LEGAL

Privacy Policy

Last updated: October 9, 2026

This policy explains how I handle personal data on marcovanderweijden.com (the "site"). It follows the Swiss Federal Act on Data Protection (nFADP) and, for visitors in the EU and EEA, the EU General Data Protection Regulation (GDPR).

1. Who is responsible

I am Marco van der Weijden, based in Zurich, Switzerland, and I am the controller for the processing described here.

Email: [email protected]
Use this address for any privacy request or question.

2. In short

  • Visiting the site: the host and Cloudflare process technical data such as your IP address to deliver and protect the site.
  • Contact form: I use what you enter to reply and keep a record for up to 12 months after our last contact.
  • Analytics tools: Google Analytics and Microsoft Clarity load only if you accept them in the cookie banner. You can change your choice at any time.
  • Visit statistics: Cloudflare Web Analytics counts page views and measures load times without cookies and without identifying you.
  • Google Search Console and Bing Webmaster Tools tell me how the site performs in search. They do not track you on the site.
  • I do not sell personal data and I make no automated decisions about you.

3. Which laws apply

The nFADP applies to processing that has an effect in Switzerland. The GDPR applies where the site is directed at, or monitors, people in the EU or EEA. Under the GDPR I state the legal basis for each purpose below. Under Swiss law I follow the principles of Art. 6 nFADP and, where processing needs a justification, rely on your consent or on my overriding private interest (Art. 31 nFADP).

4. What I process, why, and on what basis

4.1 Visiting the site (hosting and security)

  • Data: IP address, date and time, page requested, referring page, browser and device type, and the server response.
  • Purpose: delivering the site, keeping it secure, preventing abuse, fixing errors.
  • Basis: legitimate interest in running a secure site (Art. 6(1)(f) GDPR).
  • Providers: the site is hosted by Infomaniak Network SA in Switzerland. Cloudflare, Inc. (USA) sits in front of it as a network and security layer, so your requests pass through Cloudflare servers that may be outside Switzerland and the EU.
  • Retention: server logs are kept for a short period set by Infomaniak, at least seven days.

4.2 Contact form

  • Data: name, email address, company (optional), topic, your message, and the date and time of sending.
  • Purpose: answering your message and keeping a record of it.
  • Basis: where you ask about an appointment or my services, steps at your request before a contract (Art. 6(1)(b) GDPR); otherwise my legitimate interest in answering inquiries (Art. 6(1)(f) GDPR).
  • How it is handled: the message is emailed to me, and you receive an automatic confirmation email. The site does not keep a copy in its database; the email is the record.
  • Inquiries sent through this site: if your inquiry concerns work that Vervitas GmbH in Zurich contracts, I may pass it to that company so it can deal with it.
  • Required or optional: name, email, topic and message are needed to answer you. Without them I cannot process the form.
  • Retention: up to 12 months after our last contact. If your inquiry leads to an engagement, the data is then handled under the terms of that engagement and kept as long as the law requires.

4.3 Email

If you write to me by email, I process your address, the message and its metadata to reply. The mailbox is hosted by Infomaniak in Switzerland. Basis and retention are the same as for the contact form.

4.4 Spam protection (Cloudflare Turnstile)

The contact form uses Cloudflare Turnstile to tell people from bots. Turnstile evaluates signals from your browser and connection, including your IP address, when you load or submit the form. Basis: legitimate interest in protecting the form from abuse (Art. 6(1)(f) GDPR). Provider: Cloudflare, Inc.

4.5 Cookies and your consent

Technically necessary cookies and similar storage keep the site secure and working. They need no consent.

Google Analytics and Microsoft Clarity are optional. They do not load until you accept them in the cookie banner. If you decline, they stay off. You can change your choice at any time through the cookie icon at the bottom left of every page. Withdrawing consent does not affect processing that took place before.

  • CookieYes (stores your consent choice): cookieyes-* (1 year).
  • Google Analytics 4 (usage statistics): _ga, _ga_* (about 13 months).
  • Microsoft Clarity (heatmaps and session recordings): _clck (1 year), _clsk (1 day), and Microsoft identifiers set when Clarity runs: SM, MR, MUID, ANONCHK, SRM_B (from 10 minutes to about 13 months).

The cookie scan of October 1, 2026 describes some of the Microsoft identifiers as used for advertising and analytics. I do not run advertising on this site and I do not use them for advertising. The Cookie Policy page lists every cookie with its duration.

Consent banner (CookieYes). The banner is provided by CookieYes. It stores your choice in a cookie on your device and keeps a consent log so I can show what you chose and when. The log holds a consent ID, a pseudonymized IP address, your country, your choice by category and the time. Basis: legitimate interest in being able to show your choice (Art. 6(1)(f) GDPR; Art. 7(1) GDPR requires me to be able to demonstrate consent). Provider: CookieYes Limited, United Kingdom.

