Privacy Policy

1. Who we are

This website is operated by ClickClickPlay OÜ, registry code 17439378, Sepapaja tn 6, 15551 Tallinn, Estonia. We are the controller of the personal data described here.

We sell advertising on screens, including in workplaces, gyms, hotels and stores, on our own network and through our partner network. We also run the screens at conferences and trade fairs, and provide signage software, including an Android TV app.

Website: clickclickplay.com
Contact: hello@clickclickplay.com

2. What data we collect

When you submit one of our forms

Depending on which form you use, and which fields you choose to fill in, this is:

• Your name
• Email address
• Company name
• Phone number (optional)
• Your message
• On the "Send me this plan" form on our audience pages: your work email, company name, what you sell (optional) and the locations you selected, which we use to answer your enquiry with a plan

Recorded automatically along with the submission: the date and time, the page you sent it from, the site language you were reading, and your IP address. The IP address is used to limit one connection to eight submissions in ten minutes, which is what keeps the form from being usable as a spam relay.

When you simply visit

We set no tracking cookies and load no tracker unless you allow it - see section 4. Our web server does, however, write an ordinary access log for every request it answers, containing your IP address, the page requested, the time, the response status, and the browser identification your browser sends. This is what a web server has to record in order to be operated and defended at all, and the log is a rotating buffer that overwrites its oldest entries.

3. Why we use it, and on what legal basis

• To answer your enquiry - about advertising, a plan for the locations you selected, event screens or our software - and to manage the sales process that follows. Legal basis: steps taken at your request before entering into a contract, Art. 6(1)(b) GDPR, together with the consent you give by ticking the box on the form, Art. 6(1)(a).
• To keep the form working - the IP-based rate limit and the spam checks. Legal basis: our legitimate interest in a contact form that is not abused, Art. 6(1)(f).
• To operate and secure the website - the server access log. Legal basis: legitimate interest, Art. 6(1)(f).
• To understand which pages are read - website analytics. Legal basis: your consent, Art. 6(1)(a), which you can withdraw at any time.

We do not sell or rent your data. We do not enrich data from our forms with third-party sources, and we do not use it for marketing you did not ask for.

4. Cookies and local storage

The site needs no cookie to function, and sets none for tracking. Your privacy choice itself is stored in your browser's local storage under the key ccp_consent_v1, for six months, so you are not asked again on every page. It never leaves your browser.

Beyond that there is one optional category, and nothing in it loads until you allow it on the banner shown on your first visit - no request reaches the provider before then:

• Analytics - Google Analytics, to see which pages are read. IP addresses are anonymised, and advertising and remarketing features are switched off.

You can decline it, or change your mind later using the privacy button at the bottom left of any page. Declining does not affect your ability to use the website.

5. Who else sees your data

• HubSpot - when you submit a form, the details you entered are stored in HubSpot CRM so we can manage the enquiry. HubSpot receives what you typed into the form and nothing more: we do not enrich it, and HubSpot does not track your browsing on this site. Our portal is hosted in the EU. Privacy policy: legal.hubspot.com/privacy-policy.
• HubSpot Meetings - our booking links lead to a HubSpot-hosted page. Nothing from HubSpot is embedded in this site, so no data reaches them until you follow such a link, and what you enter there is covered by the same policy.
• Google - only if you allow analytics. Privacy policy: policies.google.com/privacy.
• OpenStreetMap - on some pages you can show a map. Only when you click "Show the map" does your browser load map tiles through the OpenStreetMap Foundation's server network, which may be outside the EU; your IP address is transmitted in the process. Without a click, no data reaches them.
• Amazon Web Services - the website and the form's backend run on a virtual server we rent from AWS in an EU region. AWS hosts the data on our instructions and does not use it for its own purposes; it is not stored outside the EU by us.

HubSpot and Google are US-headquartered. Where personal data reaches them outside the EEA, that transfer is covered by the European Commission's standard contractual clauses and, for US recipients, by the EU-US Data Privacy Framework.

6. How long we keep it

• Enquiries - kept in our CRM, and in a submission file on our own server, while we deal with your enquiry and for 12 months afterwards. Where a contract results, records are kept for the statutory retention periods under accounting and tax law.
• Server access logs - held in a rotating buffer and overwritten by newer entries; we do not archive them.
• Your privacy choice - six months, in your browser, after which you are asked again.

If you ask us to delete your data, we delete it from both the CRM and the submission file, except where we are legally required to keep it.

7. Your rights

Under the GDPR you have the right to ask us for access to your personal data and a copy of it, to have it corrected or deleted, to have its processing restricted, and to receive it in a portable form. Where we process data on your consent, you may withdraw that consent at any time, which does not affect anything done before you withdrew it.

Right to object: Where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

To exercise any of these, write to hello@clickclickplay.com. We answer within one month.

You also have the right to complain to a data protection authority. In Estonia this is the Andmekaitse Inspektsioon, aki.ee, and in Berlin the Berlin Commissioner for Data Protection and Freedom of Information. You may also complain to the supervisory authority where you live or work, or where the alleged infringement took place; in Germany that is usually the authority of your federal state.

8. Contact

ClickClickPlay OÜ
Sepapaja tn 6
15551 Tallinn
Estonia
Email: hello@clickclickplay.com