Univerza Digital Signage Privacy Notice

UNIVERZA COMPANY LIMITED ("the Company", "we" or "us") issues this notice to explain how Univerza Digital Signage collects, uses and discloses your personal data under Thailand's Personal Data Protection Act B.E. 2562 (2019). This notice supplements the Company's Personal Data Protection Policy; for matters relating to Univerza Digital Signage, this notice applies.

1. Data controller and scope

Data controller: UNIVERZA COMPANY LIMITED, Business Registration Number 0205569041361.

This notice applies to:

• the Univerza Digital Signage app for advertisers on iOS and Android;
• the management website used by screen owners, administrators and staff;
• display screens connected to the system.

2. Data we collect

Category	Details	Source
Account data	First and last name, email, username, password (stored as a hash, never in plain text), phone number and the language you choose in the app	You
Sign in with Google or Apple	The account identifier, email and name that Google or Apple share with us when you choose this sign-in method	Google, Apple
Profile data	Profile picture (optional)	You
Receipt / tax invoice details	Buyer type (individual or company), the name to show on documents, company name, tax ID (for an individual, the national ID number), branch (head office or branch number) and address. A company must give its tax ID and branch; for an individual, the tax ID and address are optional	You
Documents issued to you	Receipts / tax invoices and credit notes, which carry the receipt details above as they were on the date of issue, the items bought and the amounts	Our systems
Ad content	Images and videos you upload, including any information that appears in them	You
Orders and payments	Bookings and ad-slot purchases, amounts, payment method and status, refunds and your in-app credit balance. Card details are entered into and processed by our payment service provider (Mr. Fox Payment Gateway)	You, payment service provider
Playback records	When a screen started and played your ad, used to confirm delivery and assess refunds	Display screens
Approximate location	Low-accuracy coordinates, only when you sort screens by distance and grant location permission	Your device
Notifications	Push notification tokens and your push, email and SMS notification settings	Your device
Usage and security	Last sign-in and activity times, failed sign-in attempts, activity logs and IP address	Our systems
App crash reports	Device model, operating system, app version and technical details when the app fails	Your device
Terms acceptance	The version of the Terms of Use you accepted and when	Our systems
Screen owner data	PromptPay account for payouts, settlement and transfer records, and venue and screen details	Screen owners

3. Device permissions

• Location is used only when you sort screens by distance. The app requests low-accuracy coordinates, sends them to calculate distance for that request, and does not store them on your account.
• Camera is used to scan the QR code on a screen to open that screen's page, and to take photos or videos to upload as ad content or a profile picture. QR codes are read on your device; the app does not store or send camera images while scanning.
• Photo library is used to choose images and videos to upload. The app uploads only the files you select.
• Notifications are used to tell you about order status, payments, refunds and content review results.

You can deny or revoke these permissions at any time in your device settings and continue using the rest of the app.

4. Purposes and legal bases

Purpose	Legal basis
Create and maintain your account, verify your identity and let you sign in	Contract
Take orders and payments, show ads on the screens you choose, and refund you when an ad is not delivered as purchased	Contract
Issue receipts / tax invoices and credit notes, and email them to you	Legal obligation, contract
Review ad content before it is shown, using automated systems and staff	Contract, legitimate interests, legal obligation
Settle and pay out revenue to screen owners	Contract
Send account and order notifications by push, email or SMS, in the language you choose	Contract
Show screens near you	Contract, when you choose the feature and grant location permission
Prevent fraud, keep the service secure and fix faults	Legitimate interests
Keep accounting and tax records and comply with orders from authorities	Legal obligation
Establish, exercise or defend legal claims	Legitimate interests

If you do not provide data we need to deliver the service, such as your email or payment details, we may be unable to serve you.

We do not sell your personal data, and we do not use it to track you across other companies' apps or websites. If we want to use your data for marketing that requires consent by law, we will ask for your consent first.

