Skip to content
QUIX

Privacy policy

Last updated: 12 October 2026

1. Introduction and scope

This Privacy Policy describes how QUIX ("QUIX", "we", "us" or "our") processes personal data in connection with (a) our website (the "Website"), (b) the QUIX platform, a cloud-based service for managing and publishing content on digital screens (the "Platform"), and (c) the QUIX player applications for Android and Windows (the "Player Apps"). The Website, the Platform and the Player Apps are together referred to as the "Services".

"Personal data" means any information relating to an identified or identifiable natural person. "Processing" has the meaning given in Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"). This Policy is written to meet the information requirements of Articles 13 and 14 GDPR. Where Dutch law applies, we also comply with the Dutch GDPR Implementation Act (Uitvoeringswet AVG) and the Dutch Telecommunications Act (Telecommunicatiewet).

"Customer" means the organisation that has entered into an agreement with QUIX for the use of the Platform. "User" means an individual who has an account on the Platform, whether created by that individual or by a Customer.

2. Controller and contact details

The controller within the meaning of Article 4(7) GDPR for the processing described in section 4 is:

We have not appointed a data protection officer, because we are not required to do so under Article 37 GDPR. Questions about privacy can be sent to the address above.

3. Our roles: controller and processor

QUIX acts in two different roles.

  • As controller we determine the purposes and means of the processing described in section 4: visitors of the Website, Users of the Platform, and the operation, security and administration of the Services.
  • As processor we process the content that Customers upload to the Platform ("Customer Content") on behalf of and on the instructions of the Customer, who is the controller of that content. This is described in section 5.

The personal data in this Policy relates to the following categories of individuals: visitors of the Website; people who contact us; Users of the Platform; and individuals who appear in Customer Content, such as employees or visitors of a Customer.

4. Processing as controller

For each processing activity below we state which personal data we process, why, on which legal basis under Article 6 GDPR, and for how long.

4.1 Visiting the Website

  • Personal data: IP address, date and time of the request, the page requested, the referring page, browser type and device information, as recorded in server logs.
  • Purposes: delivering the Website, ensuring the security and stability of our systems, preventing abuse and detecting errors.
  • Legal basis: our legitimate interest in operating a secure and functioning website (Article 6(1)(f)). This interest does not override your rights, because the data is limited and used only for these purposes.
  • Retention: server logs are kept for 30 days and then deleted.

4.2 Contact form and email

  • Personal data: name, email address, organisation (optional), the content of your message, the language of the page, the time of sending and a record that you ticked the consent box together with the text you agreed to.
  • Purpose: to answer your message and to keep a record of the correspondence.
  • Legal basis: your consent (Article 6(1)(a)), given by ticking the box in the form. For correspondence that you start by email, our legitimate interest in answering you (Article 6(1)(f)). You may withdraw your consent at any time (see section 10).
  • Retention: up to 12 months after the conversation has ended, unless the conversation leads to an agreement, in which case section 8 applies.

4.3 Requests to exercise your rights

  • Personal data: the details in your request, the information we need to verify your identity, and our reply.
  • Purpose: to handle your request and to show that we handled it correctly.
  • Legal basis: compliance with a legal obligation (Article 6(1)(c)).
  • Retention: for as long as needed to handle the request and, afterwards, for as long as necessary to demonstrate compliance, in any event no longer than 3 years.

4.4 Cookies and similar technologies

  • Personal data: the information stored on or read from your device, as described in our Cookie policy.
  • Purposes: necessary cookies and local storage make the Website work (for example, to remember your language and your cookie choice). Statistics and marketing cookies are used only if you allow them.
  • Legal basis: for necessary storage, our legitimate interest (Article 6(1)(f)), which is also exempt from consent under the Dutch Telecommunications Act. For all other cookies, your consent (Article 6(1)(a) GDPR and Article 11.7a of the Dutch Telecommunications Act). You can change or withdraw your choice at any time through "Cookie preferences" in the footer.
  • Retention: see the Cookie policy. Your cookie choice is remembered for 12 months.
  • Fonts: the Website loads fonts from Google Fonts. When you open a page, your browser connects to servers of Google, which receive your IP address. See section 7.

