Privacy Policy

1. Data Controller

2. Overview

Dinio is a battery-powered e-paper display system for hospitality and retail. All data is processed and stored exclusively within the EU (AWS region Frankfurt, eu-central-1).

3. Data we collect

Account data

Email address, password (stored only as a bcrypt hash), first/last name (optional), phone (optional), preferred language. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Device data

Device ID, MAC address, IP address, Wi-Fi SSID, battery level, firmware version, hardware version, signal strength. Collected automatically via periodic heartbeat communication (every 5 minutes).

Location data

Venue address, coordinates (determined automatically via geocoding), venue type, opening hours, estimated annual visitors.

Analytics data

Heartbeat logs (retained 30 days), campaign events (retained 90 days). No personal data about display viewers is collected.

4. Retention periods

Account data: until deletion. Heartbeat logs: 30 days. Campaign events: 90 days. Notification log: 90 days. Verification codes: 24 hours.

5. Recipients

AWS EMEA SARL (hosting, database, S3, OpenSearch — Frankfurt, eu-central-1): processor under the AWS GDPR Data Processing Addendum. AWS SES: transactional emails (verification, password reset) — also eu-central-1. Apple Inc. (APNs): push notifications — covered by the Apple Developer Program License Agreement. OpenStreetMap Nominatim: location-address geocoding (address text only, no personal identifiers). No transfers to third countries.

6. Data security

HTTPS/TLS encryption, AES-256 S3 encryption, bcrypt password hashing, short-lived JWT access tokens (15 min), rate limiting, daily backups.

7. Your rights

Right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), withdrawal of consent (Art. 7(3)).

Right to lodge a complaint with the supervisory authority: Landesbeauftragte für Datenschutz und Informationsfreiheit NRW (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Postfach 20 04 44, 40102 Düsseldorf, poststelle@ldi.nrw.de

8. Contact