LEGAL
Privacy Policy
How LiveSign handles personal data, in the two different roles it holds: as the controller of its own business records, and as a processor of whatever a customer puts into the CMS.
Version 1.1Effective 9 September 2026
On this page
Who we are
LiveSign supplies digital signage software: the Live content management system, the six Live player applications, and the hardware and services around them. This policy explains what we do with personal data, and it applies to this website and to the Live service.
For questions about this policy, about the data we hold, or to exercise any of the rights set out below, write to info@livesign.uk. A person reads that inbox during our published support hours, 8:00 to 18:00 GMT/BST, Monday to Friday, excluding English public holidays.
The two roles we hold, and why the difference matters
Almost every question about signage and personal data has a different answer depending on whose data is being asked about. There are two cases and they are governed differently.
- We are the controller
- For the records we create and keep in order to run our business: website enquiries, trial requests, account and login records, billing records, and support correspondence. We decide what is collected and why, and everything in this policy applies to it directly.
- We are the processor
- For the content a customer loads into the CMS and publishes to their screens: media, layouts, schedules, campaign data, and any personal data those happen to contain, for example a staff photograph on a welcome board or a name on a meeting-room display. The customer decides what goes in and why. We act on their instructions, under the data-processing terms in the agreement between us, and we do not use their content for any purpose of our own.
If your personal data appears on a screen running Live and you want it removed, the organisation operating that screen is the one who can remove it. Contact them first. If you cannot identify them, write to us and we will pass the request to the customer responsible for that display.
SELF-HOSTED DEPLOYMENTS
A self-hosted deployment sits outside our systems entirely. Where a customer runs Live on their own infrastructure, their CMS, their media and their user records sit inside their environment and never reach ours. In that case we hold only the commercial relationship: the account, the licence and the billing records described below. Nothing else about their deployment is visible to us.
What we collect, why, and on what legal basis
We collect the minimum each purpose needs. Where a lawful basis below is legitimate interests, the interest is running and securing a business service that customers have asked for, and we have weighed it against the effect on the individual.
| What | Where it comes from | Why | Lawful basis | How long we keep it |
|---|---|---|---|---|
| Enquiry details: name, email address, company, and the message you write | The contact, sales and trial forms on this site | To answer you, and to quote for what you asked about | Steps taken at your request before entering a contract, and our legitimate interests in responding to enquiries | 24 months from your last contact with us |
| Account records: user name, email address, organisation, CMS username, role and permissions, sign-in timestamps | You, when an account or trial is set up | To give you the service, control who can reach what, and keep the account secure | Performance of our contract with you or your employer | For the life of the account, then 12 months |
| Billing records: billing contact, billing address, VAT details, purchase orders, invoices and payment history | You, and our payment and accounting systems | To invoice, to collect payment, and to keep the statutory accounting records | Performance of our contract, and our legal obligations under UK company and tax law | 6 years from the end of the financial year the record relates to |
| Support correspondence: what you asked, what we did, and any diagnostic detail you send us | You, through the Help Desk or by email | To resolve the request and to see repeat faults across a deployment | Performance of our contract, and our legitimate interests in improving the product | 24 months from the close of the request |
| Technical logs: IP address, browser or player user agent, request timestamps, error traces | Our web and CMS servers, automatically | Security, abuse prevention, and diagnosing faults | Our legitimate interests in keeping the service available and secure | 12 months |
| Player and display records: device identifier, player version, licence status, connection and playback status | The Live players connecting to the CMS | To license, monitor and support the displays in an account | Performance of our contract with the customer operating those displays | For the life of the account, then 12 months |
| Customer content: media, layouts, schedules and anything else a customer loads into the CMS | The customer | To store, schedule and deliver it to the customer’s own screens, and nothing else | Processed on the customer’s instructions. They are the controller of it, not us | For as long as the customer keeps it in the CMS, then per their instruction |
We do not buy personal data from anyone, we do not sell it to anyone, and we do not use it to build profiles or to make automated decisions that have a legal or similarly significant effect on you.
