Privacy Policy

Last updated: 26 October 2026

Who we are

The controller of your personal data is:

DynamicDigital sp. z o.o.
Al. Jerozolimskie 181B
02-222 Warszawa, Poland
KRS: 0000521993 · NIP: 5213678094 · EU VAT: PL5213678094

Email: info@myeasycms.com
Telephone: +48 509 937 137

We trade as easyCMS. If you have any question about this policy or about how we handle your data, write to us at the address above and a person will answer you.

We are not required to appoint a Data Protection Officer. Selling software and hardware is not “regular and systematic monitoring of data subjects on a large scale”, and we process no special-category data at scale, so none of the triggers in Article 37 GDPR applies. Polish law adds no further requirement for a private company. Data protection questions go to the address above.

Our two roles

For our own customers and visitors we are the controller. This policy covers that: the website, orders, your easyCMS account, support and our emails to you.

For what you put on your screens we are your processor. Your designs, media, menus, meeting bookings and anything else you upload to easyCMS belong to you, and you decide what personal data they contain, for example staff names on an agenda or the organiser of a meeting. We process that content only to run the service for you, under our Data Processing Agreement, which is part of our terms and applies to every customer automatically. If your screens show personal data, you are responsible for having a legal basis to show it.

What we collect, and why

We only collect data for specific purposes. This table is the complete picture.

Your shopping basket is stored in your own browser using local storage. It is not sent to us until you begin checkout.

Emails you always receive. Order confirmations, your account details, screen alerts you switched on, and notices about changes to the service or these terms are part of the service, not marketing, and do not need your consent.

We do not buy personal data from third parties and we do not sell your data to anyone.

Automated fraud screening. Stripe screens payments automatically for fraud, and a payment can be declined by that automated check. If a payment of yours is refused and you believe it was wrong, contact us, a person will look at it, you can explain your situation, and you can contest the outcome. Apart from this, we do not make decisions about you by purely automated means.

Studio features that use other services

Some Studio features send part of what you enter to another service, only when you use that feature:

• Import a menu sends the photos, PDF or text you upload to Google (Vertex AI, a Gemini model) to read the dishes and prices. Google processes it as our processor and does not use it to train its models. The request may be handled outside the European Economic Area. We keep only a daily count of imports per account, not the files.
• A screen’s location sends the town or postcode you type, or your device’s location if you tap “Use where I am now”, to the OpenStreetMap Foundation’s Nominatim service to find the place. Your browser asks your permission before sharing its location.
• Meeting rooms read the calendar links you add. We fetch those calendars on a schedule and store the bookings, including meeting titles and organisers, on your account so your door signs can show them. Remove a link and we stop fetching it.
• Find a logo sends the company name or website you type to Wikidata and Wikipedia from our server, never your IP address.

The “Ask easyCMS” AI assistant

Our knowledge base offers an optional AI assistant. You should understand what happens when you use it:

• The question you type, and any photo of your screen that you choose to attach, is sent to Google for processing by a Google Gemini model, through Firebase AI Logic.
• Google processes this to generate the answer and returns it to your browser.
• Using the assistant is entirely optional. If you would rather not send anything to Google, use the support guides directly or contact us instead.
• Please do not type passwords, payment details, or other people’s personal data into the assistant. Photos of a screen can contain more than you intend, check before attaching one.
• We do not store your conversation. It is kept in your browser’s session storage so it survives moving between pages, and is gone when you close the tab. We keep no server-side record of what you asked.
• The one exception is if you choose to escalate. If you click through to the support form from the assistant, the conversation is attached to that support request and emailed to us, so we can see what you already tried. That copy then lives in our support mailbox and is kept as described under How long we keep it below.
• To keep the assistant from being abused, it is protected by Google reCAPTCHA Enterprise, which checks signals from your browser when the assistant starts.

Google acts as our processor for this feature. Details of Google’s handling are in the Firebase Data Processing Terms.

Where this is processed. Google’s documentation for Firebase AI Logic states that requests are handled by an available model anywhere in Google’s global pool, and that a processing location cannot be specified. We therefore cannot guarantee that what you send to the assistant stays inside the European Economic Area. This is the main reason we ask you not to put personal or confidential information into it.

Is your question used to train Google’s models? No. Because we are established in the European Economic Area, Google applies its paid-service terms to our use, and those terms state that inputs are not used to improve Google’s models.

