Privacy policy

This English version is provided for convenience; the German version is legally binding.

Last updated: October 2026

This privacy policy explains which personal data we process in the schildwerk.ch online shop, for what purposes, on what legal basis, and what rights you have. It follows the Swiss Federal Act on Data Protection (FADP) and, where applicable, the General Data Protection Regulation (GDPR).

1. Controller

Aimara AG
Via Palü Daint 15, 7537 Müstair, Switzerland
Email: info@schildwerk.ch

Contact us at this address for any data protection question and to exercise your rights.

2. What we process, why, and on what basis

Customer account: name, email address, optional company and phone number, password (stored encrypted only), your language setting and your addresses. We save the delivery and billing address of an order to your account, so the checkout is filled in next time; you can change or delete them at any time under Account, Addresses. Purpose: sign-in, order history, faster ordering, brand kits. Basis: contract (Art. 6(1)(b) GDPR).

Accounts and orders from our previous shop: we have taken over customer accounts and orders from our previous online shop on schildwerk.ch into this shop; the controller remains Aimara AG, and we use the data for the same purpose as before (your account and your order history).

Orders: delivery and billing address (with any phone number), ordered products, designs, prices, redeemed voucher codes, payment method and payment status. So that a voucher code only applies as often as intended (e.g. once per customer), we check your email address and earlier redemptions when you redeem it. Purpose: production, delivery, invoicing, warranty. Basis: contract (b) and statutory retention duties (c).

Designs, uploads and brand kits: texts, images, logos and fonts you upload or use in your designs, and print-ready PDFs (“Print your own PDF”), stored with page pictures and the check result. Purpose: preview, print files and reuse in your brand kit or when you order again. Every uploaded file is automatically checked for malware. Basis: contract (b) and our legitimate interest in secure systems (f).

Contact and quote requests: name, email, optional phone, company, job details, your message and any attachment. Purpose: answering the request and preparing a quote. To protect against spam, your IP address is counted briefly in memory but not stored. Basis: pre-contractual steps (b) and legitimate interest (f).

Emails: we send you emails about your orders, requests and account (e.g. order confirmation, password reset). We do not send marketing emails.

Technical data: when you open the website, our server processes technically necessary data such as IP address, date and time and the page requested. Purpose: operation and security of the website. Basis: legitimate interest (f).

Ad measurement with Google Ads: only with your consent (a), see section 4.

The details marked as required for an account or an order are needed for the contract; without them we cannot deliver. Everything else is voluntary. We do not make automated individual decisions and do not profile you.

3. Cookies and similar technologies

Cookies are small files your browser stores. We set technically necessary cookies without consent because the shop does not work without them. Everything else is set only once you agree. The link "Cookies" or "Cookie settings" at the bottom of every page shows you at any time what we use, and there you can change or withdraw a consent; the withdrawal applies from then on. You can also delete or block cookies in your browser.

We also keep the following in your browser's storage (local storage and session storage). These entries stay in your browser, are not sent to us and remain until you delete them in your browser:

• your unfinished draft in the design tool, so it is not lost on reload; it only reaches us when you save the sign or add it to your cart,
• the products you viewed last and the colours you used last, so you find them again quickly,
• whether you have already seen and closed a hint,
• only if you open our internal design preview through a special link: the colours, fonts and corners chosen there,
• only with consent to ad measurement: a note that an order has already been reported to Google, so it is not counted twice.

Cloudflare Turnstile (see section 6) runs in its own Cloudflare frame and sets no cookies on schildwerk.ch.

Statistics: to see which pages are read, we may count page views with Umami on our own server. Umami sets no cookies, stores no IP addresses and does not recognise you. If "Do Not Track" is on in your browser, we do not count you. Whether statistics are switched on is shown under "Cookies" or "Cookie settings".

We do not embed social media plugins. Links to Instagram open Instagram only when you click them.

4. Ad measurement with Google Ads

We advertise on Google. To see whether an ad leads to an order, we may use Google Ads conversion measurement, but only if you agree in the cookie banner or the cookie settings. Nothing from Google is loaded before that. While the measurement is not switched on, no cookie banner appears and no data goes to Google.

• Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and Google LLC, USA.
• Data: a cookie (_gcl_au) with an identifier of the ad click, technical data about your browser and device, your IP address and, for an order, the order number, amount and currency. We do not pass your name, email or address to Google.
• Purpose: measuring which ads lead to orders and allocating the ad budget accordingly. We do not use personalised advertising or remarketing.
• Basis: your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time under "Cookie settings".
• Abroad: Google may transfer data to the USA (see section 7).
• More in Google's privacy policy.

5. Hosting

The website, the shop and the database run on Aimara AG's own servers in Switzerland. For production we also keep uploaded files and print files on our internal storage, which cannot be reached from the internet. Data we pass to the service providers in section 6 is processed on their own systems. The fonts in the shop are also loaded from our servers, not from Google.

6. Disclosure to third parties

We only disclose personal data where necessary for the purposes above:

• Shipping: Swiss Post receives your name and delivery address.
• Payment: card payments and TWINT are handled by Stripe (Stripe Payments Europe Ltd., Ireland). Stripe receives the data needed for the payment; you enter your card details directly with Stripe, we never see them. If you pay with TWINT, Apple Pay or Google Pay, TWINT AG, Apple or Google also process the payment under their own privacy policies.
• Invoices and accounting: we create and book invoices in bexio (bexio AG, Rapperswil-Jona, Switzerland); the data reaches bexio through the aimara Hub, our own system for shipping and accounting on our servers in Switzerland. bexio receives your name, company, billing address, email address, the ordered items and the payment status.
• Email delivery: we send the shop's automatic emails (e.g. order confirmation, invoice, password reset) via Resend (Resend Inc., USA). Resend receives your email address and the content of the email, for the invoice also the PDF.
• Mailbox: our mailboxes (e.g. info@schildwerk.ch) and our personal email correspondence run on Google Workspace (Google Ireland Limited, Ireland, and Google LLC, USA). That is where your emails to us, your requests from the forms and our copies of the shop emails about your orders are kept.
• Bot protection: contact, quote and design requests, sign-up and "Forgot your password" are protected by Cloudflare Turnstile (Cloudflare Inc., USA), for which Cloudflare processes technical data about your browser and your IP address to tell bots from people.
• Ad measurement: Google, only with your consent (section 4).
• Authorities, where we are legally obliged to.

These service providers process the data on our behalf and according to our instructions, unless they are controllers themselves (e.g. Swiss Post for shipping). We do not sell data.

7. Transfers abroad

Stripe and Google (Google Workspace and, with consent, Google Ads) process data in Ireland (EU) and may transfer it to the USA; Resend and Cloudflare process data in the USA. Under Swiss law the EU provides adequate data protection. For the USA we rely on the providers' certification under the Swiss-U.S. or EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses.

8. Retention

• Order and accounting data: 10 years (statutory retention duty).
• Brand kits, saved designs, addresses and uploaded PDFs: until you delete them yourself in your account or ask us to delete them. If you delete an upload, the print file of signs already ordered stays with the order.
• Customer account: until you ask us by email to delete it.
• Print files of your orders: together with the order, so that reorders and complaints are possible; on request we delete them earlier.
• Requests: as long as we need them to handle the request and any quote or order.
• Server logs: a few weeks.
• Backups: deleted data may remain in our encrypted backups for up to 12 months, until they are overwritten automatically.
• Cookies and browser storage: see section 3.

9. Data security

We protect your data with technical and organisational measures, including encrypted transmission (HTTPS), encrypted passwords, non-public storage of print files and attachments, and malware checks on every upload.

10. Your rights

You have the right to:

• access the data we process about you,
• rectification of incorrect data,
• erasure of your data, in particular your account,
• restriction of processing,
• receive your data in a common electronic format (data portability),
• object to processing based on our legitimate interest,
• withdraw a consent at any time with effect for the future, for cookies directly under "Cookie settings".

Write to us at info@schildwerk.ch. We usually reply within 30 days. Statutory retention duties remain reserved: we delete order and accounting data only once they expire.

You may also lodge a complaint with a supervisory authority:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch

11. Changes

We update this privacy policy when our services or the law change. The version published here applies. If a service that needs consent is added, we will ask you again.