Privacy.
What this site collects, why, who handles it, and what you can ask me to do about it.
Effective Last updated
1. Who I am
This website, sitesbyenzo.com, is run by Sites by Enzo, a one-person web design business based in Denmark. I decide what personal information the site collects and what happens to it, so I am responsible for it: the "controller" under the EU's General Data Protection Regulation (GDPR), and the person accountable for it under Canada's privacy law (PIPEDA) and Quebec's privacy law. Questions, requests and complaints about this policy come to me, and I reply within 30 days.
Email: hello@sitesbyenzo.com
Sites by Enzo is a sole proprietorship (enkeltmandsvirksomhed) registered in Denmark and owned by me,Enzo Tous Sanz.
Address: Østergade 19, 2., 6400 Sønderborg, Denmark
CVR: 46837045
2. What I collect, and how
- When you book a call: the booking calendar on the call page is Cal.com's. It loads when the page opens, so Cal.com receives your IP address, and if you book, the details you enter (your name, your email address and the time you choose). The booking reaches my Google calendar, and we talk on Google Meet.
- On our call: with your permission, I record it on my computer with Wispr Flow, which turns it into a written transcript, so I can listen to you rather than take notes. I ask at the start of the call. If you would rather I did not, I do not record, and we talk all the same.
- After you book: the page you land on after booking asks a few questions about your business: your name and email address, your business's name, what it does, where it is, its website, where else it is online, and who sent you my way. When you send them, they go through a small script that runs on Cloudflare, which checks the form is from a person and emails your answers to me. The script keeps no copy. I use your answers, and what your business shows publicly online, to prepare for our call, with the help of Claude, an AI assistant made by Anthropic. Once you send them, the page shows Vancouver's weather, which your browser fetches from Environment and Climate Change Canada's public weather service; like any site you load, that service receives your IP address.
- When you email me: your message arrives in my inbox, which Google Workspace hosts.
- When you visit: Fathom Analytics counts visits: the page you viewed, the site that referred you, your browser and device type, and your country. It uses no cookies and does not store your IP address or anything that could recognize you across visits or sites. Cloudflare, which hosts the site, keeps standard security logs (IP address, time, requested address, browser), for the period set in Cloudflare's own policies.
You do not have to give me anything. Without an email address I cannot reply to you, and without booking details I cannot hold a call for you. The questions after booking are there to help me prepare; you can leave the optional ones empty.
This site has no newsletter and is not directed at children. I do not collect sensitive information. If you believe someone under 14 has sent me information, tell me and I will delete it.
3. Why I use it, and what allows me to
Canadian law asks what I use your information for and how you consent to it. The GDPR also asks which of its legal grounds each use rests on. Both are in the table.
| What | Why | Consent and legal ground |
|---|---|---|
| Your booking details | To hold the call at the time you chose | Your request: consent is implied by booking. GDPR: steps you asked for before a contract (Article 6(1)(b)) |
| Your answers after booking | To understand your business before the call | Your request: consent is implied by sending them. GDPR: steps you asked for before a contract (Article 6(1)(b)) |
| Your emails to me | To answer you and, if you become a client, to do the work | Your request. GDPR: steps you asked for before a contract, and the contract itself if we work together (Article 6(1)(b)) |
| The recording and transcript of our call | To have an accurate record of what you asked for, to scope and build your site from | Your consent, asked at the start of the call. You can withdraw it at any time, and I delete the recording and transcript. GDPR: consent (Article 6(1)(a)) |
| The spam check on the form | To keep automated spam out of my inbox | Necessary for the form you are using. GDPR: my legitimate interest in a form that works (Article 6(1)(f)) |
| Analytics | To see which pages are useful and fix problems | No consent needed: no cookies, no identifiers. GDPR: my legitimate interest in knowing the site works (Article 6(1)(f)) |
| Security logs | Security and keeping the site running | Necessary to operate the site. GDPR: my legitimate interest in a secure site (Article 6(1)(f)) |
| Client records, if you become a client | Invoices and accounts | Required by law. GDPR: a legal obligation (Article 6(1)(c)) |
I do not sell personal information, use it for advertising, or make automated decisions with it.
