Privacy policy

This information applies to the modsi.de website, the modsi control web application, the “modsi control” mobile app (iOS and Android), the “modsiTV” player apps (Apple TV, Android TV) and the web player at play.modsi.de. The technical details describe the actual state of the application.

1. Controller

EX-IT GmbH & Co. KG
Bahnhofstraße 17, 63571 Gelnhausen, Germany
Email: info@ex-it.eu · Phone: +49 6051 4973400

No data protection officer has been appointed, as the statutory requirements for doing so are not met.

2. Two roles: controller and processor

We are the controller for the account and sign-in data of all users – including team members invited by customers – (name, email address, password, two-factor authentication, passkeys, sessions, security log, push tokens) and for our customers’ contract and billing data. What a customer specifies for its company and what is logged there – roles and location permissions of its team members, approvals and the audit log of actions within the company – we process as a processor on behalf of the customer; the customer is the controller. For the content that customers upload to modsi and show on their screens (videos, images, overlay texts), and for the playback and device data generated in the process, we act as a processor on behalf of the respective customer; the customer is the controller. This is based on the data processing agreement pursuant to Art. 28 of the General Data Protection Regulation (GDPR), which forms part of the Terms of use. If you appear in a customer’s video or image, or if, as a team member, you want to know which role and permissions a company has given you or what is logged there about your actions, please contact that customer to exercise your rights; we will support the customer in this. For your account itself (sign-in, security, deletion), we are your point of contact.

3. Website modsi.de and play.modsi.de

Server logs

When the website is accessed, our web server (nginx) stores the IP address, time, requested address, HTTP status, amount of data transferred, referrer and browser identifier. Purpose: technical operation, troubleshooting and defence against attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure operation). The logs are deleted after 14 days.

Only a language cookie, no tracking

The website sets only one cookie: modsi_locale stores the language you have chosen (German or English) for up to twelve months so that the pages are shown in that language. It is only set when you choose a language yourself or a language is set in your account; it contains no identifier and is not analysed. As it merely implements the language choice you have expressly requested, it is strictly necessary for that purpose (§ 25(2) no. 2 TDDDG – Telekommunikation-Digitale-Dienste-Datenschutz-Gesetz, German Telecommunications and Digital Services Data Protection Act); no consent is required. The website does not use any analytics, advertising or social media services and does not load any fonts or scripts from third parties. After you sign in, the web application stores an access token in your browser’s local storage (localStorage) so that you remain signed in; the web player stores its device access, the orientation and the schedule there, and the media to be played in the browser cache. This storage is technically necessary for the service (§ 25(2) no. 2 TDDDG), and you can delete it by signing out or unpairing, or via your browser settings.

Contact form

We process your name, email address, optionally your company and phone number, the topic selected, your message and the language of the website when you send it in order to answer your enquiry. Legal basis: Art. 6(1)(b) GDPR (pre-contractual measures) or point (f) (answering general enquiries). The enquiry is stored in our database, forwarded to our mailbox and notified to our administrators by email and in the admin area, where we record the processing status and internal notes. If you request access, we use your details to create your company and invite you by email; from then on, sections 4 and 5 apply. Deletion: 12 months after processing has been completed (done or declined), enquiries still open at the latest 24 months after receipt – earlier at your request, unless a statutory retention obligation applies.

Reporting illegal content

You can report content via modsi.de/inhalte-melden. We process your name, email address, the location of the content, your reasons and the time of your statement made in good faith in order to review the report, confirm receipt to you and inform you of our decision (Art. 16 and 17 of Regulation (EU) 2022/2065, DSA). Legal basis: Art. 6(1)(c) GDPR. We inform the customer concerned of the content of the report, but not of your contact details, unless this is necessary for the pursuit of legal claims. Retention: 3 years after receipt of the report for evidential purposes; we then delete it.

