Privacy Policy

The controller for data processing on contboxx.com is:

Adversign Media GmbH
Immermannstraße 12
40210 Düsseldorf, Germany
Phone: +49 211 355814-0
Email: info@adversign-media.de

You can reach our data protection officer at:

Sebastian Neumann
Adversign Media GmbH
Immermannstraße 12
40210 Düsseldorf, Germany
Email: datenschutz@adversign-media.de

• We do not use third-party tracking or advertising tools. We count visits to the website ourselves, without cookies and without recognising you across days. We only use cookies where they are technically necessary.
• The website, database and content delivery run on Amazon Web Services in the Frankfurt am Main data centre.
• Payment data (card, bank account) is collected only by our payment service provider Stripe, not by us.
• We use Zoho, with a data centre in the EU, for customer management, invoicing and the contact form.
• Our AI processes news sources, not data about our customers. The text of a content wish is read only by our own language model, to detect its language (section 8).
• The games on the screens do not collect any data about the people who play them.
• We analyse statistically, per customer account, which content is retrieved through our interfaces, in order to improve our offering (section 9).

When you visit contboxx.com, our web server processes technically necessary data transmitted by your browser: IP address, date and time, requested address, status code, amount of data transferred, the previously visited page (referrer) as well as browser and operating system. This data is stored in server log files.

Purpose: delivering the website, stability and security, such as defending against attacks. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in the secure operation of the website. Retention: log files are deleted after 30 days at the latest, unless a specific security incident needs to be investigated for longer.

We serve the website’s fonts ourselves; no data is transferred to Google or other font providers when you visit. The news ticker on the home page is loaded by our server; your browser does not make any request to third parties for it.

On the pages with our games (content catalogue, games section) and on the solutions pages, your browser loads the games’ preview images directly from our content service Atlas, which delivers them via the Amazon CloudFront content delivery network (sections 9 and 14). Amazon Web Services thereby receives your IP address and the information your browser sends with every request, such as browser and operating system, the address of the image and the page requesting it. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in delivering the images quickly and reliably.

Cookieless audience measurement

To understand which pages are used and where visitors come from, we count visits to the public pages with our own method on our own server. Nothing is stored on or read from your device — no cookies, no local storage. We record the page visited (without parameters), the referring website (domain only), campaign identifiers from the link (utm_source, utm_campaign), device type, browser and operating system family, the page language, the country derived from the IP address, and time on page and scroll depth. Clicks on individual buttons and on links to other websites are counted as events.

To count visitors per day, we compute a checksum from the IP address and browser identifier together with a random value that is valid for one day only and then deleted. We do not store the IP address itself. As a result, neither we nor anyone else can recognise a visitor across days. The data does not leave our servers. If your browser sends “Do Not Track” or “Global Privacy Control”, no measurement takes place.

Purpose: improving the website and measuring the success of our content and campaigns. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in designing the website according to need. As your device is not accessed, no consent under Section 25 TDDDG is required. Retention: 13 months, then deleted automatically. Objection: you can object to the measurement at any time (Art. 21 GDPR), most simply via your browser’s Do Not Track or Global Privacy Control setting.

Prices in your currency

As long as we also offer prices in US dollars, the public pages show them in euros or in US dollars. If you are not signed in and have not chosen the currency yourself, we use your IP address to work out which country you are visiting from: visitors from the EU, the EEA, Switzerland and the other countries that use the euro see euros, everyone else US dollars. The lookup runs in a country database on our own server. The IP address is neither stored nor logged nor passed on to third parties for this; only the two-letter country code is used, and only for this one page view. If you choose the currency yourself next to the language selector, we remember it in a cookie (section 13) and no longer look up the country. If you are signed in, the display follows your account (section 5).

Purpose: prices in the currency you are likely to pay in. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in showing visitors from different countries suitable prices. Retention: none. Objection: choose the currency yourself; the lookup then no longer takes place.

Registration with an email address

For an account, we collect your name, your email address, your company or organisation and a password. We store the password only as a cryptographic hash (bcrypt), never in plain text. To confirm your email address, we send you a link valid for 24 hours; to reset your password, a link valid for 30 minutes.

When you accept our Terms and Conditions, we store the time and the version you accepted so that we can prove the conclusion of the contract.

