Privacy Policy

Who is responsible

The controller for this website is Sandblue, Fabian Pfluger, 8057 Zurich, Switzerland. For privacy enquiries, email [email protected].

This policy covers sandblue.ch, its English-language pages and enquiries sent through the website. Swiss data protection law applies. Where the EU General Data Protection Regulation (GDPR) applies to a particular processing activity, the legal bases and rights described below also apply.

Data we process and purposes

When you visit the website, technical connection data may be processed, including your IP address, time of access, requested URL, browser and device details, referring page, and security or error events. These data are needed to deliver and protect the site and troubleshoot problems.

When you contact us, we process the information you provide: your name, email address and, where relevant, company, website, system or platform, subject and message. We use it to respond, discuss a possible collaboration and, where applicable, perform a contract. Required fields are marked in each form.

Where the GDPR applies, the legal bases are Article 6(1)(b) for contract-related enquiries, Article 6(1)(c) for legal obligations, Article 6(1)(f) for website security and general correspondence, and Article 6(1)(a) for analytics requiring consent.

Hosting, DNS and security: Cloudflare

The website is delivered through Cloudflare Pages, DNS and Cloudflare’s network. Cloudflare, Inc. may process technical connection and security data to deliver content, defend against attacks and diagnose errors. Technically necessary security mechanisms may also be used.

To distinguish visits from Switzerland from other regions, we use the country code determined by Cloudflare when a page is requested. The website retrieves this code through its own endpoint; it is not stored as a separate visitor profile.

Cloudflare privacy information

Content management and media: Sanity

We manage website content in Sanity. Text is incorporated when the website is built. Some images or videos may load directly from cdn.sanity.io; Sanity then receives technical connection data, in particular your IP address and request details. Form submissions are not sent to Sanity.

Sanity privacy information

Contact and service forms

Contact and service forms send the details you enter over an encrypted connection to a Cloudflare Function. Cloudflare Turnstile is used to deter bots. It processes technical browser and interaction signals, and its result is checked on the server before an email is sent. The Turnstile widget does not receive the text of your enquiry.

After successful verification, we send your details by email via Resend (Plus Five Five, Inc., USA) to our mailbox at Hostpoint AG in Switzerland. Your email address is used as the reply-to address. Please do not send sensitive personal data through the forms. You can contact us directly by email instead.

Cloudflare Turnstile privacy information

Resend privacy information

Hostpoint privacy information

Website analytics: Google Analytics 4

We use Google Analytics 4 (measurement ID G-WSS9TF4TM4) to understand page views and website usage. Visited pages, usage events, approximate location, browser and device information, and cookie identifiers may be sent to Google. The website uses the Google tag; the site code does not include a separate advertising or remarketing integration.

For visits that Cloudflare identifies as originating from Switzerland, analytics currently starts without a prior consent prompt. You can object at any time using “Privacy settings” in the footer. Outside Switzerland, or when the region cannot be determined, analytics loads only after you accept it. A previously saved refusal also applies to Swiss visits. Country detection can be inaccurate, for example when using a VPN.

Google Analytics typically uses the _ga and _ga_<ID> cookies to distinguish visitors and sessions; their default lifetime is up to two years. Google says it does not log or store individual IP addresses of users from Switzerland, the EU or the UK. Data may nevertheless be transferred to Google and processed outside Switzerland.

Google Analytics privacy information

Local storage and your analytics choice

The website saves your analytics choice in browser local storage under sandblue-analytics-consent. This avoids asking again and applies your choice on subsequent page loads. You can change it at any time through “Privacy settings” in the footer. If you decline, no further analytics requests are started on newly loaded pages; you can also clear existing analytics cookies in your browser.

Technically necessary storage or security mechanisms may still be required regardless of your analytics choice. Clearing browser data may remove your saved choice.

Other content and external links

Website fonts are served locally. Following an external link, such as one to LinkedIn, opens the third-party service; its privacy policy then applies. For Sanity-hosted media, see the content-management section above.

Recipients and international transfers

For the purposes described above, we use Cloudflare, Sanity, Resend, Google and Hostpoint. Depending on the service and its subprocessors, data may be processed in Switzerland, the European Economic Area, the United Kingdom and the United States; other locations may appear on providers’ current subprocessor lists. Resend and Google in particular may process data in the United States.

Where data are transferred to countries without an adequate level of protection, we rely, where required, on appropriate safeguards such as applicable standard contractual clauses or other permitted transfer mechanisms offered by the providers. Provider agreements and privacy settings should be reviewed regularly.

Retention and security

We keep enquiries and correspondence for as long as needed to deal with them, manage a possible business relationship and comply with legal duties. Technical logs and analytics data are subject to the settings and retention periods of the relevant services; a single fixed period cannot therefore be stated for all data. We limit access and use appropriate technical and organisational safeguards.

Your rights

You may ask for access to your personal data and, where the legal conditions are met, request correction, deletion, disclosure or transfer, or object to processing. You may withdraw consent for the future. Contact [email protected] to exercise these rights. You may also contact the Swiss Federal Data Protection and Information Commissioner; where the GDPR applies, the corresponding rights and complaint options with a competent supervisory authority are available.

Changes

We update this policy if the website, services or legal requirements change. The version published here is the current one. Last updated: 1 October 2026.