Language of reference. This document is a translation provided for convenience. The binding version is the French one — Politique de confidentialité. In the event of any discrepancy between the two versions, the French version prevails.
1. Applicable framework
New Caledonia is an overseas country and territory, located outside the direct territorial scope of the European data protection regulation. The rules deriving from that regulation have nonetheless been extended by Ordinance no. 2018-1125 of 12 December 2018 and have applied since 1 June 2019, by way of Act no. 78-17 known as the "Informatique et Libertés" Act.
VisualCom applies these rules to all processing carried out in connection with the Service.
2. Allocation of roles — key point
Two situations must be distinguished, as they do not carry the same obligations.
| Data | Controller | VisualCom's role |
|---|---|---|
| User accounts created by the Client, content uploaded, data displayed | The Client | Processor |
| Billing account, commercial relationship, support | VisualCom | Controller |
What this means for the Client's Administrator. By creating accounts for its staff, the Client processes personal data for which it is the controller. It is therefore for the Client:
- to have a legal basis for that processing;
- to inform the individuals concerned of the existence of the processing, its purpose and their rights;
- to create only the accounts that are necessary and to delete them without delay once they are no longer justified;
- to pass on to VisualCom any request to exercise rights that would require technical action;
- not to upload to the Service any sensitive data that is not necessary for display purposes.
3. Data processed
| Category | Examples | Purpose |
|---|---|---|
| Account | email address, workspace name, role, sign-in dates | authentication, partitioning, billing |
| Content | images, videos, text, pages uploaded by the Client | publication on display devices |
| Display devices | hardware identifier, MAC address, local and public IP address, model, software version | pairing, licensing, diagnostics |
| Technical logs | player events, errors, playback status | monitoring and support |
| Screenshots | image of what is being displayed, at the request of an authorised user | remote verification and support |
| Activity log | action performed, author, date | traceability, security |
| Payment | subscription identifier, amounts, due dates | billing |
Screenshots and remote control. The Service allows an authorised user to request a screenshot of what a display device is showing and, on the plans that provide for it, to take control of it. These functions are restricted to authorised accounts and are recorded in the activity log. The Client informs any individuals likely to appear on screen or to use an interactive display device.
No payment card data is processed or stored by VisualCom: it is collected directly by the payment provider.
4. Hosting and location
Data is hosted on Google Cloud Platform infrastructure, in the australia-southeast1 (Sydney, Australia) region:
- the application and the management database (accounts, licences, logs);
- the content servers and the media uploaded by the Client.
Data is therefore not hosted in New Caledonia. Display devices also keep, on their own storage, a local copy of the content required for offline operation.
For a client established in the European Union, this processing constitutes a transfer to a third country, governed by appropriate contractual safeguards.
5. Retention periods
| Data | Period |
|---|---|
| Account and content | duration of the contractual relationship, then 30 days |
| Player technical logs | 14 days |
| Activity log | 12 months |
| Sign-in sessions | 13 hours |
| Screenshots | replaced on each new request |
| Diagnostic files retrieved remotely | 7 days |
| Unfinished sign-up requests and pairing codes | 24 hours |
| Billing | statutory accounting retention period |
6. Sub-processors
VisualCom uses the following providers, which have been informed of their obligations:
- Google Cloud Platform — hosting (Sydney, Australia)
- PayPal — collection of subscription payments
- Microsoft 365 — delivery of transactional email
The Client is informed of any change of sub-processor and may object on legitimate grounds.
7. Security
- Encryption of communications (HTTPS) and of secrets at rest.
- Strict partitioning of client workspaces: an account only accesses the data of its own workspace.
- Access to production data restricted to authorised VisualCom staff, solely for operational and support purposes.
- Logging of administrative actions.
VisualCom notifies the Client without undue delay of any data breach liable to concern it, together with the information enabling the Client to meet its own notification obligations.
8. Cookies and trackers
The Service sets no advertising cookie, no audience-measurement tracker and no behavioural tracking tool. No data is passed to an advertising network, a social network or an analytics service.
Strictly necessary local storage. The application keeps in your browser (site local storage, not cookies) only what it needs to work: the session token that keeps you signed in, the selected client space and server, the display language and your display preferences. This information never leaves your browser and is cleared on sign-out, or by clearing the site data.
Display server session cookie. When you sign in through your server, it sets a session cookie that is strictly necessary for authentication. It expires at the end of the session.
Because these trackers are strictly necessary to deliver the service you expressly requested, they are exempt from prior consent. No consent banner is shown: there is nothing to decline.
Web font. The public pages (legal notice, terms, this policy) load a font from Google Fonts. That request passes the visitor's IP address to Google; it sets no cookie and serves no tracking purpose.
9. Individuals' rights
Every individual has a right of access, rectification, erasure, restriction, objection and portability.
These requests are to be exercised with the Client where they relate to data for which it is the controller (its staff accounts, content). VisualCom assists the Client as far as necessary.
For data for which VisualCom is the controller: support@visualcom.nc.
A complaint may be lodged with the Commission nationale de l'informatique et des libertés (CNIL), which has jurisdiction in New Caledonia.
10. End of the relationship
At the end of the contractual relationship, VisualCom deletes or returns to the Client the data processed on its behalf, within thirty days, save where retention is required by law.
11. Contact
VisualCom — Nouméa, New Caledonia — support@visualcom.nc