Privacy

Privacy Policy

Version: October 2026. In case of discrepancies, the German version prevails.

1. Controller

Imagemedia GmbH, Gibelinstrasse 25, 4500 Solothurn, Switzerland
E-mail: info@imagemedia.ch · Phone: +41 32 665 72 55
Contact person for data protection: Philip Fiumi (reachable at the address above).
This policy applies to the website imagemedia.ch with all its subpages and language versions. The online shop at imagemedia.shop has its own privacy policy.

2. Principles

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where persons in the European Union or the EEA are concerned, the General Data Protection Regulation (GDPR). We only process data we need for the stated purpose, and only for as long as that purpose or a legal obligation requires. We do not sell personal data.
Where we rely on the GDPR, the legal bases are: your consent (Art. 6(1)(a)), the performance of a contract or pre-contractual steps at your request (b), legal obligations (c) or our legitimate interest in the secure, functioning and economical operation of our services (f). You may withdraw consent at any time with effect for the future.

3. Data generated when you visit the website

When a page is opened, our hosting provider necessarily processes the IP address of your device, date and time, the address requested, the amount of data transferred, browser and operating system and the page you came from. This data serves to deliver the page, operate it securely, troubleshoot and fend off attacks; we do not combine it with other data. In the event of unusual traffic, such as a very large number of requests in a short time, the hosting provider's firewall may show a brief check page first; the provider then processes the IP address and technical characteristics of the browser to tell people apart from automated programs.
We also limit the number of requests per IP address to our forms and interfaces to prevent abuse; for that purpose we store the IP address only as an encrypted check value (hash) from which it cannot be recovered, and delete it when the counting window ends, at the latest after 24 hours.
From the IP address, the hosting provider derives your approximate location (town). We use only the town name to show you the appropriate regional content and store it for twelve hours in a cookie. No movement or location profile is created. Our server fetches the weather for this locality from Open-Meteo; only the coordinates of the locality are transmitted, no information about you.
To monitor the website's loading times, the hosting provider records technical measurements of page rendering (Web Vitals) together with the page address, device type and approximate connection quality. This measurement sets no cookies, uses no user identifier and does not allow conclusions about individual persons.

4. Cookies and local storage

We set technically necessary cookies without consent, because the website does not work as intended without them: the chosen language, light or dark display, the last chosen area (Business or Home), the detected town for regional content and a session identifier for the protected editorial area, which only concerns logged-in staff. These cookies contain no personal data other than the town name and expire after twelve months at the latest.
Your decision in the cookie notice is not stored in a cookie but in your browser's local storage on your device; it is not transmitted to us. Via the "Cookies" link in the footer you can view, change or withdraw your choice at any time. You can also delete or block cookies and local storage in your browser; some functions may then no longer be available.

5. Statistics and marketing services

For Google Analytics and Google Ads conversion measurement we use Google's consent mode (Consent Mode). The Google tag therefore also loads without your consent, but it then sets no cookies and stores nothing on your device. It only sends signals without an identifier to Google, for example that a page was viewed or an enquiry was sent; your IP address is transmitted to Google for technical reasons. From these signals Google statistically estimates the number of visits and conversions. The legal basis is our legitimate interest in measuring the effect of our website and advertising (Art. 6(1)(f) GDPR). These services only set cookies once you agree in the cookie notice, separately for "Statistics" and "Marketing". All other services listed below are loaded only with your consent. The notice offers "Decline" on an equal footing with "Accept".
As of October 2026 we use Google Analytics 4 (statistics) and Google Ads conversion measurement (marketing). The other services listed below are prepared in our system but not switched on; if we switch one of them on, we will update this policy.
- Google Analytics 4 (statistics), Google Ireland Limited, Dublin, Ireland; data processing also in the USA. We run Analytics without sharing with Google advertising products unless you have consented to "Marketing".
- Google Ads conversion measurement (marketing), Google Ireland Limited: measures whether a click on an ad led to an enquiry.
- Meta Pixel (marketing), Meta Platforms Ireland Limited, Dublin, Ireland: reach and performance measurement of ads on Facebook and Instagram; data processing also in the USA.
- LinkedIn Insight Tag (marketing), LinkedIn Ireland Unlimited Company, Dublin, Ireland: performance measurement of ads on LinkedIn; data processing also in the USA.
- Microsoft Clarity (statistics), Microsoft Ireland Operations Limited, Dublin, Ireland: anonymised recording of usage flows to improve usability; data processing also in the USA.
- Hotjar (statistics), Hotjar Ltd., Malta: usage analysis to improve usability.
These services may set cookies and record your usage behaviour in pseudonymised form. For the nature and duration of processing, see the providers' privacy notices. You can additionally deactivate Google Analytics with the browser add-on at tools.google.com/dlpage/gaoptout.