Google’s two roles. Google acts as our processor for the question and answer themselves. For technical service data generated in the process, including your IP address, usage counts and safety-filter events, Google acts as an independent controller under its own terms.

Who we contract with. Our contracting entity for Google Cloud and Firebase services, including the assistant, is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Ireland uses Google LLC in the United States as a sub-processor for the model itself, which is the transfer described above.

Who we share data with

Our processors. These providers process data only on our instructions, under a data processing agreement:

Independent controllers. These organisations receive data from us but decide themselves how to handle it, under their own privacy policies:

We also disclose data where the law requires it, for example to tax authorities, or in response to a lawful order.

We do not use a CRM. Customer accounts and media live on the easyCMS platform we run ourselves; we do not pass that data to another signage vendor.

Where your data is processed

• Our API (checkout, contact form, support requests, order emails, screen alerts) runs on Google Cloud in the europe-west1 (Belgium) region, and stores alert choices there.
• This website is served by Firebase Hosting from Google’s global content delivery network, so the pages themselves are cached on servers worldwide. That cache holds only public page content, never personal data, though the serving edge node records standard request logs including your IP address.
• The easyCMS platform at app.myeasycms.com, where your account and media live, is hosted by us on Hetzner infrastructure in Germany. The older V3 platform runs on DigitalOcean servers in Amsterdam.
• The AI assistant and menu import may be processed outside the EEA, as explained above. Everything else in this list is processed in the EU, apart from the provider transfers described next.

Some of our providers are based in the United States or may process data there. Where data goes outside the European Economic Area we rely on the European Commission’s Standard Contractual Clauses, and where the provider also holds it, certification under the EU–US Data Privacy Framework. The OpenStreetMap Foundation is in the United Kingdom, which the European Commission recognises as providing adequate protection. You may request a copy of the safeguards we rely on by emailing us.

How long we keep it

When data is no longer needed for the purpose it was collected for, we delete it or irreversibly anonymise it.

Your rights

Under the GDPR you have the right to:

• Access the personal data we hold about you, and receive a copy
• Rectify data that is inaccurate or incomplete
• Erase your data (“right to be forgotten”), where we have no overriding reason to keep it
• Restrict how we process your data while a concern is investigated
• Data portability: receive data you gave us in a structured, machine-readable format, and have it sent to another controller
• Object to processing based on our legitimate interests
• Withdraw consent at any time, where we rely on consent, this does not affect processing carried out before you withdrew it

To exercise any of these, email info@myeasycms.com. We will respond within one month. We do not charge for this, and we may ask you to confirm your identity first so we do not disclose your data to someone else.

If your request is about content one of our customers shows on their screens, we pass it to that customer, who decides, and help them answer it.

You can change your cookie choice at any time with Cookie settings at the bottom of every page, see the Cookie Policy.

Your right to object

This right is set out separately because the law requires it to be.

You have the right to object at any time, on grounds relating to your particular situation, to our processing of your data where we rely on legitimate interests. If you object, we must stop unless we can show compelling legitimate grounds that override your interests, or we need the data to establish, exercise or defend legal claims.

Where we process your data for direct marketing, you may object at any time and we must stop immediately. No reason is needed and no balancing applies.

To object, email info@myeasycms.com.

Complaints

If you believe we have handled your data unlawfully, please tell us first so we can put it right. You also have the right to complain to the Polish supervisory authority:

Prezes Urzędu Ochrony Danych Osobowych (UODO)
ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland
Telephone: 22 531 03 00 · Email: kancelaria@uodo.gov.pl
uodo.gov.pl

If you live in another EU country, you may complain to your own national data protection authority instead.

Is providing data required?

Where you buy from us, providing your name, email and billing address is a contractual requirement, we cannot deliver a licence, issue a valid invoice or ship hardware without it. Everything else, including analytics, product news and the AI assistant, is entirely optional.

Security

We take reasonable technical and organisational measures to protect your data, including encryption in transit (HTTPS across the whole site), restricted access to customer records, and payment handling delegated to Stripe so that card details never reach our systems.

In practice this means:

• Two-factor authentication is required on the administrator accounts that can reach customer data.
• Access is limited to the people who need it to run the service, and payment card details never reach our systems at all: Stripe handles them directly.
• Encryption in transit on every connection to this site, our API and the easyCMS platform.
• Regular backups of the easyCMS platform, held within the European Union and restricted to the same administrators.

Changes to this policy

If we change this policy we will update the date at the top. Where a change materially affects your rights, we will tell you directly.