This is a draft policy pending legal review.
1. Data controller
The data controller for personal data processed through NovaScreen (the "Service") is BOSH Group Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom, company number 10893235. This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
2. Personal data we collect
- Account data: company name, username, email address and a hashed (not plain-text) password.
- Billing data: subscription and payment details, processed on our behalf by Stripe — we do not store full card numbers.
- Uploaded content: images, video, documents and other files you upload for display on your screens.
- Screen & device telemetry: information from paired players such as online/offline status, last-seen time and playback logs.
3. Lawful basis for processing
We process personal data under the following lawful bases:
- Contract — to create and administer your account, provide the Service and process billing.
- Legitimate interests — to maintain the security and reliability of the Service, prevent misuse, and improve our product.
- Consent — where you have opted in to optional features, such as marketing communications or optional single sign-on.
4. How data is shared — subprocessors
We share personal data with the following categories of subprocessor, only as needed to provide the Service:
- Stripe — payment processing for paid subscriptions.
- An SMTP email provider — for account, verification and notification emails, falling back to the server's own mail delivery if the configured provider is unavailable.
- Optional S3-compatible storage — for hosting uploaded media, where this option is configured for your account.
- Optional Google or Microsoft single sign-on — only if you choose to sign in using one of these providers.
We do not sell personal data.
5. Data retention
We retain account, billing and content data for as long as your account is active, and for a reasonable period afterwards to comply with legal, accounting or tax obligations, and to resolve disputes. See our Terms & Conditions for what happens to content if a subscription lapses.
6. Your rights
Under UK GDPR you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected (rectification);
- have your data deleted in certain circumstances (erasure);
- receive your data in a portable format (portability); and
- object to certain processing.
To exercise any of these rights, contact us at info@boshgroup.co.uk.
7. Data location & security
All traffic to the Service is encrypted in transit over HTTPS. Passwords are stored hashed, never in plain text, and we use session security controls to protect authenticated access. See our Cookie Policy for details of the session cookie used to keep you signed in.
8. International transfers
Where a subprocessor listed above processes data outside the UK, we rely on appropriate safeguards, such as the UK's International Data Transfer Addendum or an adequacy decision, to ensure your data remains protected.
9. Complaints
If you have concerns about how we handle your personal data, please contact us first at info@boshgroup.co.uk. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO), the UK's data protection regulator, at ico.org.uk.
10. Contact
For any privacy or GDPR-related query, contact info@boshgroup.co.uk, or write to BOSH Group Limited, 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.