4. Account and sign-in (modsi control in the browser and in the app)

When you register or are invited, we process your name, email address and password (stored only as a hash). When you register, we also store the time and version of your acceptance of the terms of use, including your confirmation that you are acting on behalf of a business (proof; Art. 6(1)(b) and (f) GDPR); this information is deleted together with the account. For account security, we additionally process the following, if you set it up: the two-factor authentication secret (stored encrypted), recovery codes (hashed), and the public keys and names of your passkeys. For each sign-in, we store the device name, the time of last use and – in the security log – the IP address and browser identifier of security-relevant actions (sign-in, password change, 2FA, passkeys). Legal basis: Art. 6(1)(b) GDPR (contract) and point (f) (protection of the account). The security log shows you the last 50 entries; entries older than 12 months are deleted. Sign-ins in the browser expire after 6 hours of inactivity.

If security-relevant changes are made, we send a notification email to your address (Art. 6(1)(f) GDPR, protection against account misuse). To reset your password, we send a link that is valid for 60 minutes.

Deletion of the account: You can delete your account yourself at any time in the web application and in the app (instructions: modsi.de/konto-loeschen). This deletes all account data, sessions, passkeys, 2FA data, push tokens, in-app notifications and the security log. To prevent the free trial from being used more than once by deleting the account and registering again, we thereafter store only an irreversible check value (HMAC) of your email address, from which the address cannot be recovered (Art. 6(1)(f) GDPR, prevention of misuse), for 24 months after the account has been deleted.

5. Company and contract data

To operate the account, we process the company’s data (name, locations with time zone, memberships, invitations) as well as contract and billing data (plan, number of licence slots, storage tier, term, price and payment term, billing address, VAT ID, email address for invoices, invoices, payments received and payment status). Legal basis: Art. 6(1)(b) GDPR. Roles and location permissions of the members, approvals and the log of actions within the company (audit log: who published, assigned or changed what and when – with IP address) we process on behalf of the customer (section 2); the customer uses them to organise its team and for traceability within its company. When the company is deleted, all of this data is deleted together with the media – except for the invoices, which we are required to retain (see below). After the end of the contract, we automatically delete the company together with the media 30 days after the end of the contract; if no plan was booked after the end of a free trial granted in the past, 90 days after the end of the trial. The owners receive a reminder by email 14 days and 3 days before the deletion. We retain invoice data for 8 years in accordance with § 147 AO (Abgabenordnung – German Fiscal Code), § 14b UStG (German VAT Act) and § 257 HGB (Handelsgesetzbuch – German Commercial Code).

6. Uploaded media and playback (processing on behalf of customers)

Videos and images uploaded by customers are stored in a private object storage in a data centre in Frankfurt am Main (see section 9). We automatically process videos technically (conversion into a uniform format, thumbnails) and deliver them to the paired players via short-lived, signed addresses. No analysis of the content takes place; we only view content if a report has been received or if legal provisions oblige us to do so. Deletion: immediately upon deletion by the customer, at the latest upon deletion of the company; older file versions in the object storage are removed at the latest 30 days thereafter (see section 9).

Player and playback data: From each paired screen, we process the device model, app version, IP address, connection status, the publication currently playing, errors, storage level and – for the customer’s playback statistics – which media were played on which screen and when. The players do not collect any data about persons in front of the screen: no camera, no microphone, no counting of viewers. We delete raw playback statistics data after 90 days; aggregated daily figures are retained for the customer’s statistics until the company is deleted.

Screenshots: When an authorised team member requests it in the app or web application, the player app for Android TV and the web player take a picture of their current screen output (JPEG, longest edge at most 960 pixels) and send it to us. The picture only shows what the screen is currently displaying, i.e. the customer’s content – not the surroundings; no camera is used. We store only the latest picture per screen in the object storage in Frankfurt am Main; each new picture replaces the previous one, and the replaced version is deleted after 30 days at the latest (see section 9). When the screen is deleted or archived, we remove the picture. The request is recorded in the company’s log. There are no screenshots on Apple TV; there, the app and web show a preview calculated from the playlist.

