Last updated: August 2026
This policy explains what personal data we process on bimi.tv, for what purpose, on what legal basis, who we share it with and how long we keep it.
We are not required to appoint a Data Protection Officer. Privacy enquiries are handled at the address above.
BIMI.TV is a platform businesses use to publish their own video. Depending on the processing, we sit in a different position, and that changes who you should approach:
If you are a viewer of a video embedded on someone else's website and want to exercise your rights, approach the operator of that website. If you write to us, we will pass your request on to the relevant client.
Username, display name, preferred language and a cryptographic hash of the password. We do not store passwords in clear text and cannot recover them.
When you sign in we record the IP address, browser user agent, device type and a session token, together with a device identifier that lets us recognise already-known machines and detect anomalous access. Where IP geolocation is enabled, we look up the approximate location (country and region) and the access provider associated with the IP.
When someone plays an embedded video we collect playback events: event type (load, play, completion), the URL of the page hosting the player, the IP address, the user agent, screen resolution, browser language and device type. These are used to build aggregated statistics for the client publishing the video. We do not build advertising profiles and we do not identify individual viewers by name.
Company name, country, address, postcode, VAT number, IBAN and SWIFT code, where the client provides them. Used solely for invoicing and to meet accounting and tax obligations.
Videos and their metadata may contain third parties' personal data, such as people appearing in or mentioned in a recording. For that content we act as a processor: we host and process it on behalf of the client, who is responsible for having an appropriate legal basis.
We process data for the following purposes:
We use functional cookies only, and the embedded player uses local storage for technical purposes. We use no first-party advertising cookies, no tracking pixels and no third-party analytics. Full detail, with names, purposes and lifetimes, is in the Cookie Policy.
We do not sell personal data and do not share it for commercial purposes. The following providers act as processors or as independent controllers:
We may also disclose data to courts, law enforcement or public authorities where we are under a legal obligation to do so.
The core infrastructure is in the European Union. Some of the providers above may process data outside the European Economic Area; where they do, the transfer relies on a European Commission adequacy decision or on Standard Contractual Clauses, together with any additional measures required. You can ask us about the safeguards in place by writing to [email protected].
If you are a viewer, you did not give us your data directly: we receive it from your browser when the player loads on our client's website. The categories involved are those described in section 3.3, they come from that interaction, and they are processed on behalf of the website operator. The same applies to personal data that may appear in content a client uploads.
We keep data for the following periods:
Under the GDPR you may exercise the following rights:
Exercise them by writing to [email protected], stating which right you wish to exercise. We respond within one month. If you believe we have not handled your request properly, you may complain to the Spanish Data Protection Agency.
We apply technical and organisational measures appropriate to the risk, including: bcrypt password hashing, HTTPS encryption on all communications, cookies carrying the HttpOnly, Secure and SameSite=Strict attributes, CSRF protection, Content Security Policy headers, rate limiting on authentication endpoints, and per-company and per-channel permission controls. No system is infallible: should a breach occur that poses a risk to your rights, we would notify it in accordance with arts. 33 and 34 GDPR.
The platform is aimed at businesses and professionals. We do not create accounts for minors and do not knowingly collect their data. If we find that a minor's data has been processed without a legal basis, we will delete it.
We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you, and we do not profile you for that purpose.
We may update this policy to reflect changes in the service or in applicable law. The current version will be published on this page with its date. Where a change is substantial, we will tell clients through the usual channels.