6. Visitor statistics and click heatmap (only with "Statistics" consent)

In addition to the services named above, we run our own statistics on our server. They are only active if you have agreed to "Statistics" in the cookie notice, and they do not run in embedded views. For each page view we record the page opened, the language, the device group (computer, tablet or phone) and the domain of the page you came from, without its full address. If you click on the page, we store the position of the click as a share of the page width and height, the surrounding section and a short label for the element clicked, such as "Request a quote". We do not record mouse movements, entries in fields or screen recordings.
We do not store your IP address in the process. We derive a check value from it that changes daily and cannot be reversed; it only lets us recognise which clicks belong to the same visit. Click data is deleted automatically after 180 days, visit data after 365 days.
For visits from company networks we determine which organisation registered the address range the request comes from. To do so, our server queries the public directory of the responsible internet registry via the service rdap.org (for example RIPE NCC, Netherlands, or ARIN, USA), no more than once per address range and day, and performs a reverse DNS lookup; your IP address is transmitted to these bodies in the process. Only the result is stored: name, address and website of the registered organisation and its classification as a company, internet provider or hosting provider. These details as a rule concern companies, not persons; for sole proprietorships the name of a person may be included. For private connections only the internet provider appears. The purpose is to recognise which companies are interested in our services so that we can align our content accordingly. You can object to this processing by declining "Statistics" in the cookie notice or changing your choice there.

7. Embedded websites and apps

On the reference pages we show websites we have built for our clients, initially as images from our own server. For some projects you can load the real website in a frame with a click ("Use the live website"). Only with this click does your browser connect to the respective client's server; the client then receives your IP address and technical details about your browser and may set its own cookies. The privacy policy of the respective website applies.
Our free signage apps (Weather, News, Words) run on our own systems with the same hosting provider as this website (section 3). On larger screens the previews start by themselves; on a phone only after a tap. While a preview runs, your browser loads content directly from third parties: weather data from Open-Meteo, news images from the respective publishers (for example SRF, 20 Minuten, Nau), background videos from Mixkit and fonts from Google Fonts (Google Ireland Limited). These providers then receive your IP address and technical details about your browser. If you use an app on your own screen, the same applies to that screen.
On the reference pages we also show whether our clients' websites are reachable and how quickly they respond. This measurement is carried out by our server, not by your browser; no data about you is processed in the process.

8. Contact form, enquiries and appointment booking

When you reach us via the contact form, the tools on the website (such as enquiries about screens, media data, a marketing mandate or vehicle lettering) or the appointment booking, we store the details you provide (name, e-mail address, optionally phone and company, your request, for appointments the date and time) as well as the chosen language and the area the enquiry comes from. The purpose is to answer your enquiry, prepare and hold an appointment and process any resulting order. When booking an appointment you receive a confirmation by e-mail with a calendar file. Providing your details is voluntary; without the fields marked as required, however, we cannot process your enquiry.
For every enquiry we also store the IP address from which it was sent and, where available, origin details such as the referring page, the landing page or campaign parameters, so that we can trace abuse and assess the effect of our advertising. Against automated submissions we use a hidden form field and a limit on enquiries per IP address. If we switch it on, the Turnstile service of Cloudflare, Inc. (USA) additionally checks whether an entry comes from a human; the IP address and technical characteristics of the browser are transmitted to Cloudflare in the process. As of October 2026 this service is not switched on.
So that we can respond quickly, every new enquiry is delivered internally: by e-mail via our mail service (see section 12) and, where set up, as a message to our work channel on Slack (Slack Technologies, USA) and via WhatsApp Business (Meta Platforms Ireland Limited; data processing also in the USA). Name, contact details and the content of the enquiry are transmitted. These channels serve exclusively for internal forwarding to our team.
We keep enquiries for as long as processing is ongoing and follow-up questions are possible. Completed enquiries and those marked as spam are anonymised automatically 24 months after the last processing; details that led to an order are subject to the ten-year retention obligation under the Swiss Code of Obligations.

9. Review request and reviews on the website

After an enquiry has been completed, we may send you once by e-mail a short request for a Google review. The link in that e-mail passes through our website to Google; we record whether and when the link was clicked so that we do not ask more than once. We rely on our legitimate interest in improving our service and maintaining our reputation. You can object to this mailing at any time: a short message to info@imagemedia.ch is enough and we will remove you.
The customer testimonials shown on the website are public Google reviews that we copy manually with the name given there. No data flows to Google when they are displayed. If you no longer wish to see a review of your own here, let us know; we will remove it.

