Privacy policy

What personal data we process when you visit castitsignage.com, send us a form, or use the Castit app, why we do it, and what you can ask of us. In effect from 12 November 2026.

Future Forward-Portstream Software & Services B.V. is responsible for the personal data you send through the forms on this website (the data controller). Castit is a brand of GuideLites DOO in Niš, Serbia, which develops and runs the Castit platform. Who is responsible for the data in the Castit app is explained under The Castit app.

We process personal data under the EU General Data Protection Regulation (GDPR).

• Registered address: Stationsplein 45, unit A4.004, 3013 AK Rotterdam, the Netherlands
• Chamber of Commerce (KvK): 74519670
• VAT number: NL859933167B01
• Represented by: Dennis Groeneveld, Managing Director
• Email for privacy questions: info@guidelites.com

More about both companies is on the company details page.

GuideLites DOO, established in Serbia, does not offer the Castit service to people in the EU itself: organizations in the EU contract with Future Forward-Portstream, for which GuideLites DOO works as a sub-processor. GuideLites DOO has therefore not appointed a representative in the EU under Article 27 GDPR. You can send any privacy question to info@guidelites.com.

When you send a form

The contact form asks for your name, work email, company, country, the reason you are writing, and your message. The demo request form asks for your name, company, work email, phone number, number of screens, and the plan you are interested in. Company, country, phone, number of screens, and plan are optional.

Two of our ad landing pages have a form of their own. The partner price-sheet request (castitsignage.com/nl/lp/partners) asks what kind of business you have, how many screens or displays you install for customers each year, what you are interested in, and your name, company name, work email, and phone number; the phone number is optional. The Black Friday set-up request (castitsignage.com/en/special-offer) asks for your email address and, if you like, a note.

We use these details to answer you, to arrange and give a demo, to send you the partner price list and a demo account, to set up an offer you ask for, and to follow up on your request. Before you send the contact or demo request form, you tick a box to agree to this. We do not add you to a mailing list.

Your submission is stored in the site's content management system, which only signed-in Castit staff can open. Our sales team gets a message in Slack that a form came in, with a link to it. That message never contains your name, your email, or your phone number. For a demo request it names the plan you picked; for a partner price-sheet request it names your company, your type of business, and how many screens you install a year. A partner price-sheet request also goes to sales@guidelites.com by email, and a Black Friday set-up request to sales@castit.nl, each with everything you filled in. These emails are sent through Cloudflare Email Routing.

When you browse the site

To serve the pages, our hosting provider, Cloudflare, processes your IP address and the technical details your browser sends, such as its type and your preferred language. We keep no logs of these requests: no request logging is switched on for the site. Cloudflare processes the data only to serve and protect the site, as our processor.

At its home address the site opens in English. Dutch and Serbian have their own addresses, /nl and /sr; castit.nl and castit.rs lead there, and the language menu switches between them.

Forms are protected from spam by Cloudflare Turnstile, which checks that a person, not a bot, is sending them.

On our ad landing pages

Six pages are made for our ads and campaign emails: castitsignage.com/nl/lp/partners, /nl/lp/narrowcasting, /nl/lp/scherm, /sr/lp/chatgpt, /sr/lp/epapir, and /en/special-offer. Search engines don't list them. On these pages only, we count what visitors do, so we can see which ads work. We use PostHog, hosted in the EU, for this: that the page was opened and on what kind of screen, how far it was scrolled and which sections came into view, which buttons, questions, and tabs were clicked, the steps of the partner form (only the answers picked from its lists, never what you type), how long the page was in front of you, your choice in the cookie banner, and the campaign tags in the ad's link (utm_source, utm_medium, utm_campaign, and utm_content). With each event PostHog also receives what your browser tells any website: your IP address, your browser and device type, screen size, language, and the page you came from. This measurement sets no cookies and stores nothing in your browser: each visit gets a random ID that is gone when you leave the page. We never send PostHog your name, your email, what you type, the search term from the ad's link (utm_term), or an ad click ID, and we cut every web address down to the page itself. The PostHog script is loaded from jsDelivr, a public network for open-source code, which also sees your IP address. The measurement starts when the page opens, before you choose anything in the cookie banner, and it also runs if you allow only essential cookies. We do this on the basis of our legitimate interest in knowing which ads bring visitors and requests (Article 6(1)(f) GDPR). The measurement stores nothing in your browser and goes no further than described here; you can object to it at any time by writing to info@guidelites.com. Requests sent from /nl/lp/partners are for Future Forward-Portstream, which is responsible for them; GuideLites DOO receives them on its behalf at sales@guidelites.com.

If you switch marketing on in the cookie banner, an ad landing page that runs an OpenAI ad also loads the OpenAI ads pixel. It tells OpenAI about the visit, so OpenAI can match it to a click on its ad, and, when you send the page's form, that a request came in. We send it nothing from the form. Today that is the partner page, /nl/lp/partners. The cookie policy describes the pixel.

Cookies, analytics, and marketing

Apart from the measurement on the ad landing pages above, analytics and marketing tags run only if you agree to them in the cookie banner. The cookie policy lists every cookie and tag, and what each category does. You can change your choice at any time with Cookie settings at the bottom of every page.

This policy also covers the Castit app (app.castit.nl) and the Castit players.

Your account

When you create an account, we process your name, email address, and password (stored only in hashed form), your role and settings, and the details of the organization you sign up for. We use them to give you access, to help you when you need support, and to tell you about changes to the service. When you use the app, we log your sign-ins, your IP address, your browser and device, and what you do in the app, and we measure how the app is used. If you contact support, we keep your contact details and what you write to us.

Screens and players

A player sends us what we need to run and support it: its device identifier, its IP address, its status and uptime, and its logs and error reports. Players do not collect their location. The only location we keep is the address a user enters for a screen.

