Privacy Policy

OMAR ALEJANDRO BALLESTEROS MEDINA, an individual with business activity registered in Mexico, operating under the trade name ovenlabs.io (the "Controller"), with domicile at Avenida Venustiano Carranza number 1602, interior C, Colonia Residencial Esmeralda, Colima, Colima, Mexico, postal code 28017, is responsible for the processing, use and protection of the personal data collected in accordance with this Privacy Policy.

The domicile stated above and the electronic mail account contacto@ovenlabs.io are designated for notices and for the exercise of data protection rights.

The purpose of this Privacy Policy is to inform the Data Subject of the personal data that will be processed, the purposes of such processing, and the means available to exercise their rights, in connection with the service known as ScreenAds (the "Service").

The Service comprises:

• I.The Platform, meaning the ScreenAds web application accessed by the Customer from a computer in order to administer their account, locations, screens and the content played on them.
• II.The Roku Application, meaning the ScreenAds application installed on Roku devices located at the Customer’s establishments, the sole function of which is the playback of content previously scheduled from the Platform.

This Policy does not apply to the Controller’s corporate website or to other services provided by the Controller, which are governed by their own privacy notices.

The Service is designed for individuals and legal entities carrying out business activities. The Controller is established in the United Mexican States and processing is governed by Mexican law; where the Data Subject resides in the United States of America or in the European Economic Area, Clause Eighteen shall additionally apply.

For the purposes of this Privacy Policy:

• I.Data Subject: the individual to whom the personal data being processed pertains.
• II.Customer: the individual or legal entity holding an account on the Platform.
• III.Device: each Roku unit paired with the Customer’s account.
• IV.Customer Content: the image, video, text and other files that the Customer uploads to the Platform for playback.
• V.Processor: the individual or legal entity that processes personal data on behalf of and in the name of the Controller.
• VI.The Law: the Federal Law on the Protection of Personal Data Held by Private Parties in force.

The Controller processes only the categories of personal data listed below.

I. Identification and contact data

Collected directly from the Data Subject upon registration and during use of the Platform:

• a)First and last name of the account holder;
• b)Electronic mail address;
• c)Telephone number, on an optional basis;
• d)Trade name of the business;
• e)Name and address of the locations or establishments where screens will be installed;
• f)Time zone, required in order to resolve content scheduling.

II. Tax data

Collected directly from the Data Subject, solely where a tax invoice is requested:

• a)Corporate or tax name;
• b)Federal Taxpayer Registry number;
• c)Tax domicile;
• d)Tax regime and use of the digital tax invoice.

Charges for the Service may be paid by card, through the payment platform of Stripe, Inc. and its affiliates ("Stripe"), or by bank transfer recorded manually. When the Customer pays by card, payment method data is captured and processed directly by Stripe in its own forms, in accordance with its privacy policy. The Controller does not collect or store card numbers or security codes; it only receives from Stripe the customer and subscription identifiers, together with the amount, date, period and outcome of each charge, which it keeps as part of the billing history.

III. Technical data

Generated indirectly and automatically by the operation of the Service:

• a)Device identifier, corresponding to the channel client identifier that the Roku operating system assigns to each unit for this particular application. It is not the Device serial number, it identifies no individual, and it does not allow the Device to be recognized across other applications;
• b)Pairing code, generated on the Platform at the Customer’s request and redeemed by the Device at the time of pairing;
• c)Device model and version of the installed Roku Application;
• d)Connection status and date of last connection of the Device, in order to display on the Platform whether a screen is operating;
• e)Internet protocol address and technical records of Platform access, as set out in Clause Seventeen.

The Controller states that the technical data referred to above is indispensable in order to link each Device to the corresponding account, direct content to the correct screen, evidence the activity carried out within the account, and diagnose failures in the Service.

IV. Sensitive personal data

The Controller does not collect or process sensitive personal data, understood as data affecting the most intimate sphere of the Data Subject or the improper use of which could give rise to discrimination or entail a serious risk to the Data Subject.

The Controller expressly states that, with respect to the Roku Application:

• I.It does not request user registration or any personal data on the Device. Pairing is carried out by means of a pairing code that authenticates the screen, not a person, and all account administration is carried out on the Platform.
• II.It collects no information whatsoever regarding the persons who view the screens. The Roku Application employs no camera, microphone, sensors, audience counting, facial recognition or any system of viewer measurement.
• III.It displays no third-party advertising and integrates no third-party advertising, analytics or tracking software development kits. It does not use the Roku Advertising Identifier or any equivalent identifier for advertising purposes.
• IV.It does not sell, market or transfer personal data to third parties for advertising purposes, and does not build profiles.
• V.The Service is directed at commercial establishments and not at minors. The Controller does not knowingly collect personal data from persons under eighteen years of age.