10. AI check and chat assistant

Chat assistant: on the website you can ask a digital assistant questions. It answers automatically, from the content of this website or, depending on the configuration, using an AI language model; its answers may contain mistakes and are not binding. Only if an AI language model is configured do we transmit your questions, the conversation so far, the chosen language and the page on which you use the chat to the AI provider, depending on the configuration Anthropic PBC (USA) or OpenAI, L.L.C. (USA). Under their terms for business customers, these providers do not use data submitted via the interface to train their models. As of October 2026 no AI language model is configured; the assistant answers solely from the content of this website. We store the conversation without IP address and without name in order to improve the assistant, and delete it automatically after 90 days. To limit misuse, we count questions per IP address only as an encrypted value (hash) and for no longer than one day. Your browser keeps the conversation for the lifetime of the tab in session storage. Please do not enter confidential or sensitive data in the chat. If you leave a message via the chat, section 8 applies to your name, contact details and message; the conversation is then linked to your enquiry. We rely on our legitimate interest in answering questions quickly and, where you leave a message, on pre-contractual measures taken at your request.
AI check: when you enter a website address, optionally a company name and your e-mail address in the "AI check" tool, our server retrieves the website indicated and examines it for technical characteristics. We store the details as an enquiry so that we can send you the result and advise you if you are interested. If AI providers are configured on our side, we additionally ask up to two of them (OpenAI, Anthropic, Perplexity or Google; data processing also in the USA) what they know about the website entered. Only the website address and the company name are transmitted, never your e-mail address.

11. Job applications

Application documents you send us by e-mail or via the contact form are processed exclusively for the respective selection procedure; they are accessible only to the people involved in it. After the procedure ends we delete the documents within six months at the latest, unless you consent to longer retention for future positions.

12. E-mail dispatch and file uploads

Confirmations, replies, appointment confirmations and review requests are sent via an e-mail service provider on our behalf: depending on configuration via Resend (Resend, Inc., USA) or via the SMTP server of our Swiss mail provider Kreativmedia. The provider receives your e-mail address and the content of the message for this purpose.
Files you upload to us (such as print data or images) are stored in our hosting provider's object store (Vercel Blob), which is accessible only to us, and deleted as soon as the order is completed.

13. Quotes and status pages for clients

On request we make quotes available to you via a personal link on our website. There we store the details contained in the quote: name, company, address, e-mail address, the services and prices offered and whether and when you accepted or declined the quote. The link contains a long random identifier and is accessible only to people who know it. As business records, quotes are subject to the ten-year retention obligation.
For screens we operate for our clients, we offer status pages. There we store the device name, location, the time of the last report and the IP address of the screen, not that of a person, in order to detect and report outages.

14. Hosting and processors

The website, the database and the object store are operated by specialised providers who process the data exclusively on our instructions and on the basis of a data processing agreement. The website hosting and the object store run with Vercel Inc. (USA) with delivery via a worldwide network; the application itself runs in Frankfurt am Main. The database with enquiries, quotes and statistics data is operated for us by Neon Inc. (USA) in Frankfurt am Main (Amazon Web Services, region eu-central-1). All connections are encrypted with TLS (recognisable by the "https://" in the address bar). The providers' server logs are deleted according to their rules, usually within a few weeks.

15. Disclosure abroad

Some of the providers named have their registered office or processing locations outside Switzerland and the EEA, in particular in the USA. For these transfers we rely on the Federal Council's adequacy decision on the Swiss-U.S. Data Privacy Framework, insofar as the provider is certified there, and otherwise on the European Commission's standard contractual clauses with the adaptations required for Switzerland. Despite these safeguards, a lower level of data protection may exist in third countries; for the services in sections 5 and 6 you decide yourself by giving consent, except for the cookieless signals sent to Google under section 5.

16. Retention and deletion

We keep personal data for as long as the respective purpose requires: technical logs a few weeks, the town name twelve hours, check values for limiting requests no longer than 24 hours, click data of our own statistics 180 days and visit data 365 days, conversations with the chat assistant 90 days, enquiries until completion and then no longer than 24 months, contract and accounting records including quotes ten years under the Code of Obligations. After that we delete or anonymise the data.

17. Your rights

You have the right to information about the data we process about you, to rectification of inaccurate data, to erasure, to restriction of processing, to receive your data in a common electronic format and to object to processing based on a legitimate interest. You may withdraw consent at any time.
We do not make decisions based solely on automated processing that produce legal effects for you or similarly significantly affect you (Art. 21 FADP, Art. 22 GDPR).
For requests, contact info@imagemedia.ch or write to the address in section 1. To verify your identity we may ask for proof; we usually respond within 30 days. You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, 3003 Bern), or in the EU with the supervisory authority responsible for you.

18. Data security

We protect your data with technical and organisational measures: encrypted transmission, access to enquiries only for logged-in staff with a personal account, restriction of access, regular security updates. Complete protection against access by third parties is nevertheless not possible on the internet; for confidential matters we recommend the phone or a personal meeting rather than unencrypted e-mail.

19. Changes to this policy

We adapt this policy when our data processing or the legal situation changes. The German version published on this page prevails.