4. Cookies and browser storage
This site sets no cookies of its own. It keeps one note in your browser's session storage, named sbe-intro, which remembers that the opening animation has played, so it does not play again when you come back to the home page in the same tab. It holds nothing about you, is never sent anywhere, and is deleted when you close the tab.
Two services I use store something of their own. The Cal.com calendar on the call page sets Cal.com's cookies when the page opens; Cal.com's policy describes them. On the page after booking, Cloudflare's spam check keeps a note in your browser's storage for its own domain, challenges.cloudflare.com, to tell people from automated scripts. Fathom Analytics uses no cookies or storage.
5. Who handles it
These providers process information on my behalf, under their own terms and privacy policies:
| Provider | What | Where |
|---|---|---|
| Cloudflare | Hosting, including the video on the page after booking, security logs, the form script and its spam check, and the email that carries your answers to me | Cloudflare's global network, including the United States |
| Cal.com | The booking calendar on the call page | United States |
| Fathom Analytics | Cookieless visit counts | Canada; visits from the EU are processed in the EU |
| Google Workspace | My email inbox and calendar, and Google Meet for our call | Google's data centres, including the United States |
| Wispr Flow | Recording and transcribing our call, if you agree to it | United States |
| Anthropic (Claude) | The AI assistant I prepare for our call and build your site with, working from your answers, our call's transcript and your emails | United States |
Some of these providers are outside the EU and outside Canada. While your information is with them, it is subject to the laws of the country it is in and may be accessible to its authorities. For transfers out of the EU I rely on the safeguards each provider offers under the GDPR: the EU-US Data Privacy Framework where the provider is certified under it, the European Commission's adequacy decision for Canada, or the Commission's standard contractual clauses. You can ask me for details of the safeguard that applies.
If you are in Canada: I run this business from Denmark, so your information is handled in Denmark and by the providers above, outside Canada.
I do not share personal information with anyone else unless the law requires it.
6. How long I keep it
- Your answers after booking, your booking, your emails, and the recording and transcript of our call: deleted 12 months after our last exchange, unless you become a client.
- If you become a client: for our work together, then your invoices and accounting records for five years, as Danish bookkeeping law requires.
- The form script: keeps no copy of your answers. Its own logs hold no answers and no email address, and are deleted after 7 days.
- Bookings in Cal.com's records: under Cal.com's own policy.
- Analytics: totals only, with no personal data to keep.
- Security logs: for the period set by Cloudflare.
7. How I protect it
Every page uses HTTPS. I use reputable providers, I am the only one with access, my accounts use two-factor authentication, and I collect only what the purposes above need. No method is perfectly secure. If a breach creates a real risk to you, I will tell you and the regulator as the law requires.
8. Your rights
You can ask me, free of charge:
- to tell you what personal information I hold about you and how I use it, and to give you a copy;
- to correct it;
- to delete it;
- to limit what I do with it, or to object to a use that rests on my legitimate interest;
- to give you what you gave me in a structured, machine-readable format, or send it to someone else;
- to withdraw consent you have given, for the future.
Write to me at the email above. I will confirm it is you and respond within 30 days. Some rights have limits set by law. For example, I must keep accounting records even if you ask me to delete them. If a limit applies, I will tell you which one and why.
If you are not satisfied, you can complain to the Danish Data Protection Agency, Datatilsynet, or to the privacy regulator where you live: in Canada the Office of the Privacy Commissioner of Canada, in British Columbia the Office of the Information and Privacy Commissioner for British Columbia, and in Quebec the Commission d'accès à l'information.
9. Changes
I post changes here with a new "last updated" date. For a significant change, I add a notice on the home page.
10. Contact
Sites by Enzo, at hello@sitesbyenzo.com.