Privacy Notice

Last updated: 14 October 2026

This notice explains how iMDsoft Ltd. processes personal data when you visit imd-soft.com, including its German, French and Spanish pages, and our landing pages on learn.imd-soft.com. It also explains your rights under the EU General Data Protection Regulation (GDPR) and the UK GDPR. If you live in California, our California Privacy Notice gives you additional information.

1. Who is responsible for your data

The controller is iMDsoft Ltd., Park Atidim, Bldg. 4, P.O.B. 58178, Tel Aviv 6158101, Israel. Phone: +972 3 768 2888. Email: [email protected].

Our representative in the EU under Art. 27 GDPR

iMDsoft GmbH
Schiessstr. 55
40549 Düsseldorf
Phone: +49 211 5073330
E-Mail: [email protected]

For any question about data protection, and to exercise your rights (section 13), please contact us at the address above.

2. Visiting our website

When you open a page, your browser sends technical data to the server: your IP address, the date and time, the page requested, the page you came from, your browser and operating system, and your language settings. We use this data to deliver the website, to keep it secure and to find errors.

The website is hosted by WP Engine, Inc. (Austin, Texas, USA). Cloudflare, Inc. (San Francisco, USA) delivers the pages through its network and protects them against attacks. To tell people from automated bots, Cloudflare stores the cookie __cf_bm in your browser for 30 minutes. Both providers process the data on our behalf.

The legal basis is our legitimate interest in a secure website that works (Art. 6(1)(f) GDPR). Storing __cf_bm is strictly necessary for this service, so it needs no consent (Art. 5(3) ePrivacy Directive and the national laws implementing it, for example § 25(2) no. 2 TDDDG in Germany; regulation 6 PECR in the UK). Server log files are deleted after 90 days.

3. Your choices in the cookie banner

On your first visit, a banner asks which optional services you allow. The banner is provided by Cookiebot of Usercentrics A/S (Copenhagen, Denmark), which processes the data on our behalf. Until you have made a choice, and after “Deny”, the website uses only services that need no consent (sections 2, 4, 5 and 8). Services in the categories preferences, statistics and marketing run only after you have allowed them.

You can change or withdraw your choice at any time with effect for the future: click the Cookiebot icon on any page, or use the cookie declaration at the end of this notice (section 15).

To record your choice, Cookiebot stores the cookie CookieConsent in your browser. It also logs your consent ID, the date and time, your choices, the address of the page, your browser details and your IP address in shortened form. We need this record to be able to prove your consent (Art. 6(1)(c) GDPR together with Art. 7(1) GDPR).

4. Accessibility tool

To make our website easier to use for people with disabilities, we offer an accessibility tool by accessiBe Inc., 1140 Broadway, 14th Floor, New York, NY 10001, USA. It loads with every page from accessiBe’s servers (acsbapp.com). Your browser transmits your IP address and technical data about the page and your device. The legal basis is our legitimate interest in an accessible website (Art. 6(1)(f) GDPR).

5. Google Tag Manager

We use Google Tag Manager of Google Ireland Limited (Dublin, Ireland) to manage the statistics tools on our website. Tag Manager itself sets no cookies and does not analyse how you use the website. It starts the tools in section 6 only after you have allowed them in the banner. When Tag Manager loads, your browser transmits your IP address to Google; Google LLC in the USA may receive it (section 12). The legal basis is our legitimate interest in managing these tools efficiently (Art. 6(1)(f) GDPR).

6. Statistics and marketing with your consent

The following services run only after you have allowed the category named in the banner. The legal basis is your consent (Art. 6(1)(a) GDPR). Storing and reading information on your device also requires consent under Art. 5(3) ePrivacy Directive and the national laws implementing it (for example § 25(1) TDDDG in Germany; regulation 6 PECR in the UK). You can withdraw your consent at any time (section 3). The cookies these services use, with purpose and lifetime, are listed in the cookie declaration (section 15).

HubSpot (statistics and marketing). HubSpot recognises returning visitors, records which of our pages they view and which buttons they click, and links this to your contact record if you send us a form. We use this to understand the interest in our products and to tailor our contact with you. Provider: HubSpot Ireland Limited (Dublin, Ireland) together with HubSpot, Inc. (Cambridge, Massachusetts, USA). Your data is stored in HubSpot’s data centre in the EU.

Google Analytics 4 (statistics). Google Analytics shows us how visitors use the website, for example which pages they view, how long they stay and how they found us. Provider: Google Ireland Limited (Dublin, Ireland); Google LLC (USA) may receive data. Google Analytics keeps the data for 14 months.

Microsoft Clarity (statistics and marketing). Clarity records how visitors use our pages, for example clicks, scrolling and mouse movements, and shows this as heatmaps and recordings of visits. Clarity also sets the cookie MUID, which Microsoft uses to recognise browsers across Microsoft websites, including for advertising. Provider: Microsoft Ireland Operations Limited (Dublin, Ireland) and Microsoft Corporation (Redmond, USA).

