IICAST.
InloggenOfferte aanvragen
Home / Privacy policy
IICAST

Privacy policy

Nederlandse versie

Version 1.0 · last updated 31 October 2026

This privacy policy explains which personal data we process when you visit www.iicast.nl, use the IICast CMS (cms.iicast.nl) or connect your social media account to IICast, why we do so, how long we keep it and what rights you have. This website is in Dutch; this English version is provided for convenience. If the versions differ, the Dutch version prevails.

The IICAST Player app for Samsung displays has its own privacy policy.

1. Who we are

This website and the IICast CMS are provided by IICast.

Drieoortsput 120, 6417 PR Heerlen, the Netherlands
Chamber of Commerce (KvK) 63556804 · VAT NL001814031B58
Email: info@iicast.nl · phone: 045 203 10 40

We are the controller for data relating to our website, our customer relationships and CMS accounts. For the content a customer chooses to show on its own screens, the customer is the controller and we process the data on its behalf (as a processor, under the data processing terms agreed with the customer).

2. Website

This website uses no trackers, no analytics or advertising cookies, and loads no external fonts or scripts. If you contact us by email or phone, we only use your details to answer your question and, if requested, to prepare a quote.

Like any website, the web server keeps technical log files (such as IP address, time and requested page). These are used only for security and troubleshooting and are deleted automatically after a short period.

3. Customers and the IICast CMS

For customers and CMS users we may process:

  • business contact details (name, organisation, email address, phone number);
  • account details (username and role; passwords are stored only as a secure hash);
  • quote, contract, invoice and support information;
  • technical data about screens and players, such as IP address, time of last contact, device and playback reports;
  • security logs, for example of login attempts.

The CMS only uses functional cookies and local storage needed to log in and to make the CMS work.

4. Instagram, Facebook and TikTok connections

IICast is adding the option to show public posts from your own Instagram, Facebook or TikTok account on your screens. This connection is optional. We only process the data described in this section when you connect your account.

How the connection works

You start the connection yourself in the CMS. You then log in to Meta (Instagram/Facebook) or TikTok on their official login screen (OAuth) and grant permission there. We never see your password for that platform. We only request read access to your basic profile and your own published posts. IICast does not post anything to your account and cannot change anything on your behalf.

What we retrieve

  • the account ID, account name/username and profile picture of the connected account;
  • your public posts and videos: the photo, video or thumbnail, the caption, the publication date and the link to the post.

We do not retrieve private messages, follower or friend lists, insights/statistics, other people's comments, or data from any other account.

Storage and security

  • The access tokens we receive from Meta or TikTok are stored encrypted on our server. They never reach your browser or the screens and are only used to retrieve posts from your own account.
  • Posts are cached on our server only for as long as needed to show them on your screens. They are replaced on every refresh. Posts that are no longer shown are deleted.
  • When showing content, a screen may load images or videos directly from Meta's or TikTok's servers (for example through an official embed). Those companies can then see the screen's IP address and process it under their own privacy policies.

What we use this data for

Only to show your own posts on your own screens, as you configure in the CMS. We do not use this data for advertising, profiling or any other purpose, and we do not combine it with other data. The legal basis is the performance of our contract with you.

Disconnecting

You can disconnect at any time in the CMS. We then immediately delete the tokens and the cached posts, account name and profile picture of that account. You can also revoke access in your Instagram, Facebook or TikTok settings. See Data deletion for instructions.

5. No selling, no ads

We do not sell personal data, do not show advertising based on your data and do not share your data with advertisers or data brokers.

6. Purposes and legal bases

  • Performance of a contract: providing and supporting accounts, screens, content and connections.
  • Legal obligation: accounting and tax.
  • Legitimate interest: a secure and reliable service, such as security, abuse prevention and troubleshooting.
  • Consent: where the law requires it. You can withdraw consent at any time.

7. Hosting and recipients

The IICast CMS and its data are hosted on a virtual private server (VPS) of TransIP B.V. in the Netherlands, within the EU. Backups are also stored with TransIP. Our server does not transfer personal data outside the European Economic Area.

We only share data with the customer that manages the screens, with service providers we need for hosting, email and accounting (under appropriate agreements), or when required by law. For a social media connection, our server connects to Meta or TikTok to retrieve your posts.

8. Retention

  • Tokens and account details of a connection: as long as the connection is active; deleted immediately when you disconnect.
  • Cached posts: only as long as needed for display; then deleted, and always when you disconnect.
  • Screen playback and fault reports: deleted automatically after 90 days.
  • Server access logs: 14 days.
  • Support and security logs: in principle no longer than 12 months.
  • Customer and account data: during the contract; after it ends, in principle deleted within 90 days, except what we must keep by law.
  • Financial records: 7 years (statutory obligation).
  • Backups: daily backups 14 days, weekly backups 8 weeks. Deleted data then also disappears from backups.

9. Security

We take appropriate technical and organisational measures. All traffic is encrypted with HTTPS, tokens are stored encrypted, passwords are stored only as hashes, login attempts are rate limited, each customer can only see its own environment, and only authorised administrators have access to the server.

10. Your rights

Under the GDPR you have the right to access, rectify and erase your data, to restrict processing, to data portability and to object. Send your request to info@iicast.nl. We respond within one month and may ask you to verify your identity.

If your request concerns content shown on a screen of one of our customers, we will forward it to that customer or help them handle it.

11. Complaints

If you are not satisfied with how we handle your data, please contact us first. You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the authority in your own country.

12. Changes

We update this policy when our service or the law changes. The current version and its date are always published on this page. We inform customers of material changes.

Draft text; to be legally reviewed before final publication.