Privacy statement

1. Who are we?

You and the World VOF, based at Koestraat 224, 8800 Roeselare, Belgium (KBO: BE1007.344.802), is responsible for the processing of personal data as described in this privacy statement.

Contact details:
Koestraat 224
8800 Roeselare
Belgium
Email: [email protected]

Data Protection Officer:
Matthias Braekevelt
Email: [email protected]

2. What data do we collect?

We collect the following personal data:

• Name
• Email address
• Company name

Of prospects, the companies we approach for business, we keep the business contact details of their contact persons: name, job title, email address, phone number and company. That data comes from a form you fill in, from a conversation with us, from a public source such as your company's website, or from a list that we import. If we send you a link to a personal demo, we can see how often and when you open it.

3. Why do we collect this data?

We process your personal data for the following purposes:

• Creating and managing your account
• Delivering our digital signage services
• Sending service-related communication
• Improving our services
• Emailing prospects about our services

4. Legal basis

We process your data on the basis of the agreement you enter into with us when you use our services.

We process data of prospects on the basis of our legitimate interest in business prospecting (Article 6.1.f GDPR).

5. Retention period

We keep your personal data no longer than strictly necessary for the purposes for which it is collected. Your data is kept for as long as you have an active account. After your account ends, your data is deleted within 30 days.

We keep data of prospects until you ask us to delete it. An address that has unsubscribed stays on the block list described in point 10.

6. Sharing with third parties

We share your data with third parties only if this is necessary to carry out our services and to email prospects. We use the following service providers:

• Database hosting - Frankfurt, Germany, EU
• Website hosting and security - worldwide CDN
• Video content delivery - EU
• Email sending - Ireland, EU
• AI service for email drafts - United States

We have signed data processing agreements with these parties to protect your data.

The AI service can write a draft of an email to a prospect. A staff member reads every draft before the email is sent.

7. The gibeon.io player app for Samsung TVs

This section covers the gibeon.io player app that you install on a Samsung TV from the Samsung app store. It says what the app sends, how long that is kept and who processes it. It applies in addition to the rest of this statement.

The app on the TV sends no serial number, no screenshots, and no data from a camera, microphone or viewer.

Purpose: to pair the screen with the customer's account, show the customer's content, watch the health of the screen, and find and fix errors.

Legal basis: the agreement with the customer who owns the account, and the consent given by activating the screen.

Without consent: do not activate the screen. The app then shows only the pairing code and sends only what pairing needs (the rows marked "before activation" in the table above).

Withdrawing consent: delete the screen in app.gibeon.io, or remove the app from the TV. When you delete the screen, its heartbeat data, its login with the device data, its playback log and its daily status records are deleted at once. To have the usage data in PostHog deleted as well, write to [email protected].

Third-party content: a content block that a customer adds can load third-party content on the TV. That party then receives the IP address of the TV. This applies to YouTube for a YouTube block, Google Fonts for some data templates, and the image hosts of a customer's data source.

8. Instagram posts on a screen

This section applies when a customer connects an Instagram account to show its posts on the customer's own screens. The customer does that by logging in with Instagram and agreeing on the consent screen of Instagram. Only business and creator accounts can be connected. It applies in addition to the rest of this statement.

What we read: the name and username of the account, the profile picture, the number of followers and the number of posts. Of the latest 25 posts we read the images (of a video its cover image), the caption, the number of likes, the date and the link to the post. We read nothing else, and we post nothing to the account. The access token that Instagram gives us is stored encrypted and is used only to fetch these posts.

Why: to show these posts on the customer's own screens, and for no other purpose. We do not sell this data and do not use it for advertising.

Where it is kept: we keep a copy of the images on our own image storage, so that the screens do not load them from Instagram. That storage is served through the content delivery network named in point 6.

How often: we fetch new posts every 30 minutes. The numbers of likes, followers and posts are updated at most once a day.

How long: a post, with its image copies, is deleted as soon as it is no longer among the latest 25 posts, for example because it was deleted on Instagram or pushed out by newer posts. When the customer disconnects the account, the access token is deleted at once, the posts leave the screens right away and the image copies are deleted. A screen also keeps the two versions of its program before the current one, as a fallback, and the texts of the posts can still be in those. A daily cleanup deletes such an older version as soon as three newer versions of that screen exist, which usually happens within a few days. When the customer's account with us ends, the data is deleted within 30 days, as described in point 5.

Legal basis: the agreement with the customer who owns the account, and the consent the customer gives on the consent screen of Instagram.

How to delete it:

• Click Disconnect on the Instagram card of the data source in app.gibeon.io. The posts leave the screens right away and our copies of the images are deleted.
• Send a request to delete data through the settings of Instagram, where you manage the apps you gave access. We then delete the posts, the image copies, the access token and the name of that account, and show you a page with the status of your request. The older versions of a screen's program are cleaned up as described above.
• Write to [email protected].

If you only remove the app in Instagram, we stop fetching new posts and delete the access token, but the posts that are already on the screens stay there until the customer disconnects the account or reconnects it. Use one of the options above to have them deleted.

9. Data outside the EU

Cloudflare processes data worldwide through its CDN network. This processing complies with European privacy law through Standard Contractual Clauses (SCCs).

The AI service for email drafts processes data in the United States. That transfer also relies on Standard Contractual Clauses (SCCs).

10. Your rights

You have the right to:

• Request access to your personal data
• Have your data corrected or deleted
• Object to the processing
• Transfer your data (data portability)
• File a complaint with the Data Protection Authority

Every email to a prospect contains a link to unsubscribe. We keep an unsubscribed address on a block list, so that we never email it again. That address stays on the list even if you ask us to delete your other data. You can also object to those emails at any time through [email protected]. We then stop emailing you.

To exercise your rights, you can contact us at [email protected].

11. Security

We take appropriate technical and organisational measures to protect your personal data against loss, unauthorised access and other forms of unlawful processing. This includes encryption of data in transit and at rest, access controls and regular security audits.

12. Changes

We may change this privacy statement from time to time. Changes are published on this page. We recommend that you check this page regularly.