7. Videos

Our videos are hosted by Vimeo.com, Inc. (New York, USA). As long as you have not allowed the marketing category, the videos are not loaded and no data goes to Vimeo. Once you have allowed it, the Vimeo player loads with the page. Vimeo then receives your IP address, the address of the page and technical data about your device, and may store cookies in your browser; Vimeo uses Cloudflare to protect its service. The legal basis is your consent (Art. 6(1)(a) GDPR and the provisions named in section 6).

8. Contact, demo, partner and event forms

You can contact us, request a demo, apply to become a partner or arrange a meeting at an event through forms on our website and on learn.imd-soft.com. We process what you enter, such as your name, company, work email address, phone number and message, to answer your request and to prepare and manage our business relationship. Fields marked with an asterisk are required; without them we cannot answer your request.

The forms are provided by HubSpot (section 6) and load from HubSpot’s servers when you open a page with a form. HubSpot protects the forms against bots with Cloudflare, which stores the cookie __cf_bm for 30 minutes. What you send us is stored in our customer database at HubSpot in the EU.

The legal basis is the preparation of a contract at your request (Art. 6(1)(b) GDPR) and our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR). We delete your data 24 months after our last contact, unless a contract follows or the law requires us to keep it longer.

9. Newsletter

If you subscribe to our newsletter, we send you news about our products, events and customer stories by email. We only need your email address. After you sign up, we send you an email with a confirmation link; your subscription starts only when you click it (double opt-in). We record the time of sign-up and confirmation and the IP address used so that we can prove your consent.

The sign-up form at the bottom of each page loads HubSpot only when you click into it. We send the newsletter with HubSpot (section 6). HubSpot records whether you open the newsletter and which links you click; we use this to improve the newsletter.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with effect for the future, using the unsubscribe link in every newsletter. We then remove your email address from the mailing list. We keep the record of your consent for 3 years after you withdraw it, so that we can prove it if needed (Art. 6(1)(f) GDPR).

10. Job applications

Our careers page links to our job board on Workday, which is run by Harris Computer Inc. If you apply there, the privacy notice shown on the job board applies.

11. Our pages on LinkedIn, YouTube and Facebook

Our website links to our pages on LinkedIn, YouTube and Facebook. These are plain links: no data goes to these platforms until you click one. On the platforms themselves, their own privacy policies apply.

For the statistics that LinkedIn and Facebook provide about visits to our pages, we are joint controllers with LinkedIn Ireland Unlimited Company and Meta Platforms Ireland Limited (Art. 26 GDPR). Under these agreements, the platforms take primary responsibility for the statistics, including requests from data subjects: LinkedIn Page Insights Joint Controller Addendum, Meta Page Insights Controller Addendum. The legal basis is our legitimate interest in presenting our company on these platforms (Art. 6(1)(f) GDPR).

12. Recipients and transfers outside the EU and the UK

The service providers named in this notice process data on our behalf and under our instructions; HubSpot uses Amazon Web Services as a sub-processor, for example for images on our blog. Beyond that, we pass on personal data only where necessary: to companies of our group for sales and support in your country, to professional advisers who are bound to confidentiality, and to authorities where the law requires it.

iMDsoft is based in Israel. The European Commission and the United Kingdom have recognised that Israel ensures an adequate level of data protection.

Several providers are based in the USA or may access data from there: WP Engine, Cloudflare, HubSpot, Google, Microsoft, Vimeo and accessiBe. Where a provider is certified under the EU-U.S. Data Privacy Framework, the transfer is based on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR) and, for the UK, on the UK Extension to this framework. Otherwise we have agreed the EU standard contractual clauses with the provider (Art. 46(2)(c) GDPR), with the UK Addendum where needed.

13. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16 GDPR) or erased (Art. 17 GDPR), to have its processing restricted (Art. 18 GDPR) and to receive data you have given us in a common machine-readable format (Art. 20 GDPR). You can withdraw any consent at any time with effect for the future (Art. 7(3) GDPR). To exercise your rights, contact us at the address in section 1.

Right to object (Art. 21 GDPR). Where we process your data on the basis of our legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation. We then stop the processing, unless we can show compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves legal claims. You can object to direct marketing at any time without giving reasons.

You can lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place (Art. 77 GDPR). In the UK, the competent authority is the Information Commissioner’s Office (ico.org.uk).

You are not obliged to provide personal data; without it, however, we may not be able to answer your request (section 8). We do not use automated decision-making within the meaning of Art. 22 GDPR.

14. Changes to this notice

We update this notice when our website or the services we use change. The current version is always available on this page; the date of the last update is shown at the top.

15. Cookie declaration