Personal data is processed for the following purposes, which are necessary for the existence, maintenance and performance of the legal relationship between the Controller and the Customer:

• I.To create, identify and administer the Customer’s account and access credentials;
• II.To link Devices to the Customer’s account by means of the pairing code;
• III.To host, schedule and deliver the Customer Content to the Customer’s screens;
• IV.To calculate and display the Customer’s usage against the limits of the contracted plan as to number of locations, number of screens and storage space;
• V.To process subscription payments and, where applicable, issue the corresponding tax invoice;
• VI.To provide technical support, diagnose failures and notify the Customer of operational, security or service changes;
• VII.To comply with legal, tax and contractual obligations and to respond to requests from competent authorities.

The Data Subject may not object to the purposes set out in this Clause without such objection entailing the impossibility of continuing the legal relationship with the Controller.

Additionally, and provided the Data Subject does not object, personal data may be processed for the following optional purposes, which are not necessary for the provision of the Service:

• I.To send communications regarding new features, educational content or promotions of the Controller;
• II.To invite the Data Subject to participate in satisfaction surveys or product interviews;
• III.To reference the trade name and logo of the Customer’s business in the Controller’s commercial materials. This purpose shall in all cases require the Customer’s prior, express and written authorization.

Opt-out mechanism. The Data Subject may object to the processing of their personal data for optional purposes by means of a communication addressed to contacto@ovenlabs.io, expressly identifying the purposes objected to, or by using the unsubscribe mechanism included in the communications received. The Controller shall act upon such objection within a period of no more than five business days from receipt.

The Data Subject’s objection to optional purposes shall not constitute grounds for denying the contracted services nor shall it affect the existing legal relationship.

I. Processors

For the operation of the Service, the Controller relies on the providers listed below, which act as Processors and process personal data solely in accordance with the Controller’s instructions:

Transmissions to Processors do not require the consent of the Data Subject under applicable regulations. The Controller contractually requires its Processors to adopt security and confidentiality measures equivalent to its own.

II. Statement regarding Roku, Inc.

The Controller states that it does not transmit the Customer’s account personal data or the Customer Content to Roku, Inc. Roku, Inc., in its capacity as operator of the Device and of the operating system, may collect its own information relating to Device usage in accordance with its policies, available at https://docs.roku.com/published/userprivacypolicy (abre en una pestaña nueva), which are independent of the Controller and for which the Controller assumes no responsibility.

III. Transfers

The Controller does not transfer personal data to third parties other than the Processors identified above, except in the circumstances provided by the Law, where necessary to respond to a request from a competent authority, or for the exercise or defense of rights before the courts.

The Customer Content is the property of the Customer. The Controller hosts it and distributes it to the Devices upon the Customer’s express instruction.

So that the Devices can play it without additional credentials, each file of the Customer Content is delivered from its own long, randomly generated web address, which is neither published nor linked from any site. Anyone who knows that address can access the file; the Customer shall therefore refrain from uploading confidential information to the Platform.

Where the Customer Content incorporates personal data of third parties, including without limitation photographs of identifiable persons or the names of employees or customers, the Customer shall act as controller with respect to such processing and shall be solely obligated to hold the consents and rights required under the Law.

With respect to such content, the Controller acts exclusively in the capacity of Processor, handling it in accordance with the Customer’s instructions and without applying it to its own purposes.

Personal data shall be retained for the periods necessary to fulfill the stated purposes, as follows:

Upon expiry of the stated periods, personal data shall be permanently deleted, following blocking where required by the Law. Where the Data Subject expressly requests deletion, it shall be carried out without waiting for those periods to elapse, except for such data as tax or accounting regulations require to be retained.

The Data Subject is entitled to access their personal data held by the Controller and to know the details of its processing; to rectify it where inaccurate or incomplete; to request its cancellation where the Data Subject considers it is not required for any of the purposes stated in this Policy; and to object to its processing for specific purposes.

Procedure

The request must be submitted to contacto@ovenlabs.io and must contain, at a minimum:

• I.The name of the Data Subject and a domicile or means by which the response may be communicated;
• II.A document evidencing the identity of the Data Subject or, where applicable, the legal representation of the person acting on their behalf;
• III.A clear and precise description of the personal data in respect of which the right is being exercised, together with the right the Data Subject intends to exercise;
• IV.Any element or document facilitating the location of the personal data, preferably the electronic mail address associated with the account.

Time limits

The Controller shall communicate its determination to the Data Subject within a maximum of 20 business days from the date the request is received. Where the request is granted, it shall be given effect within the 15 business days following communication of the response.

The exercise of these rights is free of charge. Only justified shipping expenses or the cost of reproduction in copies or other formats may be charged.

The Data Subject acknowledges that the cancellation of personal data necessary for the provision of the Service may result in the termination of the contractual relationship, and that certain data must be retained in compliance with legal obligations.

The Data Subject may at any time withdraw the consent granted for the processing of their personal data, and may request the limitation of the use or disclosure thereof, by means of a request submitted in accordance with the procedure set out in the preceding Clause.

Withdrawal of consent with respect to data necessary for the provision of the Service shall have the effects set out in the final paragraph of the preceding Clause.

