In compliance with the General Data Protection Regulation (GDPR / DSGVO). Last updated August 2026.

1. Controller

The controller (Verantwortlicher) within the meaning of Art. 4 (7) GDPR is:

DigitalFreedom Global LLC (trading as DigitalFreedom)
30 N Gould St, Ste N
Sheridan, WY 82801, United States
General contact: hello@digitalfreedom.co.za
Data protection: data-protection@digitalfreedom.co.za

2. Scope of This Policy

This policy covers personal data processed in connection with this website (marcelrgberger.com), its newsletter, and any direct contact with the controller via email.

The controller is established in the United States. We apply the GDPR as our global baseline for every visitor, regardless of where they are located, and we additionally comply with the data-protection law of your own jurisdiction where it is more protective. Data you send us directly (for example by email) is therefore processed in the United States; the processors named below (GitHub, Google, Cal.com, Apple) process data in their own regions as described in each section.

3. Hosting and Logs

This site is hosted on GitHub Pages, operated by GitHub, Inc. When you visit the site, your IP address and basic request metadata may be processed by GitHub to deliver the page and protect against abuse. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in providing a stable service).

4. Cookies

This site sets no analytics cookies before you give consent via the cookie banner. After you click "Accept", the following is loaded:

Google Analytics (see section 5)

Clicking "Reject" prevents it. Your choice is stored in localStorage on your device and can be changed at any time by clearing local site data.

Independently of that choice, the Cal.com booking calendar is embedded on the home page. It loads as soon as the page opens, including when you reject, and may set technically necessary cookies. Section 6 explains why and on what basis.

5. Google Analytics 4 with Consent Mode v2

This site uses Google Analytics 4 (operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) for aggregated traffic measurement. We implement Google Consent Mode v2, meaning the tag is loaded on every page, but consent state is set to denied by default for all categories. Only after you click "Accept" in the cookie banner is analytics_storage updated to granted.

Before consent (cookieless pings): while consent is denied, Google still receives so-called cookieless pings, without cookies, without a client ID, without persistent identifiers. They contain only aggregated, non-identifying signals (page URL, anonymised geolocation at country level, browser/device class). These pings rely on Art. 6 (1) (f) GDPR (legitimate interest in basic aggregated reach measurement).

After consent (full analytics): once you accept, a client ID cookie is set, full event data is collected, and standard Google Analytics tracking runs.

Legal basis: Art. 6 (1) (a) GDPR + § 25 (1) TTDSG for cookie-based analytics after consent; Art. 6 (1) (f) GDPR for the cookieless ping in denied state.
Data processed: page URL, referrer, anonymised IP, device/browser metadata, interaction events. After consent additionally: client ID cookie, session ID, full event parameters.
Purpose: traffic measurement to understand which content reaches an audience.
Retention: 14 months for event-level data (GA4 default); aggregated reports indefinitely.
International transfer: Google Ireland processes data within the EU and may transfer to the United States. Google LLC is certified under the EU-US Data Privacy Framework (DPF), providing an adequacy decision under Art. 45 GDPR.
Withdrawal: change your choice at any time via the cookie settings link in the footer, or use a browser-level opt-out / ad-blocker. The Google opt-out browser add-on is available at tools.google.com/dlpage/gaoptout.

Google's own privacy policy: policies.google.com/privacy.

6. Booking a call (Cal.com)

The booking calendar from Cal.com (Cal.com, Inc., USA) is embedded directly on the home page. This means a script from app.cal.com is loaded when you open the page, and your IP address is transmitted to Cal.com in the process. This happens as soon as you view the page, not only when you book. Cal.com may set technically necessary cookies in this context.

If you book a slot, Cal.com additionally processes what you enter in the calendar, typically your name, email address, and your description of the topic.

Legal basis for embedding: Art. 6 (1) (f) GDPR, legitimate interest in offering booking without an intermediate step.
Legal basis for the booking: Art. 6 (1) (b) GDPR, steps taken at your request prior to entering into a contract.
Purpose: showing available times, arranging and holding the call.
Transfer outside the EU: Cal.com, Inc. is based in the United States. The transfer relies on the European Commission's Standard Contractual Clauses.
Storage: until the matter is dealt with, then within statutory retention periods.

If you want to avoid the transfer, do not open the home page or block app.cal.com in your browser. The calendar is the only place on this site where Cal.com is loaded.

Read Cal.com's privacy policy at cal.com/privacy.

7. Embedded Content

App icons and metadata shown on this page may be loaded from Apple's App Store CDN (is1-ssl.mzstatic.com) and GitHub's API (api.github.com). These third-party services may process your IP address when their resources load. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in showing accurate product data).

8. Direct Contact

If you contact us by email, your message and contact details will be stored for the purpose of processing your request and for follow-up. Legal basis: Art. 6 (1) (b) GDPR (pre-contractual / contractual processing) or Art. 6 (1) (f) GDPR (legitimate interest in responding).

9. Your Rights

Under the GDPR you have the right to:

Access (Art. 15), request a copy of the data we process about you.
Rectification (Art. 16), correct inaccurate data.
Erasure (Art. 17), request deletion of your data.
Restriction (Art. 18), request restriction of processing.
Portability (Art. 20), receive your data in a structured machine-readable format.
Object (Art. 21), object to processing based on legitimate interest.
Withdraw consent (Art. 7), at any time, with effect for the future.
Complain (Art. 77), with the competent supervisory authority in your EU/EEA member state of residence, place of work, or of the alleged infringement. In the United Kingdom this is the Information Commissioner's Office (ICO).

To exercise any of these rights, email data-protection@digitalfreedom.co.za.

10. Data Protection Officer

A formal DPO has not been appointed; the controller does not meet the threshold criteria for mandatory appointment under Art. 37 GDPR / § 38 BDSG. For all data-protection inquiries please email data-protection@digitalfreedom.co.za.

11. Changes to This Policy

We may update this policy when our processing changes or when laws require it. The current version is always available on this page. Material changes will be announced via the newsletter where appropriate.

Privacy Policy