Live data for widgets: For weather displays, our server retrieves weather data from Open-Meteo (open-meteo.com) and only transmits the coordinates of the location that the company has stored for this purpose; when you search for a place in the location form, it transmits the place name entered. For tickers with an RSS feed and for calendar displays, our server retrieves the address specified by the company. These requests are made by our server, not by the screens or your device: the providers only receive our server’s IP address, no data about users, devices or viewers. We cache the retrieved data (weather, headlines, events) briefly and deliver it to the company’s players.

QR codes (short links)

Customers can show QR codes with a modsi short link on their screens (for example modsi.de/q/…). Anyone who scans such a QR code or opens the short link is immediately redirected by us to the address specified by the respective company; that company is responsible for the content there. For the company’s scan statistics, we count for each access the time, the screen (from the short link) and the device type (iPhone/iPad, Android or other, derived from the browser identifier). We do not store the IP address in the process. In order to recognise repeated accesses by the same person on the same day, we generate a day-specific one-way hash (check value) from the IP address, browser identifier, date and a secret key; neither the IP address nor the person can be determined from it, and it changes every day, so that accesses cannot be linked across days. We do not set any cookies in the process. Accesses by search engines and link previews are redirected but not counted. To protect against misuse, we briefly limit the number of accesses per IP address in memory. The counting is carried out on behalf of the respective company (Art. 28 GDPR); the legal basis on the company’s side is generally Art. 6(1)(f) GDPR (measuring the success of a promotion). Once a promotion has ended, the short link only shows a notice and no longer counts anything.

7. Payment processing

We bill by invoice and bank transfer. For this purpose, we process the billing address (name of the invoice recipient, address, country), the VAT ID where applicable, the email address for invoices (otherwise that of the owners), the invoices and the payments we have received. We create invoices as PDF files, store them in our private object storage in the data centre in Frankfurt am Main (see section 9) and send them by email (see section 8). For a bank transfer, we receive the usual details of the incoming payment from our bank (name and bank details of the payer, amount, date, payment reference). Legal basis: Art. 6(1)(b) GDPR; for the retention of invoices, Art. 6(1)(c) GDPR in conjunction with § 147 AO and § 257 HGB (see section 5). Until October 2026, we billed subscriptions via Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Dublin 2, Ireland; for subscriptions concluded before then, Stripe processes the payment data provided there as an independent controller, also in the USA (EU-U.S. Data Privacy Framework and standard contractual clauses), until they end and within the scope of statutory retention obligations. Further information: stripe.com/de/privacy.

8. Sending of emails

We send transactional emails (invitations, confirmations, password resets, security notifications, outage and approval notifications, confirmations of receipt, invoices) via the Mailtrap service of Railsware Products Studio LLC, 117 E Colorado Blvd, Suite 600, Office 650, Pasadena, CA 91105, USA, as a processor. In the process, the email address, subject and content of the message are processed; processing takes place in the USA. The transfer is based on the EU-U.S. Data Privacy Framework, in which Railsware states that it participates; alternatively, the standard contractual clauses of the EU Commission (Art. 46(2)(c) GDPR), which form part of the data processing agreement, apply. Legal basis: Art. 6(1)(b) and (f) GDPR. We do not use newsletters.

9. Hosting and processors

Agreements pursuant to Art. 28 GDPR are in place with all processors.

Backups: We back up the database (account, company and contract data as well as the other data stored in the application, excluding the media files) every day. Each backup is encrypted while still on the server; we keep the key required for decryption separately from the server. The backups are stored by DigitalOcean in a data centre in Frankfurt am Main (Germany) in an object storage separate from the server and are deleted automatically after 30 days. Deleted data therefore also disappears from the backups after 30 days at the latest. In the object storage for media, we retain older versions of deleted or replaced files for up to 30 days so that accidental deletions can be undone; after that, they are deleted automatically. Legal basis: Art. 6(1)(f) GDPR (protection against data loss, restoring the service after disruptions).

