Contents
- Scope & platform description
- Definitions
- Roles & responsibilities
- Data protection principles
- Accessibility services — full disclosure
- Types of data collected
- Third-party applications & deeplinks
- Channel content & media player disclaimer
- Legal bases for processing
- Data processing purposes
- Smart Config — automated privacy protection
- Data storage & retention
- Data security
- Data sharing
- International data transfers
- Your rights
- Cookies & tracking
- Client responsibilities
- Privacy by design & default
- Changes to this policy
- Contact & data protection officer
01.Scope & platform description#
This Privacy Policy explains how Vaast ("We", "Our") collects, uses, discloses, processes, and protects the personal data of users ("You") in connection with the Vaast Hospitality Platform — an enterprise Hospitality TV application deployed on guest-facing smart TV devices in hotels, hospitals, and similar hospitality environments.
By accessing or using Vaast services, you acknowledge that you have read, understood, and agreed to the terms of this Policy. This document complies with the General Data Protection Regulation (GDPR) and applicable international data protection standards.
Vaast operates as an enterprise Hospitality TV platform that replaces the default home screen on smart TV devices in guest-facing environments. The technical scope of the platform includes:
- Home Screen Replacement: Vaast replaces the default Android launcher on devices using Accessibility Services (see Section 5 for full disclosure).
- Media Player: Vaast provides a media player interface for IPTV channels and streaming content, fully configured and managed by Clients.
- Deeplink Bookmarks: Vaast provides shortcut/bookmark functionality to launch third-party apps (e.g. YouTube, Netflix). Vaast does not control, manage, or process content within those apps.
- PMS Integration: Vaast integrates with hotel Property Management Systems (PMS) to receive check-in/check-out status for device management.
02.Definitions#
| Term | Definition |
|---|---|
| Personal Data | Any information that identifies or can identify an individual, directly or indirectly. |
| Processing | Any operation performed on data: collection, storage, use, transfer, deletion, etc. |
| Data Controller | The party that determines the purposes and means of data processing. |
| Data Processor | The party that processes data on behalf of the Controller. |
| Client | Hotel, hospital, or hospitality operator using the Vaast platform. |
| Guest / User | End-user individuals accessing services through Client-installed devices (e.g. hotel guests). |
| Smart Config | Vaast's proprietary automated device reset and data clearing feature triggered at guest checkout. |
| Accessibility Services | Android system permission used by Vaast solely for launcher replacement and session management. |
| Deeplink | URL or intent that directly opens a third-party application. |
| PMS | Property Management System — hotel guest management software. |
03.Roles & responsibilities#
Depending on context, Vaast acts in different legal capacities:
| Context | Vaast's Role | Client's Role |
|---|---|---|
| Hospitality TV Platform | Data Processor | Data Controller |
| Vaast Internal Systems | Data Controller | N/A |
| PMS Integration | Data Processor | Data Controller |
| Device Management | Data Processor | Data Controller |
As a Data Processor, Vaast processes data solely on behalf of and under Client instructions. As a Data Controller (for internal operations), Vaast independently determines processing purposes.
04.Data protection principles#
All data processing by Vaast is conducted in accordance with the following principles as mandated by GDPR Article 5:
- Lawfulness, Fairness & Transparency
- Purpose Limitation — data collected only for specified, explicit, and legitimate purposes.
- Data Minimisation — only adequate and relevant data is collected.
- Accuracy — reasonable steps are taken to ensure data is accurate and up-to-date.
- Storage Limitation — data is retained only for as long as necessary.
- Integrity & Confidentiality — appropriate security measures are applied.
- Accountability — Vaast is responsible and able to demonstrate compliance.
05.Accessibility services — full disclosure#
Vaast uses Android Accessibility Services solelyas a technical mechanism to replace the device's default home screen (launcher). This is required because Android does not provide a standard API for enterprise TV launcher replacement across all OEM configurations.
Vaast does NOT use Accessibility Services for:
- Reading, capturing, or recording content displayed in third-party apps
- Monitoring keystrokes, input, or user interactions within other apps
- Transmitting or logging screen content to any server
- Accessing personal accounts, credentials, or authentication data
- Tracking user behaviour within Netflix, YouTube, or other third-party apps
Permitted uses
- Detecting when a guest session starts or ends (check-in / check-out trigger)
- Ensuring the Vaast Home Screen remains the default interface on TV devices
- Triggering the Smart Config reset process at checkout
Clients (hotels/hospitals) are responsible for communicating this permission usage to guests as part of their guest notification obligations. Vaast provides documentation on request to support such notices.