Sign-in with Google

Alternatively, you can sign in with your Google account. Our site then redirects you to Google. Google transmits your name, your email address and your profile picture to us; we do not learn your Google password. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework. Processing by Google is governed by Google’s privacy policy.

Customer profile

In your account you can store further details we need for the contract, invoicing and VAT: first and last name, position, phone, address, country, VAT identification number, commercial register, tax number, billing email, order number, cost centre and reference. We also store the language you registered in or chose in the settings, so that the dashboard and emails appear in your language.

Purpose: concluding and performing the contract, managing your account, invoicing. Legal basis: Art. 6(1)(b) GDPR; for information required by tax and commercial law Art. 6(1)(c) GDPR; for sign-in with Google, additionally your choice of this sign-in method. Retention: we store your account for as long as it exists. When a paid plan ends, it remains as a free account until you request its deletion. Links for confirmation and for resetting the password expire after the periods stated.

Checking the VAT identification number

If you enter a VAT identification number of an EU member state, we check its validity via the European Commission’s VAT Information Exchange System (VIES). For this we transmit the number with its country code and, where set up, our own VAT identification number as the requesting party; VIES queries the number with the tax administration of the member state concerned. We check when you enter or change the number, with every order, and before a renewal if the last confirmation is more than 30 days old. We keep the result of a query in memory for up to 24 hours. With your profile we store when VIES last confirmed the number and, if VIES issues one, the identifier of the query as proof. If VIES rejects the number before a renewal, we remove it from your profile and charge VAT.

Purpose: checking whether we may invoice without German VAT (reverse charge), and proof of this. Legal basis: Art. 6(1)(c) GDPR in conjunction with the obligations to provide evidence under VAT law. Recipients: the European Commission (VIES) and the tax administration of the member state that issued the number. Retention: time and identifier of the confirmation for as long as the number is in your profile; if you change or remove it, we delete both.

You pay for paid plans by credit card or SEPA direct debit via Stripe. You enter your payment details directly with Stripe; we do not receive or store them. We only store the customer number assigned by Stripe, the identifier of your payment method, and the amount and status of payments, so that we can collect renewals.

Whether we bill in euros or in US dollars depends on the country of your billing address (Terms § 12(2)). With your first paid booking we store this currency with your account; it then applies to all further bookings and invoices.

The provider is Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. Stripe processes certain data under its own responsibility, for example for fraud prevention and to meet its own legal obligations. Data may be transferred to Stripe, Inc. in the USA; Stripe, Inc. is certified under the EU-US Data Privacy Framework. Details in Stripe’s privacy policy.

Legal basis: Art. 6(1)(b) GDPR. Retention: we keep payment information as part of our accounting for the statutory periods (see section 6).

With every registration, including for the free plan, we create a contact in our customer management system Zoho CRM and in our accounting system Zoho Books (name, email address, company). When you book, Zoho Books creates the invoice and sends it by email as a PDF; for this, Zoho processes your billing details. In Zoho CRM we also note whether you use contboxx free of charge or on a paid plan.

If you change your name, company, phone, address or VAT identification number in your account, we transmit the change to the contacts we created for you in Zoho CRM and Zoho Books; we do not transmit your email addresses. If a contact with your email address already existed there when you registered, for example from another contract with us, we do not change its details and at most add your billing address.

The provider is Zoho Corporation B.V., Beneluxlaan 4B, 3527 HT Utrecht, Netherlands. We use Zoho’s European data centre (zoho.eu). Zoho processes the data on our behalf (Art. 28 GDPR).

Purpose: customer care, invoicing and bookkeeping. Legal basis: Art. 6(1)(b) and (c) GDPR; for contacts on the free plan Art. 6(1)(f) GDPR, our legitimate interest lies in uniform customer management. Retention: we keep invoices and accounting records for eight years and commercial and business letters for six years in accordance with § 147 of the German Fiscal Code (AO) and § 257 of the German Commercial Code (HGB). Contacts without such an obligation are deleted when the account is deleted.

We send confirmation, password and notification emails via Amazon Simple Email Service (SES) in the Frankfurt am Main data centre (for the provider see section 14). These include the confirmation of your email address, links for resetting your password, a security notice when your password has been changed or reset, notices about payment problems (a charge failed, your bank requires a confirmation, a direct debit was returned, no payment method is stored, or a plan or package ends after unsuccessful attempts), the confirmation of content wishes and confirmation links, quotes and receipts of the procurement interface (section 8). Your email address and the content of the message are processed. Legal basis: Art. 6(1)(b) GDPR. We do not send newsletters.