Content your organization manages

Your organization decides what its screens show, which apps it uses, and who gets an account. Content and apps can contain personal data, for example names and photos from your organization's Microsoft 365 or Google Workspace, room bookings, class information, or birthdays. Camera apps show a live picture only, which is not stored. Castit does not use facial recognition, audience measurement, or profiling of the people in front of a screen.

Who is responsible for app data

For that content, and for the data of its own people in the app, your organization is the controller. The data is processed on its behalf:

• For customers whose agreement is with Future Forward-Portstream Software & Services B.V., Future Forward-Portstream is the processor, and GuideLites DOO, which develops and runs the platform, is its sub-processor.
• For customers whose agreement is with GuideLites DOO, GuideLites DOO is the processor.

Which company your organization's agreement is with depends on where it is; see company details.

How that data is processed is set out in a data processing agreement. Customers receive it with their contract; it is not published on this site.

Where your data is hosted

Your data is hosted in the EU. app.castit.nl runs at Hetzner in Germany: the database, the files, the backups, and outgoing email. Amazon Web Services in Ireland is used only to convert videos and keeps nothing. The companies involved are listed under Who else handles your data.

• Your consent: the contact and demo request forms, and analytics and marketing cookies and tags, the OpenAI ads pixel on the ad landing pages included. You can withdraw it at any time. That does not affect what was done before.
• A contract with you or your organization, or steps you ask for before one: the Castit app and its accounts, and the partner price-sheet and Black Friday set-up requests on the ad landing pages.
• Our legitimate interest in running a secure site and in knowing which of our ads work: serving pages, keeping forms free of spam, essential cookies, and measuring visits to the ad landing pages without cookies.
• A legal obligation: for example, keeping invoices as tax law requires.

We share personal data only with companies that help us run the site and the service, under contracts that oblige them to protect it, or when the law requires it. We do not sell personal data.

This website

• Cloudflare: hosts this site and its database, runs the spam check on forms, and sends the email that brings sales a partner price-sheet or Black Friday set-up request (Email Routing).
• Slack, United States: tells our sales team that a form came in, as described above.
• PostHog, hosted in the EU: measures visits to the ad landing pages, without cookies, and, only if you allow analytics in the cookie banner, how the rest of the site is used.
• jsDelivr: delivers the PostHog script to the ad landing pages.
• Google: Google Tag Manager, which loads the analytics tags, only after you agree in the cookie banner.
• Ahrefs, Singapore: Ahrefs Web Analytics counts visits and pages viewed, without cookies, only if you allow analytics.
• OpenAI: the ads pixel on ad landing pages that run an OpenAI ad, only after you switch marketing on in the cookie banner.

The Castit app

GuideLites DOO, which runs the app, uses these companies:

• Hetzner Online GmbH, Germany: hosting, the database, file storage, backups, and outgoing email (SMTP)
• Amazon Web Services, Ireland: video conversion only. Converted files are removed from AWS once they are copied back to Hetzner.
• PostHog, hosted in the EU: usage analytics in the app
• Twilio SendGrid, United States: transactional email and email address checks
• Google, United States: push notifications (Firebase Cloud Messaging), screen addresses (Google Maps Platform), and translation of text written in the app (Gemini API, on Google's paid tier: Google acts as our processor and does not use the text to improve its products)
• SmartBear Bugsnag, United States: error monitoring for players
• Slack, United States: internal notifications to GuideLites staff, such as support requests
• ActiveCollab, United States and Canada, with a backup in France: internal task management, including tasks created from player logs
• Google Workspace (Google Ireland): email and documents used for support
• Future Forward DOO Niš, Serbia: software development, maintenance, and support

Transfers outside the EU

GuideLites DOO and Future Forward DOO Niš reach the app's data from Serbia, for support, maintenance, and operations. Several of the companies above are in the United States. These transfers are covered by the EU standard contractual clauses, and by the EU-U.S. Data Privacy Framework where the company is certified under it.

• Form submissions: up to two years after our last contact with you about the request, then deleted from the site's database and from the sales mailboxes.
• Visit measurements from the ad landing pages, in PostHog: up to 7 years (PostHog's retention period for our plan), then deleted automatically.
• App accounts and their content: as long as the account exists. Your organization decides what to keep or delete in the app. When the account is closed or the contract ends, its data is deleted within 45 days.
• Logs with IP addresses (sign-ins, activity in the app, and player logs): as long as the account exists. They are deleted with it, at the latest 45 days after it ends.
• Backups: made every day, kept only at Hetzner, and deleted after 14 days at the latest. Data that is deleted is gone from the backups within 14 days.
• Analytics and marketing cookies: as long as the cookie policy says for each.
• Invoices and contract records: as long as tax and accounting law requires.

You have the right to:

• know what data we hold about you, and get a copy of it
• have data that is wrong or out of date corrected
• have your data deleted
• have its use limited, or object to a use based on our legitimate interest
• get your data in a common format, or have it sent to another organization
• withdraw a consent you gave

Write to info@guidelites.com. We may ask you to confirm it is you before we act. You get an answer within 30 days.

You can also complain to the Commissioner for Information of Public Importance and Personal Data Protection of the Republic of Serbia (Poverenik), Bulevar kralja Aleksandra 15, 11000 Belgrade, office@poverenik.rs, +381 11 3408 900. If you live in the EU, you can also complain to the data protection authority in your country. In the Netherlands, that is the Autoriteit Persoonsgegevens.

The site is served only over an encrypted connection (HTTPS). Form submissions are kept in the site's own database, which only signed-in staff can open, and only the people who need the data for their work can reach it.

If you think your data is not safe with us, or you get an email in Castit's name asking for your password, tell us at info@guidelites.com. We never ask for your password by email.