06.Types of data collected#
Vaast only collects and processes the minimum data required to deliver platform functionality.
6.1 Identity data
- Guest name (received from PMS, managed by Client)
- Room number or device/user ID
6.2 Technical data
- TV device IP address
- Device ID and device type/model
- Operating system version
- System activity logs for diagnostics and debugging
6.3 Usage data
- Interaction history with the Vaast interface (e.g. menu navigation)
- Content preferences within the Vaast platform
- App launch events (deeplink opens — timestamp and target app only)
6.4 PMS integration data
- Check-in and check-out status (received from Client's PMS)
- Room assignment data
- Vaast does NOT collect or store third-party app login credentials (Netflix, YouTube, etc.)
- Vaast does NOT collect content watched or browsed within third-party apps
- Vaast does NOT read or store data from WebViews opened by third-party apps
- Vaast does NOT record audio, video, or screen content
- Vaast does NOT store biometric or sensitive personal data permanently
07.Third-party applications & deeplinks#
Vaast provides deeplink bookmark functionality to allow guests to quickly launch third-party apps such as YouTube, Netflix, and other OTT/streaming platforms configured by Clients.
| Aspect | Vaast | Third-Party App |
|---|---|---|
| Data collected at launch | Deeplink URL + timestamp only | All in-app activity data |
| Content displayed | Not controlled or monitored | Platform's own responsibility |
| Login credentials | Not accessed or stored | Handled by the platform |
| Privacy policy | This document | Each platform's own policy |
| Content responsibility | None | Platform's own responsibility |
Guests are advised to review the privacy policies of each third-party app they use. Vaast has no technical control over data processed by those platforms once the app is launched.
08.Channel content & media player disclaimer#
Vaast functions exclusively as technical media player infrastructure and content delivery interface. All channel content, IPTV streams, and media available through the Vaast platform are configured, managed, and controlled entirely by the Client (hotel/hospital operator).
Vaast is NOT responsible for:
- Legality, accuracy, or suitability of channel content
- Licensing compliance for broadcast or streaming content provided by Clients
- Copyright compliance for Client-configured channels
- Accuracy of information displayed via Client-configured channels
Clients are solely responsible for ensuring all content configured in the Vaast platform complies with applicable laws, broadcasting regulations, and content licensing requirements in their jurisdiction.
09.Legal bases for processing#
Data is processed on the following legal bases per GDPR Article 6:
| Legal Basis | Application |
|---|---|
| Contractual Necessity (Art. 6(1)(b)) | Processing required to deliver contracted Hospitality TV services to Clients. |
| Legitimate Interests (Art. 6(1)(f)) | Service improvement, security monitoring, performance diagnostics, and abuse prevention. |
| Legal Obligation (Art. 6(1)(c)) | Compliance with applicable laws, regulations, and lawful data requests. |
| Consent (Art. 6(1)(a)) | For optional features requiring explicit user consent (where applicable). |
You may withdraw consent at any time by contacting privacy@vaast.tv.
10.Data processing purposes#
Personal data is used exclusively for the following purposes:
- Providing and operating the Hospitality TV platform and related services
- Personalising the guest interface within the Vaast platform
- Running PMS integration to manage check-in/check-out workflows
- Operating the Smart Config automated device reset feature
- System monitoring, debugging, and performance optimisation
- Security management and abuse prevention
- Fulfilling contractual obligations to Clients
- Complying with legal and regulatory requirements
11.Smart Config — automated privacy protection#
Smart Config is Vaast's proprietary automated privacy and data protection feature, designed to ensure guest data is fully cleared at the end of each stay.
- Signs out of all active guest sessions on the device
- Clears all app caches, cookies, and session tokens
- Resets usage history and interaction logs
- Restores the device to its pre-check-in state
- Verifies reset completion and logs the operation for Client audit purposes
Smart Config is a core implementation of Privacy by Design and Data Minimisation principles as required by GDPR. Its operation is automatic and requires no manual action from Clients or guests.
12.Data storage & retention#
Vaast retains personal data only for the minimum duration required to fulfil the purpose of collection.
| Data Category | Retention Period |
|---|---|
| Guest session data | Deleted at checkout via Smart Config |
| System activity logs | Duration of Client contract or legal obligation |
| PMS integration data | Duration of active guest stay + 24 hours |
| Technical diagnostics data | Up to 90 days unless required for ongoing support |
| Contract-related data | Duration of contract + applicable legal retention period |
After the retention period expires, data will be permanently deleted or irreversibly anonymised to the applicable standard.
