Privacy Notice

1. Who we are

PulsePanels is a digital signage software platform owned and operated by Technoserve W.L.L., Commercial Registration No. 81118, Doha, State of Qatar ("PulsePanels", "we", "us"). For privacy questions, contact privacy@pulsepanels.com.

2. Our two roles: controller and processor

Controller. For our own business activities, PulsePanels decides why and how personal data is processed. This covers visitors to our website, people who create or manage accounts, and our billing, sales and support activities.

Processor. For the content and data our customers manage in their PulsePanels account, PulsePanels acts on the customer's instructions. The customer is the controller of that data.

3. Data we control (website, accounts, billing, sales, support)

Website visitors

• Technical data such as IP address, device/browser information and pages viewed.
• Our website sets no cookies and uses no analytics or advertising trackers; it only remembers your language choice in your browser. The PulsePanels app uses only strictly necessary cookies to keep you signed in. See the Cookie Policy.

Account and organisation management

• Account details such as name, work email, organisation and role.
• Authentication data: hashed passwords, two-factor authentication settings, or the identifier and email address returned by your sign-in provider (Google, Microsoft or your organisation's single sign-on).
• Usage and audit information related to managing and securing the service, including sign-in IP addresses and approximate country.

Billing

• Billing contact details, subscription and invoice records.
• Invoices may be paid by bank transfer or, where offered, by card through our payment provider (Stripe). Card details are entered directly with the payment provider and are never stored by PulsePanels.

Sales and support

• Contact details and the content of your enquiries, demos and support requests, including support chat conversations.
• Records of our communications with you.

4. Why we use this data and our legal basis

5. Data we process on our customers' behalf

When our customers use PulsePanels, they upload and manage content and configuration in their account. This may include media, playlists, schedules, screen and device information, and — depending on how the customer uses the platform — limited personal data that the customer chooses to include.

For this data, PulsePanels acts as a processor. We process it only on the customer's instructions to provide the service. We do not use customer content for our own purposes, and we do not sell it. A Data Processing Agreement is available to customers on request.

6. Data from Google and Microsoft accounts

You can choose to sign in with a Google or Microsoft account, and an organisation can choose to connect a Google or Microsoft (Outlook) calendar so that meeting rooms and event boards show their schedule on screens. We only access this data when you start the connection yourself.

What we access

• Sign in with Google or Microsoft: your name, email address and account identifier (the openid, email and profile permissions). We use them only to create and sign you in to your PulsePanels account.
• Google Calendar: read-only access to your list of calendars (calendar.calendarlist.readonly) and to events on the calendars you choose (calendar.events.readonly). Microsoft Outlook calendar: equivalent read-only access.

How we use it

• Calendar data is used only to show the schedule you selected — such as meeting titles, times and rooms — on the screens your organisation configures in PulsePanels, and to let you pick which calendars to show.
• We never create, change or delete anything in your calendar, and we never read your email, contacts or files.
• We do not sell this data, use it for advertising, or use it to train artificial-intelligence or machine-learning models, and humans do not read it except with your permission, for security reasons, or where the law requires.
• We store the access tokens for these connections encrypted. Synced events are stored so screens can show them even if the connection is briefly unavailable.

Disconnecting

An administrator can disconnect a calendar account at any time in PulsePanels. We then stop syncing it immediately, delete its stored access tokens and, for Google accounts, revoke PulsePanels' access with Google. You can also revoke access yourself from your Google Account (myaccount.google.com/permissions) or your Microsoft account settings. An administrator can pause a calendar source (it stops syncing and keeps its events) or delete it, which also deletes the events synced from it. Events from a disconnected account stay in your PulsePanels account until its sources are deleted or the account is closed.

7. Sharing and service providers

We share personal data only with service providers (subprocessors) that help us run PulsePanels, under contracts that limit their use of it, and where required by law or to protect our rights, users or the public. Our main service providers are:

8. International data transfers

Our servers and database are hosted in Germany (European Union). Some of the service providers above process data in other countries, including the United States. Where the law requires it, we rely on appropriate safeguards for these transfers, such as the European Commission's standard contractual clauses offered by those providers. Customers with data-residency requirements can also run PulsePanels on their own premises.

9. How long we keep data

• Account and organisation data: while the account is active, and deleted or anonymised within 90 days after the account is closed.
• Customer content (media, playlists, schedules and similar): customers can delete it at any time; anything left is deleted within 90 days after the account is closed.
• Calendar access tokens: deleted when the account is disconnected. Synced calendar events: until the calendar source is deleted or the PulsePanels account is closed.
• Audit and security logs: up to 12 months.
• Support conversations: up to 24 months.
• Billing and invoice records: as long as tax and accounting law requires.
• Backups: deleted data can remain in backups until they expire on their regular rotation.

10. Your rights

Depending on your location and applicable law, you may have rights to access, correct, delete, restrict or object to the processing of your personal data, and to data portability. Where we act as a processor for a customer, we will forward such requests to the relevant customer and help them respond.

To exercise your rights regarding data we control, email privacy@pulsepanels.com. You may also have the right to complain to your local data-protection authority.

11. Security

We protect personal data with technical and organisational measures, including encrypted connections (HTTPS), hashed passwords, optional two-factor authentication, encryption of stored access tokens and other secrets, role-based access control, rate limiting, audit logs, and daily backups with off-site copies encrypted at rest.

12. Children

PulsePanels is a business product and is not directed to children. We do not knowingly collect personal data from children through our own business activities.

13. Changes to this notice

We may update this notice from time to time. Material changes will be posted here with a new effective date.