10. Mobile app and player apps

The “modsi control” app processes the same data as the web application. It accesses the camera only when you scan a QR code for pairing, and your photos/videos only when you upload media; in both cases only after you have granted permission in the operating system. For push notifications, it contains Google’s Firebase Cloud Messaging SDK (see below). The apps do not contain any advertising, analytics or crash reporting SDKs (such as Google Analytics for Firebase or Firebase Crashlytics) and do not send crash reports to us. The “modsiTV” player apps process only the device data specified in section 6.

Push notifications

The “modsi control” app can inform you by push notification when a screen goes offline or comes back online and when an approval has been requested or decided. To do so, after you sign in the app asks for permission to show notifications via the operating system; without your permission, you will not receive push notifications and we will not receive a token. Only after you have granted permission does the Firebase Cloud Messaging SDK generate a Firebase installation ID and a device token (push token) on your device; until then, automatic generation is switched off, and the app switches it off again when you sign out. The app transmits the token to us; we store it together with your user account, the platform (iOS or Android), the device name and the time of last use. A push notification contains a title and a short text – for outages, for example, the name of the screen, the location, the company and the time; for approvals, the name of the content, of the requesting or deciding person and of the company – as well as technical identifiers (type of notification, company, screen or approval) so that the app opens the right view when you tap it. For delivery, we transmit the token and the message to Google (Firebase Cloud Messaging); Google delivers them to your device via the notification service of Apple (iOS) or Google (Android). Google processes the data as our processor under the Firebase Data Processing and Security Terms (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA). Processing may also take place in the USA; this is based on the EU-U.S. Data Privacy Framework, under which Google LLC is certified, and alternatively on standard contractual clauses of the EU Commission. Legal basis: Art. 6(1)(b) GDPR (notifications as part of the service) or point (f) (timely information about outages). Storing the token on your device and accessing it are strictly necessary for the notifications you have requested (§ 25(2) no. 2 TDDDG). You can switch off push and email notifications for each company in the app and in the web application under “Notifications”, and all of the app’s notifications in the operating system settings. We delete the token when you sign out of the app, when Google reports it as invalid, when your account is deleted and at the latest when it has not been used for 270 days (the app registers it again each time it starts). We delete in-app notifications (bell) after 90 days.

11. Storage periods at a glance

• Server logs: 14 days
• Account data: until the account is deleted; check value of the email address thereafter 24 months
• Security log: 12 months; sign-ins in the browser: 6 hours of inactivity
• Push tokens: until you sign out of the app, at the latest after 270 days without use; in-app notifications: 90 days
• Company data and media: until deleted by the customer, at the latest 30 days after the end of the contract or 90 days after the end of a trial without a booked plan
• Playback statistics: raw data 90 days, daily figures until the company is deleted
• Screenshots: only the latest picture per screen, until the next picture or until the screen is deleted; replaced versions up to 30 days
• QR scans (time, screen, device type, daily check value; no IP address): 13 months, earlier upon deletion of the QR campaign or of the company
• Contact enquiries: 12 months after processing has been completed, open ones at the latest 24 months after receipt; content reports: 3 years after receipt
• Invoices and accounting records: 8 years (statutory retention)
• Database backups: 30 days; older versions of deleted or replaced media: up to 30 days

12. Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You may withdraw any consent you have given at any time with effect for the future (Art. 7(3)).

Right to object (Art. 21 GDPR): Where we process data on the basis of legitimate interests, you may object at any time on grounds relating to your particular situation. We will then no longer process the data unless we can demonstrate compelling legitimate grounds that override your interests, or the processing serves the establishment, exercise or defence of legal claims.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR), in particular with the authority responsible for our registered office: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (the Hessian Commissioner for Data Protection and Freedom of Information), Gustav-Stresemann-Ring 1, 65189 Wiesbaden. No automated decision-making, including profiling, takes place.

13. Changes

We will amend this policy if the service or the legal situation changes. The current version can always be found at modsi.de/datenschutz. Last updated: 20 October 2026.