# Privacy basics for digital signage

> Screens show things to everyone in the room. That makes them a privacy question as much as a design one: what you put on them, what's built into them and who can change them. A plain-language starting point under Türkiye's KVKK.

Blog · https://jonza.app/en/blog/digital-signage-privacy-basics · [TR](https://jonza.app/tr/blog/digital-signage-kvkk.md)

Published: 2026-10-21

> This is general information to help you ask the right questions, not legal advice. For decisions about your own business, talk to your legal adviser.

## Why screens are a privacy question

Most digital signage shows menus, prices, campaigns and announcements, none of which is personal. But screens creep towards people over time: a queue screen with patients' names, a welcome board with a visitor's name, a lobby slideshow of staff birthdays, a camera that counts who looks at an ad.

In Türkiye, personal data is governed by the Law on the Protection of Personal Data, No. 6698, known as the KVKK. If you serve people in the European Union, the GDPR may apply as well. Both start from the same idea: process only the personal data you need, for a clear purpose, and tell people about it.

## Keep personal data off the screen by default

A screen is the most public place your data can end up. Anyone in the room can read it, and anyone with a phone can photograph it. So the simplest rule is: if a screen doesn't need a person's details to do its job, leave them off.

- Queue screens can call a ticket number or a room instead of a full name.
- Welcome boards can greet a company or a group rather than a named visitor, unless the visitor agreed.
- Order screens in cafés can show an order number, not the customer's name and phone.
- Nothing about health, beliefs or similar sensitive matters belongs on a shared screen. The KVKK treats health and biometric data, among others, as special categories (Article 6), with stricter rules.

Clinics and pharmacies should be especially careful: a name in a waiting room can reveal that someone is a patient, which is itself sensitive.

## Staff photos and names

"Employee of the month", a team wall in the lobby, birthdays on the office screen: these are friendly ideas, and they're also personal data. Before any of them goes up:

- Ask the person, and keep a note that they agreed.
- Make it easy to say no, and easy to be taken off later.
- Show only what's needed: a first name and a photo is often enough; a birth date with the year is not.
- Take content down when someone leaves. A schedule with an end date stops forgotten slides from staying up for months.

## Cameras and sensors on screens

Some signage products offer cameras or sensors that count viewers, estimate age or gender, or measure how long people look. This is where privacy duties grow quickly.

Under Article 10 of the KVKK, whoever collects personal data must inform the people concerned of who is collecting it, for what purpose, to whom it may be transferred, how and on what legal basis it's collected, and what rights they have. That duty is often called the aydınlatma yükümlülüğü. A camera hidden in a screen frame makes that hard to meet in practice.

- Ask whether you need it at all. Most businesses can judge a campaign by sales instead of faces.
- If you do use one, find out exactly what it records, whether images leave the device and how long anything is kept.
- Facial analysis can involve biometric data, a special category under the KVKK. Get legal advice before switching anything like that on.
- Tell people clearly, at the entrance and next to the screen, before they're recorded.

Jonza doesn't use cameras or audience sensors; the screens play the content you plan, and that's all.

## QR codes that lead to forms

A QR code on a screen is a handy way to send people to a menu, a survey or a sign-up page. The code itself collects nothing, but the page it opens might.

- If the page asks for a name, phone or email, it needs its own privacy notice, reachable from the page.
- Ask for the minimum: an email for a newsletter, not a birth date and address.
- Don't tick marketing consent boxes for people; let them choose.
- Print a short web address under the code, so people can see where they're going before they scan.

## Who can change what's on the screen

Privacy is also about access. If a former employee can still sign in and put something on every screen, that's a problem for your customers and your brand.

- Give each person their own login, and remove people when they leave.
- Turn on two-step verification for the account that manages your screens.
- Keep the screens' own settings out of reach, so nobody can plug in a stick and show their own files.

Article 12 of the KVKK asks data controllers to take the technical and administrative measures needed to prevent unlawful processing of and access to personal data. Sensible access control is a large part of that.

## Your signage vendor and your data

When a software provider processes personal data on your behalf, such as your team's logins, the KVKK calls them a data processor (veri işleyen). Article 12 makes you jointly responsible with them for the security measures, so it's worth asking a few questions before you choose one:

- What personal data does the platform process, and why? Look for a clear privacy policy.
- Which service providers does it rely on, and where?
- Can every user have their own login with two-step verification?
- Can you see and end sessions, and remove users yourself?
- Who do you contact with a data question, and how quickly do they answer?

Jonza's privacy policy, linked at the bottom of every page, explains what the platform processes, why, and who it's shared with.

## The takeaway

Most signage never needs personal data at all, and that's the safest place to be. Keep names and faces off shared screens unless there's a real reason and the person knows, think twice before adding cameras, check what your QR codes lead to, and control who can change what's shown.

Jonza keeps the screen side simple: content you plan, on the screens you choose, with personal logins and two-step verification for the people who manage it. If you have questions about how that fits your business, write to us.

## Questions

### Can I show customers' names on a queue screen?

Think about whether you need to. A ticket or order number does the same job without putting a name in front of everyone. If names are needed, ask your legal adviser how to inform people and on what basis.

### Do I need consent to show staff photos?

It's good practice to ask, keep a note of the answer and take photos down when someone leaves or changes their mind. Your legal adviser can tell you what your situation requires.

### Does the KVKK apply to a small café?

The KVKK applies to anyone who processes personal data, whatever their size, though some obligations depend on the kind of business. The safest approach for screens is not to show personal data at all.

### Does Jonza use cameras to measure viewers?

No. Jonza plays the content you plan on your screens; it doesn't record or analyse the people in front of them.

## Read next

- [Device Management](https://jonza.app/en/features/device-management.md): Live status for every screen, tags for branches and floors, and remote settings without a site visit.
- [Municipalities](https://jonza.app/en/solutions/municipalities.md): Events, service notices and urgent messages on every public screen, from one account.
- [Offices & Lobbies](https://jonza.app/en/solutions/offices-lobbies.md): Visitor welcomes, meeting lists and company announcements on lobby and office screens.

---

Jonza is a digital signage platform by Erpa Teknoloji. Contact: info@jonza.app