SANDBLUE
Privacy Policy
Controller responsible for processing
The controller responsible for this website is Fabian Pfluger, Sandblue, 8057 Zurich, Switzerland.
Privacy enquiries: [email protected]
This privacy policy covers visits to this website and contact with Sandblue. The Swiss Federal Act on Data Protection (FADP) applies. Where the EU General Data Protection Regulation (GDPR) applies to a particular processing activity, we also take its requirements into account.
What data we process and why
We process information you provide when contacting us, particularly your name, email address, details of your business or website and the content of your message. We use it to respond to your enquiry, discuss potential collaboration and provide agreed services.
Accessing websites and externally hosted media also generates technical connection data. This may include your IP address, time of access, requested address, browser and device information and referring page. These data support delivery, troubleshooting and security.
Where the GDPR applies, processing for contractual enquiries is based on Article 6(1)(b), legal obligations on point (c), and secure website operation and general correspondence on point (f). Consent-based analytics would rely on point (a).
Hosting and security with Cloudflare
Cloudflare is planned as the hosting provider for this website. The provider is Cloudflare, Inc., USA. Cloudflare delivers the website through a distributed network and may process technical connection data for delivery, protection against attacks and troubleshooting.
Processing outside Switzerland, particularly in the USA, is possible. Specific processing locations, log retention periods and any security cookies depend on the Cloudflare services enabled. These settings will be determined before public launch and specified in this policy.
Cloudflare data processing and international transfers
Content and media through Sanity
We use Sanity as our content management system. The website retrieves text from Sanity and may load images or videos directly from cdn.sanity.io. When you access this media, your IP address is transmitted to the delivery service; technical request information may also be processed. This supports the display and reliable delivery of content.
Sanity identifies Sanity AS in Norway and Sanity US Inc. in the USA as contracting entities. Its provider information lists Belgium and the USA among the locations used for the underlying cloud infrastructure. The contracting entity applicable to our project and the complete list of relevant recipient countries will be verified before public launch.
Sanity’s data processing agreement provides for safeguards including standard contractual clauses, with adaptations for the Swiss FADP, for restricted international transfers. Public website content is managed in Sanity; the current contact forms do not send enquiries to Sanity.
Sanity data processing agreement
Sanity subprocessors and processing locations
Email contact and forms
Our email provider is Hostpoint AG, Neue Jonastrasse 60, 8640 Rapperswil, Switzerland. When you send us an email, your address, message content, any attachments and technical delivery data are processed to receive, store and respond to the message.
Please do not send sensitive personal data by ordinary email unless this has been agreed in advance. Hostpoint’s information also applies to technical processes and any service providers it uses.
The forms in this preview version validate entries only in your browser. Sending is not yet enabled: the website currently neither transmits nor stores submitted form data on a server. Please use the email address above for enquiries. Once form delivery is configured, this section will be updated to describe the actual processing.
Cookies, fonts and animations
The current website code does not include analytics or advertising cookies. Fonts are served with the website; loading them does not make a request to Google Fonts.
The robot animation processes mouse movements and scroll positions locally in your browser to control the video position. The animation neither stores these movement data nor sends them to an analytics service. If a video is loaded through Sanity, the media delivery information also applies.
Strictly necessary cookies may be added when security services are introduced. We will provide information about the cookies actually used, their purposes and lifetimes before using them. You can also manage and delete cookies in your browser settings.
Google Analytics – planned use
We plan to use Google Analytics 4 to analyse website usage. Google Analytics is not integrated into this version, so our website does not currently send usage data to Google Analytics.
If activated later, page views, interactions, traffic sources, device and browser information and cookie identifiers may be analysed. The aim is to improve content and navigation. According to Google, IP addresses are used during collection to derive location information but are not logged or stored in Google Analytics 4. This does not mean that all analytics data are anonymous.
Before activation, the specific Google contracting entity, recipient countries, transfer safeguards, cookie lifetimes and retention periods will be determined and added here. Activation is intended to take place only after your consent, with an accessible option to withdraw it at any time. This consent feature is not yet implemented.
Google: safeguarding Analytics data
Google Analytics: data retention
Recipients and processing abroad
The providers named here may receive personal data where required for their services. Disclosure may also be necessary to meet legal obligations or to establish, exercise or defend legal claims.
Transfers abroad must meet the requirements of the Swiss FADP. These include an adequate level of data protection in the recipient country or appropriate safeguards, such as recognised standard contractual clauses, subject to statutory exceptions. The safeguards and recipient countries applicable to public operation will be checked against the provider agreements in place.
FDPIC: disclosure of personal data abroad
How long data are retained
We retain personal data for as long as needed for the relevant purpose. For enquiries, retention depends on handling the request and any subsequent collaboration. Statutory retention obligations and the need to establish or defend legal claims may justify longer retention.
When the purpose and grounds for retention no longer apply, data are deleted or anonymised. Technical logs, backups and future analytics data are also subject to the providers’ agreed or configured retention periods. These still need to be specified before public launch.
Your rights
You may request information about whether and which personal data we process about you, and have inaccurate data corrected. Subject to applicable legal requirements, you may request deletion or cessation of processing and the provision or transfer of certain data. Where processing is based on consent, you may withdraw that consent for the future.
Send your request to [email protected]. Where necessary, we may ask for information to verify your identity. We generally provide access free of charge within 30 days, subject to statutory restrictions and exceptions.
You may also contact the Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, its additional rights to restriction, objection and complaint to a competent supervisory authority also apply.
FDPIC: right of access and further information
Changes to this policy
We update this policy when our website, the services we use or applicable requirements change. For the processing described here, we do not currently use automated individual decisions with legal or similarly significant effects.
Last updated: 19 September 2026. This version describes the preview of the new website. Hosting configuration, form delivery and Google Analytics information will be updated before those services are activated.