4.5 Platform accounts and use of the Platform

  • Personal data: name, email address and password (stored only as a one-way hash), the organisation, branch, role and permissions of the User, settings for two-step verification and recovery codes (stored securely), language and interface preferences, IP address and time of logins, failed login attempts and password reset requests, and a log of actions performed in the Platform.
  • Purposes: to create and manage accounts and give access to the Platform; to secure accounts and the Platform, including detecting and preventing unauthorised access; to keep an activity log so that Customers can see who changed what; to send service messages such as password resets and notices about changes to the Services.
  • Legal basis: performance of the agreement with the Customer, or steps taken at the request of the User before entering into an agreement (Article 6(1)(b)); our legitimate interest in the security of the Platform and in preventing fraud and abuse (Article 6(1)(f)); and, for the Users of a Customer, the legitimate interest of the Customer and of QUIX in being able to manage and audit use of the Platform.
  • Retention: for as long as the account exists. An account that has not been used for 365 days is deleted. The administrator of a Customer can set how long the activity log is kept. Data about failed logins and password resets is kept only as long as necessary for security. After the account is closed, the data is deleted or anonymised in accordance with section 8.
  • Source of the data: a User's account may be created by an administrator of the Customer. In that case we receive the User's name, email address and role from the Customer.

4.6 Support and bug reports

  • Personal data: name, email address, the content of your messages and any files or screenshots you attach, and technical information that you or the Platform provide with the report.
  • Purpose: to answer questions, resolve problems and improve the Services.
  • Legal basis: performance of the agreement (Article 6(1)(b)) and our legitimate interest in providing and improving support (Article 6(1)(f)).
  • Retention: until the matter is resolved and, afterwards, for as long as needed to follow up on recurring problems, in any event no longer than 24 months after the report was closed.

4.7 Billing and administration

  • Personal data: name and contact details of the contact person, company name, billing address, VAT number, and invoices and payment status.
  • Purposes: invoicing, collecting payment, accounting and meeting tax obligations.
  • Legal basis: performance of the agreement (Article 6(1)(b)) and compliance with legal obligations (Article 6(1)(c)).
  • Retention: 7 years after the end of the financial year to which the records relate, as required by Dutch tax and accounting law.

4.8 Player Apps and screens

  • Personal data: the name given to a screen, the pairing code, technical device information such as the app version and operating system, the IP address from which the screen connects, and status information such as whether the screen is online.
  • Purposes: to pair a screen with an account, to deliver the right content to the right screen, to show Customers the status of their screens and to keep the Platform secure.
  • Legal basis: performance of the agreement (Article 6(1)(b)) and our legitimate interest in the security and reliability of the Services (Article 6(1)(f)).
  • Retention: status history is deleted after 90 days. Other screen data is kept for as long as the screen is registered.

4.9 Product news and marketing

We send product news or marketing messages only if you have asked us to, or where the law otherwise allows it. Each message contains a way to unsubscribe. Legal basis: your consent (Article 6(1)(a)). We keep a record of unsubscribes so that we do not contact you again.

5. Customer Content: QUIX as processor

Customers upload media, texts, playlists and other content to the Platform. This content may contain personal data, for example images of individuals. For Customer Content the Customer is the controller and QUIX is the processor within the meaning of Article 4(8) GDPR.

  • We process Customer Content only on the documented instructions of the Customer and only to provide the Services.
  • The Customer is responsible for having a legal basis for the content it publishes, for informing the individuals concerned and for answering their requests. If you are an individual whose data appears in Customer Content, please contact the Customer first. We will assist the Customer as required by Article 28 GDPR.
  • The processing is governed by a data processing agreement that meets the requirements of Article 28 GDPR. Customers can request this agreement from us at the email address in section 2.
  • Content shown on a screen can be seen by everyone who can see that screen. The Customer decides what is shown and is responsible for not showing personal or confidential data without a legal basis.
  • Customers can show content from external sources, such as RSS feeds. Our servers then retrieve the feed at the address the Customer entered and pass the items to the screen. We use this only to show the content and do not use it for any other purpose.
  • When the agreement ends, we delete Customer Content or, if the Customer asks for it before the end of the agreement, we provide a copy and then delete it, unless the law requires us to keep it. We do not offer a general export function for Customer Content, so Customers should keep their own copies of the media they upload.
  • We use sub-processors as described in section 6 and remain responsible for them towards the Customer.

6. Recipients and processors

We share personal data only where this is necessary for the purposes above, and only with the following categories of recipients:

  • Hosting and email provider: Hetzner Online GmbH (Germany) hosts our servers and email within the European Union and acts as our processor.
  • Google: Google Fonts, which is loaded by the Website (see section 7). If we switch on Google Analytics, it is used only after you consent in the cookie banner.
  • Password breach check: where this function is enabled, the Platform checks new passwords against the Have I Been Pwned service using a method (k-anonymity) in which only a short fragment of a hash is transmitted. The password itself and the User's identity are not sent.
  • Professional advisers and authorities: for example our accountant, our legal adviser, and public authorities where we are legally obliged to disclose data.
  • Customers: Users' names, email addresses, roles and activity are visible to the administrators of the Customer they belong to.

