Data is shared only with your organization’s administrators and with processors necessary to operate the Service (e.g. email delivery for security notifications).

8. Contact

For privacy questions, contact your organization’s administrator.