There is increasing interest in using digital signage to deliver highly personalised content. However, display personalization presents a number of architectural design challenges in particular, how best to provide personalisation without unduly compromising viewers' privacy. While previous research has focused on understanding specific elements of the overall vision, our work presents details of the first significant attempt at a system that integrates future pervasive display networks and mobile devices to support display personalisation. We describe a series of usage models and design goals for display personalisation and then present Tacita, a system that supports these models and goals. Our architecture includes mobile, display and cloud-based elements and provides comprehensive personalisation features while preventing the creation of user profiles within the display infrastructure, thus helping to preserve users' privacy. An initial evaluation of our prototype implementation of the architecture is also included and demonstrates the viability of the Tacita approach.