4.6 Google Analytics 4

  • Data: a pseudonymous identifier, pages viewed, events, approximate location, browser, device and operating system. Google Analytics 4 does not log or store IP addresses.
  • Purpose: understanding which content is useful, so I can improve the site.
  • Basis: your consent (Art. 6(1)(a) GDPR). The tool receives your choice through Google Consent Mode.
  • Provider: Google Ireland Limited for users in the EEA and Switzerland, with onward processing by Google LLC (USA).
  • Retention: event-level data 2 months; user-level data 14 months, counted from your last activity. Aggregated reports are not affected by these settings.

4.7 Microsoft Clarity

  • Data: how you use the pages: clicks, scrolling, mouse movement, pages visited, device and browser details, and an approximate location. Session recordings are made from this data. Clarity masks text that visitors type into forms and other sensitive text, so what you enter in the contact form is not recorded.
  • Purpose: finding pages that confuse visitors or do not work well.
  • Basis: your consent (Art. 6(1)(a) GDPR). Clarity requires a consent signal for visitors from the EEA, the UK and Switzerland and sets its cookies only after it receives one.
  • Provider: Microsoft Corporation (USA) and Microsoft Ireland Operations Limited.
  • Retention: session recordings 30 days; aggregated click and heatmap data 9 months.

4.8 Google Search Console and Bing Webmaster Tools

I use these tools to see how the site appears in Google and Bing: search queries, impressions, clicks, indexing and errors. I verified ownership of the site with a verification code. The tools show me aggregated data. They do not place cookies or tracking code in your browser. Google and Microsoft process data about your searches under their own privacy policies. Basis: legitimate interest in keeping the site findable and working (Art. 6(1)(f) GDPR).

4.9 Cloudflare Web Analytics

  • Data: the page visited, the referring page, your country, browser, operating system and device type, and how long the page took to load. It sets no cookies and stores nothing on your device. Cloudflare states that it does not fingerprint visitors through their IP address, browser details or any other data.
  • Purpose: counting visits and checking how quickly pages load.
  • Basis: legitimate interest in measuring the use and performance of the site (Art. 6(1)(f) GDPR). Because it sets no cookies and is not used to identify you, it does not depend on the cookie banner.
  • Provider: Cloudflare, Inc. (USA).
  • Retention: Cloudflare keeps the full data for 7 days and after that only an aggregated sample of about 10 percent.

5. Who receives your data

  • Infomaniak Network SA (Switzerland): hosting of the site and my mailbox.
  • Cloudflare, Inc. (USA and its global network): network, security, Turnstile, Web Analytics.
  • Google Ireland Limited, Google LLC (Ireland, USA): analytics (with consent), Search Console.
  • Microsoft Ireland Operations Limited, Microsoft Corporation (Ireland, USA): Clarity (with consent), Bing Webmaster Tools.
  • CookieYes Limited (United Kingdom): consent banner and consent log.
  • Vervitas GmbH (Switzerland): handling of inquiries sent through this site.

I may also disclose data to authorities where the law requires it, and to professional advisers bound by confidentiality where I need advice on a specific matter. I do not sell personal data.

6. Transfers abroad

Switzerland and the EU/EEA recognize each other's data protection as adequate, and the UK is covered by adequacy decisions. For transfers to the USA I rely on the Swiss-US Data Privacy Framework (in force since September 15, 2024) and the EU-US Data Privacy Framework where the recipient is certified. Google LLC, Microsoft Corporation and Cloudflare, Inc. each state that they are certified under these frameworks. Where a recipient is not certified, I rely on standard contractual clauses, adapted for Swiss law, in the provider's data processing terms. Cloudflare routes traffic through data centers in many countries; its data processing terms cover those transfers.

7. How long I keep data

  • Server logs: a short period set by Infomaniak, at least seven days.
  • Contact form and email messages: up to 12 months after our last contact; longer only if an engagement or the law requires it.
  • Google Analytics 4: event-level data 2 months; user-level data 14 months.
  • Microsoft Clarity: session recordings 30 days; aggregated click and heatmap data 9 months.
  • Cloudflare Web Analytics: full data 7 days, then an aggregated sample.
  • Cookie consent choice and consent log: the choice cookie 1 year; the log as long as needed to demonstrate your choice.

I delete data earlier if you ask and no legal duty requires me to keep it.

8. Security

The site is served over HTTPS. Access to the site's administration and to stored messages is restricted, and Cloudflare filters abusive traffic. No system is completely secure, so I cannot guarantee absolute security.

9. Your rights

You can ask me for access to your data, correction, deletion, restriction of processing, and a copy of the data you gave me in a common format. Where I process on the basis of legitimate interests, you can object. Where I rely on consent, you can withdraw it at any time through the cookie icon at the bottom left of every page.

Write to [email protected]. I may ask you to prove your identity first. I answer within 30 days.

You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch, or, if you are in the EU or EEA, to the data protection authority where you live or work.

10. Automated decisions

I take no decisions about you based solely on automated processing that have legal or similarly significant effects. The analytics tools compile usage statistics, but they do not decide anything about you.

11. Children

The site is meant for a professional audience and is not directed at children. I do not knowingly collect data from children under 16.

12. Links to other sites

The site links to other sites, such as my LinkedIn profile. Those sites have their own privacy policies, and I am not responsible for them.

13. Changes

I update this policy when the site or the law changes. The date at the top shows the current version.