The Platform does not use cookies, whether first-party or third-party, and incorporates no analytics, advertising or audience measurement tools. Nor does it share the Data Subject’s activity with social networks.

In order to operate the session, the Platform uses the browser’s local storage, in which it keeps only:

• The session token that keeps the Data Subject signed in;
• Basic profile data, so as to display their name without requesting it again;
• Their display preferences, such as the light or dark theme, the collapsed menu and the Platform’s colour;
• On playback screens opened from a browser, the Device identifier and token.

All of the above is necessary for the provision of the Service and disappears upon signing out or clearing browser data. Removing it prevents sign-in to the Platform.

The Roku Application does not use cookies or equivalent technologies. In the Device’s local registry it keeps only the server address, the credential obtained upon pairing, the name of the associated screen, a copy of the last playlist received and the size of the downloaded files, so that the establishment continues displaying content in the event of a connection outage. It also keeps, in the Device’s temporary memory, copies of the Customer Content files included in that playlist, so as not to download them on every playback; those copies disappear when the Device is switched off or unpaired. The registry information is removed when the Roku Application is uninstalled, and the credential ceases to have effect as soon as the Customer unpairs the Device from the Platform.

The Controller has implemented reasonable administrative, technical and physical security measures to protect personal data against damage, loss, alteration, destruction, or unauthorized use, access or processing, including encryption of communications by means of the transport layer security protocol, storage of passwords using non-reversible key derivation functions, role-based access control, isolation of each Customer’s data, issuance of per-Device revocable credentials, and periodic database backups.

In the event of a security breach that materially affects the property or moral rights of the Data Subject, the Controller shall notify the Data Subject without delay at the electronic mail address associated with their account, so that appropriate measures may be taken.

The Controller reserves the right to amend or update this Privacy Policy at any time as a result of changes in its practices, its Processors, the Service or applicable legislation.

The version in force shall be permanently available at https://screenads.ovenlabs.io/en/privacy (abre en una pestaña nueva), indicating the date of its last update. In the case of material amendments, the Controller shall notify the Data Subject by electronic mail no less than 15 calendar days prior to their entry into force.

Should the Data Subject consider that their right to the protection of personal data has been infringed by any act or omission of the Controller, or presume any violation of the provisions of the Law, they may file the corresponding complaint before the Secretaría Anticorrupción y Buen Gobierno, the authority competent in matters of protection of personal data held by private parties in Mexico.

The Platform keeps a log of the activity carried out within each account, recording sign-in and sign-out, failed access attempts, and the queries, creations, modifications and deletions performed on locations, screens, devices, media, playlists, schedules and account data.

Each entry retains the name and email of the actor, the account acted upon, a description of the operation, its date and time, and the internet protocol address from which it was performed. This log exists in order to evidence who did what within an account, to allow the Customer to audit the activity of their own business, and to investigate security incidents. It is not used for commercial or advertising purposes.

Where the Controller’s personnel access an account in support mode, such access is recorded expressly and distinctly in the same log.

No advertising, no tracking, no sensors

ScreenAds screens only play content. They incorporate no cameras, microphones or sensors, and capture no images, sound, people counts or any other data concerning those who pass in front of them.

Should audience measurement features ever be incorporated, the Controller would update this Policy and would first obtain the corresponding consents and authorizations.

This Clause applies only to Data Subjects residing in those territories and is additional to, and does not replace, the rights recognized in the preceding Clauses.

I. Residents of California and other United States jurisdictions

Under the California Consumer Privacy Act and equivalent state legislation, the Data Subject has the right to know the categories of personal information collected and the purposes of its use, to request a copy of that information, to request its deletion, to correct inaccurate information, and not to be discriminated against for exercising these rights.

The Controller does not sell personal information and does not share it for cross-context behavioral advertising, as those terms are defined in such legislation, and therefore no opt-out mechanism is offered: there is no sale or sharing to opt out of. The Service is not directed to persons under sixteen years of age and the Controller does not knowingly collect their information.

II. Residents of the European Economic Area and the United Kingdom

Under the General Data Protection Regulation, the legal bases for processing are the performance of the contract in respect of the necessary purposes set out in Clause Six, the Controller’s legitimate interest in the security of the Service in respect of audit records, compliance with legal obligations in respect of tax data, and consent in respect of the optional purposes set out in Clause Seven.

The Data Subject has the rights of access, rectification, erasure, restriction of processing, portability and objection, as well as the right to withdraw consent at any time without affecting the lawfulness of prior processing, and to lodge a complaint with the supervisory authority of their country of residence.

International transfers to the Processors identified in Clause Eight are covered by the standard contractual clauses approved by the European Commission or by whichever adequacy mechanism applies to each provider.

These rights are exercised by the same means and on the same terms set out in Clause Eleven.

The Data Subject states that they have read and understood the terms and scope of this Privacy Policy and grants their consent to the processing of their personal data on the terms expressed herein.

In the case of the creation of an account on the Platform, consent is expressed through registration and use of the Service, this Policy being permanently available and accessible without the need to sign in.