5. Who we share data with

• Administrators of the screens you order ad time on, limited to what they need to review and show the ad, such as the ad content and order details
• Cloud hosting and file storage providers (Amazon Web Services), including the files of documents issued to you
• Image and video processing and review providers
• Payment service providers and banks (Mr. Fox Payment Gateway)
• Push notification (Google Firebase Cloud Messaging and OneSignal), email (Google) and SMS (Mr. Fox) providers
• App crash reporting providers (Google Firebase Crashlytics)
• Google and Apple, when you choose to sign in with those accounts
• The Company's legal advisers and auditors
• Government agencies, courts or officials where required by law, such as the Revenue Department

Service providers process data on our instructions, only for the purposes in this notice, and must keep it secure.

6. International transfers

Our systems and some of our service providers store or process data on servers outside Thailand, such as in Singapore and the United States. We only transfer data to providers with adequate personal data protection safeguards as required by law.

7. Retention

Data	Retention period
Account and profile data, including saved receipt details	While your account is active, or until you change it. On deletion, see section 8
Activity logs	30 days
Sign-in session data	Up to 30 days after expiry or revocation
Uploaded ad content	Until you delete it in the app, or as long as needed for related orders and complaints
Orders, payments, refunds, credit and playback records	As required by accounting and tax laws, and for the limitation period of related legal claims
Receipts / tax invoices and credit notes already issued	At least 5 years from the date of issue, as tax and accounting laws require, even after you delete your account
App crash reports	According to Firebase Crashlytics retention

After these periods, we delete, destroy or anonymise the data.

8. Account deletion

You can delete your account in the app or request deletion by email. When you delete your account, we:

• sign you out on all devices and stop sending you notifications;
• delete your profile picture, phone number and the receipt details saved on your profile;
• unlink Google and Apple sign-in;
• replace your name, email and username with values that cannot identify you.

Order and payment records, and documents already issued (which carry the name, tax ID and address as they were on the date of issue), are kept as described in section 7. See "Account and Data Deletion" for details.

9. Security

• Data is transmitted over encrypted connections (HTTPS).
• Passwords are stored as hashes, and screen owners' PromptPay account details are encrypted.
• Access to data is restricted by user role, and documents can be downloaded only by their owner and our staff, through links that expire shortly.
• Sign-in is temporarily locked after repeated failed password attempts.

If a personal data breach is likely to put your rights and freedoms at risk, we will notify the Personal Data Protection Committee and you as required by law.

10. Your rights

• Access your data and obtain a copy
• Receive or transfer your data in a machine-readable format
• Object to the collection, use or disclosure of your data
• Have your data deleted, destroyed or anonymised
• Restrict the use of your data
• Have your data corrected and kept up to date
• Withdraw consent you have given, without affecting processing before withdrawal
• Complain to the Office of the Personal Data Protection Committee

You can update your name, phone number, profile picture, receipt details, language and notification settings in the app. Changed receipt details apply to documents issued afterwards. Documents already issued cannot be changed in the app; if one is wrong, contact us and we will cancel it and issue a new one.

For other requests, email developer@univerza.co from the email address on your account. We may ask for more information to verify your identity and will respond within 30 days of receiving your request. We may refuse a request where the law allows, for example a request to delete documents the law requires us to keep, and will tell you why.

11. Minors

The service is intended for advertisers and screen owners, not for minors. If you are under 20 years of age, you must obtain consent from your parent or guardian before using the service. If we learn that we have collected a minor's data without such consent, we will delete it.

12. Changes to this notice

We may update this notice from time to time. The latest version is published with its version number and effective date. For significant changes, we will notify you in the app or by email.

13. Contact us

UNIVERZA COMPANY LIMITED
800/108 Sukhumvit Road, Saen Suk, Mueang Chon Buri, Chon Buri 20130, Thailand
Business Registration Number 0205569041361
Email developer@univerza.co Tel. 087-148-3537