Privacy
No personal data at the screens. The regiowerber screens have no camera and no facial recognition. They only count anonymously whether someone moved in front of them and whether the screen was touched or its QR code was opened, each as a plain count with no reference to a person. The details are below under “Data from the screens”.
Controller
Quartiero GmbH
Bernstrasse 27b
3122 Kehrsatz
Switzerland
Quartiero GmbH (the "operator") is the controller for the processing of your personal data on regiowerber.ch and in the advertiser portal. K-I-Soft IT&Holding GmbH, Bernstrasse 27b, 3122 Kehrsatz, develops and runs the technical platform on its behalf as a processor. The Swiss Data Protection Act (revDSG) applies. Please direct privacy questions to info@regiowerber.ch.
Territorial scope
regiowerber is aimed at companies and self-employed people in Switzerland. Use from the European Union is not excluded. Where the European General Data Protection Regulation (GDPR) applies in an individual case, the rights it provides apply in addition to those under the revDSG.
Visiting the website
When regiowerber.ch is called up, technical connection data arises, such as IP address, time, page requested and browser type. These access logs serve to secure operation and to find errors. They are kept in Zurich for 180 days, and the operator analyses them itself without cookies.
The website uses only technically necessary cookies and comparable storage, needed for sign-in and for the session. There are no analytics services, no tracking and no advertising cookies on regiowerber.ch. That is why no consent banner appears.
Account and sign-in
You create an account for the advertiser portal. Sign-in runs through a shared sign-in service based on Amazon Cognito. This processes the account data of the signed-in person, as a rule email address and name, and, if you set one up, a passkey. The passkey stays on your device; only its public key is stored.
The operator sends transactional emails through the account, for example to confirm the account, about the state of an approval or with an invoice. They are sent through Amazon Simple Email Service.
Notices and newsletter
Besides these emails, the operator sends circulars to the customers of the advertiser portal, of two kinds:
- Notices about your contract and the operation of the advertiser portal, for example a change to the general terms and conditions or to the data processing agreement. They are part of performing the contract, also go to people who have unsubscribed from the newsletter, and cannot be unsubscribed from.
- Newsletter with news about regiowerber and similar offerings of the operator. You receive it as a customer on the basis of the existing customer relationship (Art. 3 para. 1 let. o UCA). You can unsubscribe at any time through the link in every issue or with the switch in your profile in the advertiser portal. Unsubscribing applies to the regiowerber newsletter; you will continue to receive notices.
For every mailing, the operator records per recipient the address the email went to and at what time, and notes an unsubscription. This makes it possible to show when a notice was sent. The operator does not measure whether or when you open an email: the emails contain neither tracking pixels nor tracked links. Like the other emails, they are sent through Amazon Simple Email Service.
Campaigns and advertising content
When you create and book campaigns, the operator stores the advertising content you create, the screen locations you choose, the schedule and the state of review and approval. If your advertising content contains personal data, such as a name or a contact detail, the operator processes it on behalf of your company. The data processing agreement applies to this.
Information about the screen locations
When choosing screens you see the address of each location, a description and up to three images. The description and the images come from the owner of the location. The advertiser portal does not show the name of the location or any information about the people living there.
If an image shows a person, a vehicle number plate or anything else that concerns you, the operator will remove the image upon your message to the address above.
Invoicing details and payment
For billing you enter invoicing and contact details in the advertiser portal, such as company, address and email. If you store a card or TWINT, the payment data is collected and stored solely at wallee AG (Switzerland). Of this the operator stores a reference to the stored means of payment, its label and the references of the transactions, and card data at no point. The invoicing and contact details are passed to wallee as far as the payment requires them.
Contact form and email
If you write through the contact form or by email, the operator processes the details you provide (name, email address, possibly phone number and your message) in order to answer the enquiry. The form forwards the message by email. To guard against automated submissions it checks a hidden field and how quickly the form was filled in; no captcha and no third-party service is used for this.
Data from the screens
The screens stand in publicly accessible places and at further selected locations. They count anonymously only: what is recorded is whether motion occurred, whether someone touched a screen with touch and whether the QR code of a screen was opened, in each case as a plain count with no reference to a person. Measurement runs through a motion or presence sensor (infrared or radar) that detects presence and records no images. There is no camera, no facial recognition and no other person recognition on the screens.
Figures for advertisers
As an advertiser you receive only aggregated, anonymous figures on your campaigns, such as reach, the number of touches and QR scans and the number of screens on which a subject ran. No data about people in front of the screen arises in the process, and none is passed on. Advertising tailored to an individual person does not take place.
Disclosure to third parties
The operator does not sell personal data. It passes data to processors that support it in operating the service and that are bound by its instructions. These are Amazon Web Services for hosting, database, sign-in, email delivery and converting videos, wallee AG (Switzerland) for payment processing, and K-I-Soft IT&Holding GmbH, which operates and develops the technical platform. Beyond that, the operator passes on data where a law obliges it to.
Place of processing
Data is stored exclusively in Switzerland, in Amazon Web Services data centres in Zurich, as are the backups. It is encrypted with the platform's own key, which is also located in Zurich.
In some technical processes data passes encrypted through locations outside Switzerland without being stored there:
- Access: browsers and screens connect to the nearest access point of the Amazon Web Services worldwide network (Amazon CloudFront), in Europe usually one in the EU. It keeps subjects and images in its cache for a limited time so that they load quickly. The technical error logs of the sign-in check at the access point are deleted after 30 days.
- Real-time connection: screens and advertiser portal are connected through a data centre in Frankfurt (Germany), because the service used for this is not offered in Zurich. Status messages, control commands and notices of changes pass through it, but no subjects. Technical connection logs are kept there for 30 days.
- Converting videos: an uploaded video is converted for the screens in Frankfurt and then stored back in Zurich.
According to the decision of the Swiss Federal Council, Germany and the EU provide data protection equivalent to that of Switzerland.
Amazon Web Services is a company based in the USA. Access by US authorities under US law, such as the CLOUD Act, can therefore not be ruled out with complete certainty, even though the data is kept in Switzerland. In case data reaches the USA, for example through an access point there, the Amazon Web Services data processing agreement provides for protection under Swiss law, with the EU standard contractual clauses and the Swiss-U.S. Data Privacy Framework. The operator also addresses the residual risk with encrypted transmission and storage and the principle of collecting only the data needed.
Data security
The operator takes appropriate technical and organisational measures to protect the data: encryption in transit and with its own key at rest, two-factor sign-in, access for authorised people only, separate processing per advertiser and continuous backups of the database. No one can guarantee absolute security for transmission over the internet.
Retention
Accounts, campaigns and advertising content remain stored for the duration of the contractual relationship and are deleted afterwards. Invoices and accounting records are kept by the operator for the statutory period of ten years (Art. 958f CO). Anonymous raw counts from the screens delete themselves after 90 days, once they have been aggregated into anonymous daily figures. Enquiries through the contact form are kept for as long as handling them requires. The operator keeps the record of notices and newsletters sent, because it shows when a notice was sent. When an account is deleted, it removes the name and email address from it; the time and result of the dispatch remain as evidence.
Your rights
Under the revDSG you have the right to information about your personal data, to rectification and erasure, and to have your data handed over in a common format. Please contact the address above for this. If you disagree with a processing operation, you may turn to the Federal Data Protection and Information Commissioner (FDPIC).
Changes
The operator adapts this policy when the processing or the legal requirements change. The version published on this page applies.
Last updated: October 2026