13.Data security#
Vaast implements technical and organisational security measures proportionate to the risk, including:
- Data encryption in transit using TLS/HTTPS where applicable
- Role-based access controls (RBAC) restricting data access to authorised personnel only
- Continuous system monitoring and anomaly detection
- Regular security reviews and vulnerability assessments
- Data processing agreements with all sub-processors
- Smart Config as a structural privacy-by-design protection
In the event of a personal data breach, Vaast will notify affected parties in accordance with applicable law and within the mandated timeframe. Details on our security practices are published on our Security page.
14.Data sharing#
Vaast does not sell personal data under any circumstances. Data is only shared in the following limited conditions:
14.1 Clients (hotels / hospitals)
As Data Controllers, Clients receive data required for their hospitality service operations, including guest session reports and device status updates.
14.2 Sub-processors
Vaast may engage trusted sub-processors (e.g. cloud infrastructure providers, server hosting, monitoring tools). All sub-processors:
- Are bound by GDPR-compliant Data Processing Agreements (DPAs)
- Are required to implement equivalent security standards
- Are prohibited from processing data outside the stated purposes
14.3 Legal authorities
Vaast may disclose data if required by applicable law, court order, or valid regulatory request. Vaast will inform Clients of such requests if legally permitted.
15.International data transfers#
If data is transferred outside the country of origin or outside the European Economic Area (EEA), Vaast ensures equivalent protection through:
- Standard Contractual Clauses (SCCs) as approved by the European Commission
- Adequacy decisions by applicable regulatory authorities (where available)
- Binding Corporate Rules or equivalent safeguards
Vaast will not transfer personal data to jurisdictions that do not provide adequate data protection without appropriate safeguards in place.
16.Your rights#
Under GDPR and applicable data protection laws, individuals have the following rights over their personal data:
| Right | Description |
|---|---|
| Right of Access | Request a copy of personal data held about you. |
| Right to Rectification | Request correction of inaccurate or incomplete data. |
| Right to Erasure | Request deletion of personal data ("right to be forgotten"). |
| Right to Restriction of Processing | Request restriction of how your data is processed. |
| Right to Data Portability | Receive data in a structured, machine-readable format. |
| Right to Object | Object to processing based on legitimate interests or for direct marketing. |
| Right to Withdraw Consent | Withdraw consent at any time where processing is based on consent. |
To exercise any right, contact privacy@vaast.tv. We will respond within 30 days. You also have the right to lodge a complaint with your local data protection authority.
18.Client responsibilities#
Clients act as Data Controllers in all guest-facing Vaast platform deployments. Clients are solely responsible for:
- Establishing a valid legal basis for guest data collection and processing
- Providing adequate privacy notices to guests at check-in or at the point of data collection
- Ensuring all content configured on the platform (channels, deeplinks, media) complies with applicable laws and licensing requirements
- Responding to guest data subject rights requests relating to their own data
- Ensuring Vaast deployments comply with local data protection regulations in their jurisdiction
- Notifying Vaast of suspected data breaches involving data processed by Vaast within 24 hours
Vaast provides Data Processing Agreement (DPA) templates and documentation on request to support Client compliance obligations.
19.Privacy by design & default#
Vaast applies Privacy by Design and Privacy by Default principles throughout the platform lifecycle:
- Data minimisation is embedded in the platform architecture — only essential data is collected
- Smart Config provides automatic post-stay data clearing as the default system behaviour
- Accessibility Services usage is constrained by code to only defined and documented functions
- Default system settings prioritise the most privacy-protective configuration
- Security and privacy reviews are conducted during the product development cycle
20.Changes to this policy#
Vaast reserves the right to update this Privacy Policy to reflect changes in legal requirements, platform features, or operational practices. Material changes will be communicated via:
- The official Vaast website: www.vaast.tv
- The Vaast Client Service Platform
- Direct notice to registered Clients if changes materially affect data processing
Continued use of the Vaast platform following notice of changes constitutes acceptance of the revised Policy.
21.Contact & data protection officer#
For privacy questions, data subject rights requests, or concerns about this Policy, please contact:
Vaast Data Protection Contact
- Company
- Vaast
- Website
- www.vaast.tv
- privacy@vaast.tv
- DPO Status
- Appointed as required by applicable law
You can also write to us at the address on our Contact page. We aim to respond to all privacy enquiries within 5 working days.