Where the data is held, and international transfers
Live is offered as a cloud-hosted service and as a self-hosted deployment, and where the data physically sits depends on which one you buy.
- Self-hosted. On your infrastructure, in whichever country you run it. None of it reaches us.
- Cloud-hosted. In the hosting region agreed for your account. Regions differ by customer and by deployment, so the region that applies to you is confirmed at contract and stated in your order documentation. If a specific region or country is a requirement, raise it before you sign rather than after.
Where personal data is transferred outside the United Kingdom, we rely on an adequacy decision where one covers the destination, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with a transfer risk assessment. You can ask us which mechanism applies to your account.
How it is protected
The measures below are the ones that apply to the service as sold. They are described in more detail, in plain terms, on our security and data handling page.
- Access to the CMS is per user, with permissions scoped to the features and the display groups each person needs, so a site or department login cannot reach the rest of the network.
- SAML single sign-on is available on the Business plan and above, so signage access follows your own joiner and leaver process rather than a separate password list.
- Players connect outbound to the CMS over HTTP or HTTPS on TCP/80, TCP/443 and TCP/9505, and hold no inbound listening service of their own.
- Access to production systems by our staff is limited to the people who need it to support and operate the service.
- Self-hosting is available for organisations that require the CMS and its content to remain inside their own controlled environment, and an On-Premise Licensing Module supports networks with no internet access at all.
No system is beyond compromise. If a personal data breach occurs that is likely to result in a risk to people’s rights and freedoms, we will report it to the Information Commissioner’s Office within 72 hours of becoming aware of it, and tell affected customers without undue delay.
How long we keep things
The periods in the table above are the working rule. We keep personal data for as long as it is needed for the purpose it was collected for, plus any period we are required to keep it by law, and then delete it or anonymise it.
Two exceptions are worth stating plainly. Billing and accounting records are kept for six years because UK company and tax law requires it, whatever else you ask us to delete. And where a dispute or a legal claim is live, the records relevant to it are kept until it is resolved.
Your rights
Under UK data protection law you have the following rights over personal data we hold about you as a controller. They are free to exercise.
- Access. A copy of the personal data we hold about you, and an explanation of what we do with it.
- Rectification. Correction of anything inaccurate, and completion of anything incomplete.
- Erasure. Deletion, where we no longer have a good reason to keep it.
- Restriction. A pause on our use of it while an accuracy or objection question is resolved.
- Portability. The data you gave us, in a structured, commonly used, machine-readable form, sent to you or to another provider.
- Objection. To processing we carry out on the basis of legitimate interests, including any direct marketing, which we stop on request without argument.
- Withdrawal of consent. Where we relied on consent, at any time, without affecting what was lawful before you withdrew it.
To exercise any of these, write to info@livesign.uk. We will respond within one month, and will tell you if the request is complex enough to need longer, which the law allows up to a further two months. We may ask you to confirm your identity before we release data about you.
Where the personal data sits in a customer’s CMS rather than in our own records, we are the processor and cannot act on it unilaterally. We will pass your request to that customer and support them in answering it.
If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Children
Live is a business product, sold to organisations and operated by their staff. It is not directed at children and we do not knowingly collect personal data from them.
Schools and colleges do run Live on corridor and hall displays. In those deployments the school is the controller of anything published, including any pupil names or photographs it chooses to show, and its own policies and consents govern that content. We process it on the school’s instructions and for no other purpose.
Changes to this policy
The version number and effective date at the top of this page tell you which text you are reading. When we change something of substance we bump the version and, where the change affects customers, tell the account contact by email before it takes effect.
QUESTIONS ABOUT THIS DOCUMENT
A person answers these, not a form. Write to info@livesign.uk for anything on this page, or sales@livesign.uk if it concerns a purchase you are considering.
Help Desk hours are 8:00 to 18:00 GMT/BST, Monday to Friday, excluding English public holidays.
LEGAL
Terms of Service
The commercial terms: what a subscription and a perpetual licence each give you, fees and renewal, hardware, liability and governing law.
This is version 1.1 of this document, effective 9 September 2026.