Privacy policy

1. Controller

Controller within the meaning of the Swiss Federal Act on Data Protection (DSG) and the GDPR:

DIGITLZ Massold, owner Christian Massold
Dufourstrasse 49, 8008 Zurich, Switzerland
[email protected]

2. Data collected

• When you visit the site: a truncated IP address, the time, the address requested, the volume of data transferred, the status message, the browser identifier, the language setting, the referring page and the country of origin as supplied by Cloudflare.
• When you write by email: your address and the content of your message.
• When you book an appointment: name, email address, whatever you enter in the additional fields, and the slot you choose. Loading the reservation page also transmits your IP address, browser and device details, and the page you came from.

3. Purposes

• Secure operation and troubleshooting
• Answering your enquiries
• Arranging, confirming and reminding you of appointments
• Protecting the reservation page against abuse
• Initiating and performing a contract
• Audience measurement

4. Legal bases

• Consent – Art. 6(1)(a) GDPR, § 25(1) TDDDG: for loading the reservation page.
• Contract and pre-contractual steps – Art. 6(1)(b) GDPR: for enquiries relating to a contract and for handling appointments.
• Overriding legitimate interest – Art. 31(1) DSG, Art. 6(1)(f) GDPR: for secure operation and for enquiries unrelated to a contract.
• Legal obligation – Art. 6(1)(c) GDPR: for retaining business records.

5. Retention

• Server logs: 30 days.
• Audience measurement data: 90 days, deleted weekly. The reports calculated from it remain.
• Appointment data: until the appointment is dealt with, at most twelve months – provided no business relationship arises.
• Business records: ten years (Art. 958f OR, the Swiss Code of Obligations).

6. Recipients and disclosure

Data is not passed to third parties, apart from the service providers below and to authorities where the law requires it. Where data is disclosed abroad, the country and the safeguard must be named (Art. 19(4) DSG).

• Cloudflare, Inc., USA – delivery of the website and protection against overload; involved in every page view. Safeguard: standard contractual clauses with the Swiss addendum recognising the EDÖB, the Swiss Federal Data Protection and Information Commissioner, as supervisory authority, supplemented by the Swiss-U.S. Data Privacy Framework.
• Google Cloud EMEA Limited, Dublin, Ireland – email, appointment booking and the confirmation and sign-in emails of the Sparks publication, as processor. Safeguard: adequacy decision for Ireland; for onward transfer to Google entities in the USA the standard contractual clauses (EU) 2021/914, processor-to-processor module, with Google as exporter.
• Google LLC, Mountain View, USA – operation of the reservation page and reCAPTCHA abuse protection, as an independent controller. Its own terms apply: policies.google.com/privacy.

7. Cookies and local storage

This website sets cookies of its own only where you have decided something yourself: for your choice of language, and for your objection to the audience measurement.

• The cookie “digitlz-sprache” records whether you want to read the site in German or in English. It is only created once you use the switch in the header, contains nothing but “de” or “en”, and expires after a year. It applies to digitlz.ai and to sparks.digitlz.ai, so that your choice holds on both addresses. It serves only the presentation you asked for and therefore needs no consent; you can delete it in your browser settings.
• Your browser's local storage holds your colour scheme, the currency you picked and, once you have loaded the appointment picker, your consent to it. None of that leaves your device.
• The Google Calendar reservation page on the contact page only loads once you explicitly ask for it – before that, no request goes to Google. Google then sets the cookie “NID” with a lifetime of around six months and loads its reCAPTCHA abuse protection.
• The cookie “digitlz-nicht-zaehlen” is only created if you object to the audience measurement. It contains a 1, applies to digitlz.ai and to sparks.digitlz.ai, and expires after a year.
• Your consent can be withdrawn at the bottom of this page. The Google cookie is one you delete in your browser settings.

8. Audience measurement

To see which pages get read, DIGITLZ analyses the access log of its own server. Nothing is stored on or read from your device, and no service provider is involved. The legal basis is the overriding and legitimate interest in a demonstrably better website (Art. 31(1) DSG, Art. 6(1)(f) GDPR).

9. Sparks (sparks.digitlz.ai)

At sparks.digitlz.ai, DIGITLZ publishes posts – thoughts, use cases and news. The publication runs on the same server in Zurich as this website, and the controller is the same as in section 1. Everything above applies; the points below add to it.

• Server logs: A page view on Sparks leaves the same details as a page view here (section 2) and is deleted after 30 days (section 5).
• Audience measurement: Views on Sparks are analysed the same way, from the access log of our own server – self-hosted, no service provider, nothing stored on or read from your device. The switch in the audience measurement section applies to both addresses; likewise, the analysis honours your browser's “Do Not Track” and “Global Privacy Control” signals on both.
• Subscribing by email: On Sparks you can leave your email address to hear about new posts. That is the only purpose. After you enter it you receive an email with a confirmation link; only your click on it creates a record (double opt-in). What is stored is your address, the time of confirmation and the language of the page you subscribed on. The data sits in Sparks on the same server. The legal basis is your consent (Art. 6(1)(a) GDPR); you can withdraw it at any time with effect for the future.
• Unsubscribing and deletion: Every email carries an unsubscribe link that works with one click. We delete your address on request to [email protected].
• Confirmation and sign-in emails are sent by Sparks through Google – the same processor and the same safeguard as in section 6.
• Cookies on Sparks: If you only read, you get none (measured on 15 September 2026). One is created when the editor signs in, when you have confirmed your subscription, or when you use the language switch. Your colour scheme sits in your device's local storage, as on this website. Ghost also keeps a note in session storage of which pages you arrived through, so that a later subscription can be attributed; that entry disappears when you close the browser tab and never leaves your device.

10. Your rights

You have the following rights; an email to [email protected] is enough.

• Access to the data held about you (Art. 25 DSG, Art. 15 GDPR)
• Rectification of inaccurate data
• Erasure of your data
• Release or transfer of your data
• Restriction of processing (Art. 18 GDPR)
• Objection to processing (Art. 21 GDPR)
• Withdrawal of a consent you have given

11. Right to complain

You may complain to the competent supervisory authority:

• Switzerland: Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB), Feldeggweg 1, 3003 Bern – edoeb.admin.ch
• EU: the data protection authority where you live or work

12. Changes

This policy will be adjusted whenever the services used or the processing change.

Consent for the appointment picker

You have loaded the appointment picker on the contact page and thereby allowed the Google content; the details are in section 7. Your decision sits in your browser's local storage. Withdraw it here – the picker then stays blocked until you ask for it again.