Skip to content
GTM due diligence for PE, VC and CEOs

Privacy

This policy explains what personal data this website handles, why, and what you can do about it. It follows the Swiss Federal Act on Data Protection (FADP) and, for visitors in the EU, the EEA and the UK, the GDPR and the UK GDPR.

Who is responsible

The controller is the operator named in the imprint. For any privacy question or request, write to contact@ddscale.com.

What we collect, and why

When you visit

Server logs. Our hosting provider records technical data for every request: IP address, date and time, the page requested, the referring page, and browser and device type. We use it to deliver the site and keep it secure. Fonts and images are served from our own domain, so opening a page sends no request to a font or image provider.

Usage statistics. We count page views and interactions such as clicks on buttons and links, together with the referring page, device type and approximate location (derived from your IP address), to see which pages are useful. Links in our downloads, such as the QR code in the sample report, carry campaign parameters that tell us which source brought a visit. This uses two services and no cookies. One keeps a random identifier in your browser's local storage so that visits from the same browser can be read together. The statistics are not tied to a name or an email address. There is no session recording.

Functional cookies. Prices are shown in your local currency. For that, the site sets ccy (the currency) and geo (the two-letter code of the country your request came from), each for 30 days from your last visit. If you open a link that fixes a currency, ccy and a marker cookie, ccyf, last until you close the browser. No other location data is stored.

Scorecard tool. The scores and notes you enter are saved in your own browser's local storage so they are still there when you return. They are not sent to us. We only count that the tool was used.

When you use the contact form

We receive your name, work email, company or fund, and your message, and use them to answer you and prepare a possible engagement. The form is delivered to our mailbox by an email provider. Your name, email, company and message are not added to our usage statistics. We only count that an enquiry was sent, or failed to send, and from which page.

When you email us

We use your address and the content of your email to reply and to carry out what you ask for.

When you book a call

The calendar on the English and German home pages and on the contact page is provided by a scheduling service and loads from its servers when you open those pages, so it receives your IP address and browser data and may set its own cookies or storage inside the calendar frame. If you book, it processes your name, email, the time you chose and anything you add, and sends the confirmation. We record that a booking was made, not its content.

Client engagements

Data you share for an engagement is not covered by this page. It is governed by the engagement letter and your NDA. The principles are on the data, AI and independence page.

Legal bases under the GDPR and UK GDPR

  • Legitimate interests (Art. 6(1)(f)): running and securing the site, cookieless usage statistics, and answering general emails. You can object at any time.
  • Steps before a contract, and the contract itself (Art. 6(1)(b)): handling enquiries and bookings, and delivering an engagement.
  • Legal obligations (Art. 6(1)(c)): keeping business records.

The functional cookies serve only to show prices in your currency. You are not required to give us any data, but we cannot answer an enquiry without a way to reach you.

Who receives the data

We use the following service providers, each under its contract terms and only for the role shown. We do not sell personal data and do not share it for advertising.

ProviderRoleWhere
VercelHosting, server logs, cookieless page statisticsUSA, delivered from servers worldwide
PostHog (EU cloud)Usage statisticsEU (Germany)
ResendDelivery of contact form messagesUSA
Cal.comScheduling of callsUSA
NamecheapForwarding of email sent to our addressUSA
GoogleMailboxUSA

We may also disclose data to authorities or advisers where the law requires it or where we need to defend legal claims.

Transfers abroad

Some of these providers process data in the USA, and may use sub-processors in other countries. Where a country does not offer a level of protection recognised as adequate by Switzerland, the EU or the UK, the transfer takes place on the basis of an adequacy decision that covers the provider (such as the Swiss-US or EU-US Data Privacy Framework, including its UK extension) or of standard contractual clauses. You can ask us for details.

How long we keep it

  • Enquiries, emails and bookings: kept for as long as we need them to answer you and to manage the relationship that follows, then deleted. You can ask us to delete them sooner at any time.
  • Contracts, invoices and accounting records: ten years, as Swiss law requires.
  • Usage statistics and server logs: for the retention period set by the provider, after which they are deleted or kept only in aggregate.
  • Cookies: 30 days at most. Data in your browser's local storage stays until you clear it.

What we do not do

We set no advertising or cross-site tracking cookies. There is no session recording, no profiling for advertising, no sale of data and no decisions made by automated means alone. The site has no accounts and no newsletter. For that reason it shows no cookie banner.

Your rights

Depending on the law that applies to you, you can ask us for access to the data we hold about you, for a copy in a portable format, for correction or deletion, or for processing to be restricted, and you can object to processing that rests on our legitimate interests. Write to contact@ddscale.com. We answer within 30 days and may ask you to confirm your identity. You can also clear the cookies and local storage for this site in your browser at any time.

If you think we handle your data unlawfully, you can complain to the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or to the data protection authority where you live or work.

Security

The site is served only over an encrypted connection, and access to enquiries and statistics is limited to the operator.

Changes

We update this policy when the site or the law changes. The version on this page is the one that applies.

Last updated: 12 October 2026