If you write to us via the contact form, we transmit your name, email address, company, subject, message and the language of the page to Zoho Forms (Zoho Corporation B.V., data centre in the EU, see section 6). We store and handle your enquiry there; we do not keep it in our own database. The form loads no scripts and no cookies from Zoho. The same applies accordingly to enquiries by email, which stay in our mailbox. Purpose: handling your enquiry. Legal basis: Art. 6(1)(b) GDPR if the enquiry concerns a contract, otherwise Art. 6(1)(f) GDPR. Retention: we delete enquiries once they have been dealt with and no retention obligation applies, after two years at the latest.

Content wishes

In the content catalogue you can tell us which content you are missing. For this we store your email address, your text, the language of your text and the time in our database and forward your wish to our team by email. The language is determined by a language model on our own hardware: your text is passed to this model through our content service Atlas (data centre in Frankfurt am Main) and is not stored there. The model does not receive your email address, and providers of external AI services receive neither your text nor your address. We then send you a confirmation by email in your language, at most one per day; the same model translates its text from our own template, not from your message. Purpose: evaluating your wish to develop our offering and confirming it to you. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is aligning our offering with what our users need. Retention: we delete wishes after one year, or immediately at your request.

Quotes and requests through the procurement interface

Through our procurement interface (for procurement systems and AI agents, also as an MCP server) someone can request a quote or an individual Enterprise offer for you – you yourself, a system on your behalf, or a colleague. If someone else gave your address, the data comes from them. For a quote we store the e-mail address it is for, the chosen configuration (plan, period, package, country, tax treatment) and the time. A VAT ID and postcode given are only used for the calculation and not stored; we check the VAT ID in the VAT Information Exchange System (VIES) of the European Commission (under our own responsibility, section 14), also for a mere price request. We first send an e-mail to the address with a link to a page where you can confirm the quote or delete it right away; we only send the quote itself after confirmation. For an Enterprise request we store the e-mail address, company, optionally your name and the details of the need (screens, locations, content, term, payment method, e-invoice and routing ID, purchase order number, deadline, message), forward them by e-mail to our team and confirm receipt to you with the request number, at most once a day. A log records when a quote or request was created, confirmed or put into the cart and when an e-mail about it was sent, and through which kind of access (interface, MCP, website); it contains no IP address and the e-mail address only as an encrypted checksum for the first two days, so that we can limit the number of e-mails to one address. Purpose: preparing and sending the quote, handling the request, protecting the interface against misuse. Legal basis: Art. 6(1)(b) GDPR where you or a system on your behalf request the quote or offer for you. Where you act for a company or someone else gave your address, we rely on Art. 6(1)(f) GDPR; our legitimate interest is handling business requests and checking, before sending a quote, that the request comes from you. You can object to this processing (section 16). Retention: we delete unconfirmed quotes together with their log entries after seven days (the confirmation link is valid for 72 hours; the remaining days serve to fend off misuse), confirmed ones after 120 days (validity plus proof of the quoted price for a later order), requests and the log after two years. If a contract is concluded, we keep the related correspondence as business letters for the statutory periods. At your request we delete immediately.

Our system “Atlas” delivers the content to our customers’ screens. Atlas runs on Amazon Web Services in the Frankfurt am Main data centre. We deliver images via the Amazon CloudFront content delivery network, which distributes them via locations in Europe and North America.

Every retrieval contains an API key that we assign to the customer account. During retrieval, we technically process the IP address of the requesting device (usually the player), the time and the requested address. We count retrievals per API key and day to enforce the daily quota; these counters expire automatically after two days at the latest. To protect against overload and attacks, a firewall limits the number of requests per IP address. We delete technical application logs containing the requested address after 90 days at the latest.

The HTML widgets currently load fonts from Google Fonts (Google Ireland Limited). Google thereby receives the IP address of the player on which the widget runs.

Purpose: delivering the booked content, enforcing quotas, billing and security. Legal basis: Art. 6(1)(b) GDPR towards our customers; where data from third-party devices is concerned, Art. 6(1)(f) GDPR, our legitimate interest lies in reliable and secure delivery.

