Last updated: 30 October 2026
This English version is provided for convenience. If it differs from the French version, the French version prevails.
Scope and roles
This agreement applies when you (the customer, as controller) use JustDisplay to process personal data and IDEALOGY, a SARL with a share capital of €50,000, registered with the RCS of Paris under number 505 014 506 (APE code 6201Z, VAT number FR45505014506), whose registered office is at 50 avenue des Champs-Élysées, 75008 Paris, France, processes it on your behalf as processor. It forms part of our Terms of Service and applies for as long as we process data for you.
For the running of the Marketplace itself (listings, bookings, payments, settlement, payouts and disputes), IDEALOGY acts as an independent controller under our Privacy Policy. Owners and advertisers are each independent controllers of the data they receive from the other party for a booking.
Details of the processing
| Item | Description |
|---|---|
| Subject matter | Providing the JustDisplay digital signage and advertising service |
| Duration | The term of your account, plus the deletion periods below |
| Nature and purpose | Storage, scheduling, delivery and display of your content and ads on your displays and on the displays you book; display monitoring; Proof of Play and ad play reporting |
| Data subjects | Your team members, people who appear in the content and ads you display, and people in your order messages and files |
| Categories of data | Names, e-mail addresses, images and videos you upload, player device identifiers, IP addresses and display locations, Proof of Play and ad play records, order messages and files |
| Special categories | None requested by the service; do not upload sensitive data |
Instructions
IDEALOGY processes personal data only on your documented instructions, including the instructions you give through your use of the product (for example assigning an ad to a booking or turning on Proof of Play for a display), unless the law requires otherwise, in which case we inform you unless that law forbids it.
Confidentiality
Everyone authorised to process your data is bound by confidentiality and is trained on data protection.
Security measures
- Encryption in transit (TLS) and hashing of stored passwords; optional two-step sign-in.
- A separate token for each display; displays receive only their own content and ads.
- Role-based access for your members and the principle of least privilege for our staff.
- Segregation of customer data at application level.
- Regular backups and a documented recovery plan.
- Logging, monitoring and a documented incident procedure.
- Review of measures at least once a year.
Sub-processors
You authorise the use of sub-processors for hosting (OVH and IONOS in France), DNS and website protection and delivery (Cloudflare), cloud and CDN infrastructure (with providers and locations chosen according to your country), real-time delivery to displays, e-mail delivery and payment processing (Stripe). We inform you at least 30 days before adding or replacing a sub-processor, and you may object on reasonable data protection grounds; if we cannot offer an alternative, you may end the affected service.
The current list is published in our Privacy Policy, section Sub-processors and recipients.
Data subject requests
We help you answer requests from individuals exercising their rights, through the tools in the dashboard (deleting media, members and reports, exporting reports) and, where needed, with our support team.
Personal data breaches
We notify you without undue delay, and in any case within 48 hours, after becoming aware of a breach affecting your data, with the information you need for your own notifications.
International transfers
Any transfer outside the European Economic Area is covered by an adequacy decision or by the European Commission’s Standard Contractual Clauses and the additional safeguards required.
Deletion and return
You can download your content and export your reports at any time from the dashboard. When your account ends, we delete your data within 30 days, and from backups within 90 days, unless the law requires us to keep it (for example records of completed paid bookings). We confirm the deletion in writing on request.
Audits
We make available the information needed to demonstrate compliance with Article 28 GDPR. You may request an audit once a year, with 30 days’ notice, during business hours and without disrupting the service; we may answer with an up-to-date third-party report where one exists.