Version 1.0 · Effective date: 22 October 2026
This privacy policy explains what data the IICAST Player app for Samsung Smart TVs and Samsung professional displays (Tizen) processes, why, and what rights you have. It applies to the app and to the IICAST server it connects to. For the IICAST website and our general business processing, see our general privacy statement at www.iicast.nl/privacy.html.
The controller is IIControl, a sole proprietorship (eenmanszaak) of Paul van Boven, trading as IIControl and IICAST.
IICAST is a digital signage (narrowcasting) service for businesses such as hotels, hospitality venues, sports clubs and offices. The IICAST Player app turns a Samsung display into a signage screen: it loads the IICAST web player from the IICAST server (cms.iicast.nl) and shows the content that the business customer has configured in the IICAST content management system (CMS).
The app is intended to be installed and operated by business customers and their installers. It has no user accounts, no login for viewers, no advertising and no analytics or tracking SDKs. People who merely look at the screen do not interact with the app.
This data stays on the display until the app data is cleared or the app is removed.
Pairing. To link the display to a screen in the CMS, either a pairing code shown in the CMS is entered on the display, or the display requests a short code and a random secret from the server. Unused codes are deleted after 15 minutes; a code is deleted as soon as it has been used.
Device and player report. A few seconds after start-up, then at most a few times per hour, and when an error occurs, the player sends:
IP address. The server records the public IP address from which the display connects (usually the internet address of the venue's router). It is updated when the display reports or fetches its playlist, together with the time of last contact ("last seen").
Connection and status. The display keeps a live connection with the server to receive content updates (the server sends a keep-alive signal every 15 seconds). If that connection fails, the display checks for updates every 10 seconds.
Playback reports. Every 30 seconds the player reports what it is showing: the content item identifier, start time and duration, the playback result, playback/error status of media, whether the page is visible, and technical fault events (such as a resource that failed to load, the host name of that resource and the HTTP status code). These are used for proof of play and troubleshooting.
Data we do NOT collect through the app: the app does not read the TV's unique device ID (DUID), serial number, MAC address, Wi-Fi details, location/geolocation, camera, microphone, viewing habits of TV channels, contacts or any advertising identifier. It does not capture images of the TV screen.
The CMS can show a preview image of what a screen is showing. For the Samsung app this preview is generated on our server by rendering the same content. It is not a picture taken from the display. The latest preview per screen is stored on the server and replaced on the next refresh.
In the CMS, the business customer may record details about a screen, such as a name, location, brand/model, installation date, notes, and the network address of a display for remote power control. These are entered by the customer, not collected by the app.
The content shown on the screens is chosen by our business customer. It may contain personal data, for example names of organisations or contact persons from room bookings (such as "Welcome, Company X"), logos or photos. For this content, IIControl acts as a processor on behalf of the business customer, who is the controller. Questions about this content should go to the business that operates the screen; we will assist them.
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Pairing the display and delivering the configured content | Screen key, pairing code, server address | Performance of the contract with the business customer (Art. 6(1)(b)), and our legitimate interest in providing the service (Art. 6(1)(f)) |
| Monitoring whether screens are online, and troubleshooting and support | Device report, IP address, last seen, fault events | Legitimate interest in a reliable and secure service (Art. 6(1)(f)) |
| Proof of play and playback reports for the customer | Playback reports | Performance of the contract (Art. 6(1)(b)); for customer content, processing on the customer's instructions (Art. 28) |
| Security and abuse prevention (for example rate limiting of pairing attempts) | IP address (held in memory) | Legitimate interest (Art. 6(1)(f)) |
We do not use the data for advertising, profiling or sale, and we do not make automated decisions with legal effect.
Hosting. The IICAST server runs on a virtual private server of TransIP B.V. in the Netherlands. Off-site backups are stored with TransIP (Stack).
Services contacted directly by the display. When showing content, the display itself loads some resources from third parties. These parties can see the display's IP address and user-agent string:
These parties process data under their own privacy policies.
Services contacted by our server, not by the display. Weather (MET Norway, Open-Meteo), maps and addresses (PDOK, OpenStreetMap Nominatim), traffic (Verkeerplaza) and news feeds are retrieved by our server. The display's IP address is not shared with these services.
Others. We share data only with the business customer that operates the screen (in its CMS), with service providers we need for hosting and support, or when the law requires it. Data is not transferred outside the European Economic Area by our server. Third-party services that the display contacts (listed above) may process data outside the EEA under their own safeguards.
Under the GDPR you have the right to access, rectify and erase your personal data, to restrict processing, to data portability, and to object to processing based on legitimate interest. To exercise these rights, email info@iicast.nl. We respond within one month. We may ask for information to verify your identity.
If your request concerns content shown on a screen of one of our customers, we will forward it to that customer or help them handle it.
To remove the data stored on a display, unpair the screen in the CMS and clear the app data or uninstall the app. The business customer can delete the screen in the CMS, which removes the device data described in section 3.2.
You can file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or with the authority in your own country.
The app is a business signage tool and is not intended for children. We do not knowingly collect personal data from children.
We may update this policy when the app, the service or the law changes. The current version and its effective date are always published at this address. We inform our business customers of material changes by email and/or in the CMS. If the address of this policy changes, we will update it in the Samsung Seller Office.
IIControl, Drieoortsput 120, 6417 PR Heerlen, the Netherlands · info@iicast.nl · +31 6 31767411