Usage statistics

So that we can see which content is used, we additionally count retrievals per customer account, API key and content item (channel, mix, game, Game Box, weather location, football league, departure board). Each counter also records the hour of the retrieval, the output format, language and display variant, and whether the retrieval was delivered or refused. We do not store the player’s IP address or the API key in plain text for this purpose. For the period since April 2026 we derived these figures once from the technical application logs.

Purpose: decisions about our catalogue and product, such as which content to expand or discontinue. We analyse the figures internally and do not pass them on to third parties. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest lies in aligning our offering with actual use. Retention: hourly figures 35 days, daily figures 25 months. If your account is deleted, we no longer assign the figures to any account; they remain only as totals per content item. You can object to the usage statistics (section 16); we then delete the figures assigned to your account and no longer record your retrievals.

If you create locations, we store the name, coordinates, country and region as well as the selected units with your account. If you enter an address instead of a town, we also store street, house number, postal code and town. With the address, content near you is calculated more precisely, such as charging stations, stops or warnings; the address never appears on a screen.

For the address search we pass your search text and, once, the address you choose to the Amazon Location Service of Amazon Web Services (endpoint in the Frankfurt am Main data centre, section 14), without any information about your account. The data provider behind this service may process the request outside the EU as well; according to AWS, it is passed on without any link to you, and the provider may not store it. We only store the result for the address you select.

For the weather data, Atlas queries the contboxx weather service with the coordinates only, without any information about your account. We query the occupancy of charging stations at MobiData BW only for a fixed grid of about two kilometres per side, never for your location. Legal basis: Art. 6(1)(b) GDPR. Retention: until you delete the location or your account; an address you remove is deleted at once.

The games do not collect any personal data of the people who play them at the screen: there is no name entry, no leaderboards with names, no camera, no microphone and no location access. The games only store the game state, anonymous daily counters (for example in polls) and the language selection in the local storage of the screen device; this data does not leave the device. The games do not set cookies and do not load content from third parties.

Atlas creates the texts of our content channels from news and data sources with the help of artificial intelligence. For this we use language models on our own hardware and the interface of Anthropic, PBC (USA); Google’s image generation may be used for images. We only transmit source material and our own texts to these services, no data about our customers or website visitors. The one exception is content wishes (section 8): their text is processed solely by the language model on our own hardware, to detect its language. dpa content is not processed by AI.

We only use cookies and storage entries that are technically necessary for operation. No consent is required for this (§ 25(2) no. 2 of the German TDDDG). We base the subsequent processing on Art. 6(1)(b) GDPR (sign-in, cart, dashboard) or Art. 6(1)(f) GDPR (language and currency setting, cookie notice).

We do not use third-party analytics, marketing or tracking tools; our own audience measurement (section 3) works without cookies or local storage. Should this change, we will ask for your consent beforehand and update this policy.

We only pass on personal data where necessary for the purposes stated. The following service providers process data on our behalf or, where indicated, under their own responsibility:

Amazon Web Services, Stripe and Google belong to groups headquartered in the USA. For transfers to the USA we rely on the European Commission’s adequacy decision on the EU-US Data Privacy Framework (Art. 45 GDPR) where the recipient is certified, and otherwise on the European Commission’s standard contractual clauses (Art. 46(2)(c) GDPR).

We receive content from the Deutsche Presse-Agentur (dpa) as a delivery; we do not transmit any data about you to dpa.

Without a name, email address and company we cannot create an account; without billing details we cannot invoice paid plans. A quote through the procurement interface needs an email address, an Enterprise request also the company. Beyond that, you are not obliged to provide us with data. There is no automated decision-making, including profiling, within the meaning of Art. 22 GDPR.

You have the right to

• access the data stored about you (Art. 15 GDPR),
• rectification of inaccurate data (Art. 16 GDPR),
• erasure (Art. 17 GDPR), unless a retention obligation prevents it,
• restriction of processing (Art. 18 GDPR),
• data portability (Art. 20 GDPR).

Right to object: where we process data on the basis of our legitimate interest (Art. 6(1)(f) GDPR), you may object at any time on grounds relating to your particular situation (Art. 21 GDPR). We will then no longer process the data unless we can demonstrate compelling legitimate grounds.

To exercise your rights or have your account deleted, write to datenschutz@adversign-media.de.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW), Kavalleriestraße 2–4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

We update this privacy policy when our processing changes, for example due to a new service provider. The version published here applies.