We conclude written agreements with our processors that meet the requirements of Article 28 GDPR. If we add or replace a processor that processes Customer Content, we inform our Customers in advance and give them the opportunity to object, as set out in the data processing agreement. A complete and current list of our sub-processors, with their purpose and location, is available on request at the address in section 2. We do not sell personal data and we do not use personal data for advertising or profiling.

7. Transfers outside the European Economic Area

We host the Services within the European Union. Some providers, such as Google, may process personal data in countries outside the European Economic Area, including the United States. Where this happens we rely on an adequacy decision of the European Commission, such as the EU-U.S. Data Privacy Framework for certified providers, or on the standard contractual clauses approved by the European Commission, together with additional measures where necessary. You can request a copy of the safeguards we rely on via the contact details in section 2.

8. Retention

We do not keep personal data longer than necessary for the purposes for which it is processed. The retention periods are stated in section 4. In addition:

  • An account that has not been used for 365 days is deleted, together with the personal data in it, unless we are obliged or entitled to keep the data.
  • Personal data in a Customer's account is deleted or anonymised within 30 days after the agreement with the Customer ends, unless we are obliged or entitled to keep it, for example for accounting purposes or to establish, exercise or defend legal claims.
  • Backups are overwritten in the normal backup cycle. During that time the data in them is not used.
  • Where a retention period expires, we delete the data or make it anonymous.

9. Security and personal data breaches

We take appropriate technical and organisational measures to protect personal data, in accordance with Article 32 GDPR, taking into account the nature of the data and the risks. These measures include encryption of traffic between you and our Services, storing passwords only as hashes, optional two-step verification, access limited to those who need it, role-based permissions within Customer accounts, limits on login attempts, logging of security-relevant events, backups, and regular updates of our systems.

A description of our security measures is available on request. We keep a record of our processing activities as required by Article 30 GDPR.

If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required under Article 33 GDPR, and we will inform affected individuals without undue delay where required under Article 34 GDPR. Where we act as processor, we notify the Customer without undue delay.

10. Your rights

Under the GDPR you have the following rights, which you can exercise in relation to the personal data for which we are the controller:

  • Right of access (Article 15): to obtain confirmation whether we process your personal data and, if so, a copy of it and information about the processing.
  • Right to rectification (Article 16): to have inaccurate or incomplete data corrected.
  • Right to erasure (Article 17): to have your data deleted in the cases set out in the GDPR, for example when it is no longer necessary or when you withdraw your consent.
  • Right to restriction (Article 18): to have the processing of your data restricted in the cases set out in the GDPR.
  • Right to data portability (Article 20): to receive the data you provided to us in a structured, commonly used and machine-readable format, where the processing is based on consent or on an agreement and is carried out by automated means. This right covers personal data about you, such as your account details; it does not oblige us to offer an export of the content that a Customer has uploaded (see section 5).
  • Right to object (Article 21): to object, on grounds relating to your particular situation, to processing based on our legitimate interests. We will then stop the processing unless we have compelling legitimate grounds that override your interests, or the processing is needed for legal claims. You may object at any time to direct marketing.
  • Right to withdraw consent (Article 7(3)): where processing is based on your consent, you can withdraw it at any time. Withdrawal does not affect the lawfulness of processing before the withdrawal.

How to exercise your rights. Send a request through our Privacy requests page or by email to info@quixone.com. To protect your data we may ask you for information needed to verify your identity. We respond without undue delay and in any case within one month of receiving the request. Where necessary, taking into account the complexity and number of requests, this period may be extended by two further months, in which case we inform you within the first month. We do not charge a fee, unless a request is manifestly unfounded or excessive.

Data in a Customer's account or Customer Content. If your request concerns data for which a Customer is the controller, we will refer you to the Customer or, with your agreement, pass the request on to it.

Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or the place of the alleged infringement. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl). We would appreciate the chance to resolve your concern first.

11. Obligation to provide data and automated decisions

Providing personal data to us is voluntary, except that we cannot create an account, provide the Platform or send invoices without the data described in sections 4.5 and 4.7. If you do not use the contact form, we do not receive the data described in section 4.2.

We do not take decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

12. Children

The Services are intended for businesses and organisations and are not directed at children. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, please contact us so that we can delete it.

13. Other websites

The Services may contain links to websites of third parties. This Privacy Policy does not apply to those websites and we are not responsible for how they process personal data. Please read their privacy statements.

14. Changes to this Privacy Policy

We may amend this Privacy Policy, for example when we introduce new features, change service providers or when the law changes. The date at the top of this page shows when the Policy was last updated. For significant changes that affect you, we will give you notice in a suitable way, for example by email or in the Platform. Earlier versions are archived by us.

15. Contact

For questions about this Privacy Policy or about the way we process your personal data, contact QUIX at info@quixone.com, or by post at Zompstraat 39, 8102 HX Raalte, the Netherlands.