Privacy Policy
Last updated: 1 October 2026 | NowBoard is a trading name of Vindico Labs Ltd, a company registered in England and Wales.
This policy explains how NowBoard collects, uses, and protects personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who we are
NowBoard is a digital signage platform. NowBoard is a trading name of Vindico Labs Ltd ("we", "us", "our"), a company registered in England and Wales. Our full company details are available at /contact. We are the data controller for personal data processed through the NowBoard website and platform.
Privacy contact: for privacy questions or to exercise any of your data rights (access, correction, erasure, portability, objection), email privacy@nowboard.tv. We respond to data requests within one month.
2. What information we collect
Information you provide directly
- Account registration: name, email address, organisation name, password (stored as a hash)
- Billing: billing name, address, and payment method (handled by our payment processor, we do not store full card details)
- Hardware orders: if you order a NowBoard Player or Player Pro, the delivery name, address and phone number you enter at checkout, and the order details
- Contact forms and enquiries: name, email address, message content
- Support requests: any information you include in support correspondence
- In-app feedback: if you use the feedback button inside the NowBoard dashboard, this sends your name, email address, the page you were on, and whatever you choose to include in your message to Userback, our feedback tool provider (see section 5).
Information collected automatically
- Usage analytics: pages visited, time on site, referring URL, browser type, and approximate location (country/city level). We use Plausible Analytics and Ahrefs Web Analytics. Neither uses cookies or tracks individuals across sites, and both run only after you accept in the cookie banner.
- Server logs: IP address, request timestamps, HTTP status codes. Retained for up to 30 days for security and debugging purposes.
- Session data: a single session cookie is set when you log in to the NowBoard dashboard. It contains no personal identifiers and expires when you close your browser.
3. Legal basis for processing
| Processing activity | Legal basis |
|---|---|
| Creating and managing your account | Contract (Article 6(1)(b) UK GDPR) |
| Processing payments and billing | Contract (Article 6(1)(b) UK GDPR) |
| Responding to enquiries and support requests | Legitimate interests (Article 6(1)(f) UK GDPR) |
| Handling in-app feedback | Legitimate interests (Article 6(1)(f) UK GDPR) |
| Sending service-related communications (e.g. billing, account notices) | Contract (Article 6(1)(b) UK GDPR) |
| Sending marketing emails (where opted in) | Consent (Article 6(1)(a) UK GDPR) |
| Website analytics and performance monitoring | Legitimate interests (Article 6(1)(f) UK GDPR) |
| Security monitoring and fraud prevention | Legitimate interests (Article 6(1)(f) UK GDPR) |
| Compliance with legal obligations | Legal obligation (Article 6(1)(c) UK GDPR) |
4. How we use your information
We use the information we collect to:
- Provide, operate, and improve the NowBoard platform
- Process your subscription and manage billing
- Deliver hardware you order, and handle cancellations, returns and warranty claims
- Send you service-related communications (account confirmations, payment receipts, important notices)
- Respond to your enquiries and provide customer support
- Monitor and improve website performance
- Detect, investigate, and prevent fraudulent or unauthorised activity
- Comply with legal and regulatory obligations
We do not sell your personal data to third parties. We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
5. Who we share your data with
| Recipient | Purpose | Location |
|---|---|---|
| Stripe | Payment processing and billing | UK / EU (adequacy) |
| Delivery courier | Delivering hardware orders (delivery name, address and phone number only) | UK |
| DigitalOcean | Cloud hosting and infrastructure | UK / EU data centres |
| Plausible Analytics | Privacy-first website analytics | EU (Germany) |
| Ahrefs Web Analytics (Ahrefs Pte. Ltd.) | Website analytics and search performance | Singapore |
| Email service provider | Transactional and service emails | EU / UK |
| Userback | In-app feedback collection | Australia (Standard Contractual Clauses) |
We may also disclose your information where required by law, court order, or regulatory authority.
6. Cookies
We use a minimal number of cookies. Full details are in our Cookie Policy. In summary:
- We set one essential session cookie when you log in to the dashboard
- We do not set any advertising or tracking cookies
- Plausible Analytics (our analytics provider) does not use cookies at all
7. Data retention
| Data type | Retention period |
|---|---|
| Account data (active) | For the duration of your subscription |
| Account data (post-cancellation) | 90 days (then deleted), unless required for legal compliance |
| Billing records (including hardware orders) | 7 years (UK tax and accounting requirements) |
| Support correspondence | 3 years |
| Server access logs | 30 days |
| Marketing consent records | Until withdrawn + 3 years |
8. Your rights under UK GDPR
You have the following rights regarding your personal data:
- Right of access, request a copy of the personal data we hold about you
- Right to rectification, request correction of inaccurate or incomplete data
- Right to erasure: request deletion of your personal data, subject to legal retention requirements
- Right to restrict processing, request that we limit how we use your data in certain circumstances
- Right to data portability: receive your data in a structured, machine-readable format
- Right to object, object to processing based on legitimate interests
- Rights related to automated decision-making, we do not engage in automated decision-making that produces legal effects
- Right to withdraw consent: where processing is based on consent, you may withdraw it at any time
To exercise any of these rights, contact us at hello@nowboard.tv. We will respond within one month.
You also have the right to lodge a complaint with the Information Commissioner's Office (ICO): ico.org.uk.
9. International transfers
Where we transfer personal data outside the UK, we do so only to countries with an adequacy decision from the UK Secretary of State, or under appropriate safeguards (such as the UK International Data Transfer Agreement). Our primary hosting is within the UK and EU.
10. Security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include encrypted connections (TLS), secure password hashing, access controls, and regular security reviews. However, no method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
11. Children's privacy
NowBoard is not directed at children under the age of 16. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately at hello@nowboard.tv.
12. Changes to this policy
We may update this privacy policy from time to time. When we make material changes, we will notify account holders by email and update the "Last updated" date at the top of this page. Continued use of NowBoard after notification constitutes acceptance of the updated policy.
13. Contact us
For any questions, concerns, or requests relating to this privacy policy or your personal data, please contact us:
- Email: hello@nowboard.tv
- Contact form: /contact
- Post: Vindico Labs Ltd, Vindico Arena, Olympian Drive, Cardiff CF11 0JS (see our Contact page for full company details)