roebi Create Privacy Policy CH
Generates a Swiss-law-compliant Datenschutzerklärung for a website, following the revised nDSG (in force since 01.09.2023) and, where the site targets EU visitors, the DSGVO (GDPR).
Disclaimer: This skill produces a best-effort legal text based on your inputs. It is not a substitute for advice from a Swiss lawyer. For commercial operations or sites processing sensitive data, review with a legal professional.
Swiss legal basis (quick reference)
| Law | Relevance |
|---|---|
| nDSG Art. 19 | Duty to inform data subjects at time of collection |
| nDSG Art. 5 lit. j | Definition of data controller (Verantwortlicher) |
| DSGVO Art. 13/14 | Applies if site targets EU residents — stricter than nDSG |
| DSG Art. 12 | Prohibition of unlawful data processing |
Phase 1 — Operator identity
Ask the user:
"Do you already have an Impressum for this website created with
create-impressum-ch-en? If yes, I can reuse the identity data directly."
If yes → import: name-full / company-name, address, email, website-url
If no → collect same fields as Group B of create-impressum-ch-en
Phase 2 — Data processing inventory
Ask each group separately. Wait for answers before proceeding.
Group A — Hosting & infrastructure
"Where is your website hosted?" Examples: GitHub Pages, Netlify, Vercel, Hostpoint, AWS, own server
Store as hosting-provider and hosting-location (country/region if known).
GitHub Pages note: hosted on GitHub (Microsoft) servers, primarily USA. Netlify note: USA. Vercel note: USA. Swiss hosters: Hostpoint, Cyon = CH.
Group B — Web fonts
"Does your website load fonts from an external CDN?" Examples: Google Fonts, Adobe Fonts, Bunny Fonts, or self-hosted
Google Fonts loaded via <link> tag (standard):
- Transfers visitor IP address to Google servers (USA) on every page load
- Google privacy policy: https://policies.google.com/privacy
- Basis: legitimate interest (Art. 6 DSGVO) / nDSG Art. 19
- Mitigation option: self-host fonts (no external request)
Store as fonts-provider: google-fonts | adobe-fonts | bunny-fonts |
self-hosted | none
Group C — Analytics & tracking
"Does your website use any analytics or tracking tools?" Examples: Google Analytics, Plausible, Fathom, Matomo, none
| Tool | Data sent to | Cookies | Privacy-friendly |
|---|---|---|---|
| Google Analytics | Google (USA) | yes | no |
| Plausible | EU servers | no | yes |
| Fathom | EU/CA | no | yes |
| Matomo (self-hosted) | own server | optional | yes |
| None | — | — | ✓ |
Store as analytics-tool and analytics-cookies: yes | no | none
Group D — Contact & forms
"How can visitors contact you? Does the site have any forms?" Examples: email link only, contact form, newsletter signup
| Type | Data collected | Storage |
|---|---|---|
| Email link (mailto:) | none by the site | n/a |
| Contact form | name, email, message | server/email |
| Newsletter | email address | mailing list provider |
Store as contact-method: email-only | contact-form | newsletter | none
If form/newsletter: store form-provider (e.g. Formspree, Netlify Forms, Mailchimp)
Group E — External embeds & third-party services
"Does your website embed or link to any external services that load resources from third-party servers?" Examples: YouTube videos, Vimeo, Google Maps, Claude / AI links, social media buttons, GitHub badges, CDN scripts
Each embed that loads external resources must be disclosed. Claude.ai links (claude.ai/new?q=...) are regular hyperlinks — no data transfer from your server, user clicks voluntarily → no disclosure needed. cdnjs.cloudflare.com scripts → disclose Cloudflare CDN.
Store as embeds[]: list of services
Group F — Cookies
"Does your website set any cookies?"
Purely informational static sites with no analytics and no forms typically set zero cookies. Confirm:
- No analytics → no tracking cookies
- No login → no session cookies
- No consent tool → no consent cookies
Store as uses-cookies: yes | no
If yes: list name, purpose, duration, provider for each cookie.
Group G — EU visitors
"Does your website intentionally target visitors in the EU (e.g. German, French, Italian, Austrian audience)?"
If yes → DSGVO Art. 13 disclosure obligations apply in addition to nDSG. The generated policy will include DSGVO-compatible language.
Store as targets-eu: yes | no | unsure (treat as yes if unsure)
Group H — Language preference
"Should the Privacy Policy be in German only, English only, or both languages?"
Store as output-language: de | en | both
Phase 3 — Generate Privacy Policy
Using collected data, generate the policy using the templates in
references/template-de.md and/or references/template-en.md.
Generation rules
- Include only sections relevant to the actual processing activities found.
- Do not include boilerplate sections for tools/services the site does not use.
- Mark any missing data with
[bitte ergänzen]/[please add]. - For Google Fonts: always mention IP transfer to Google USA and link to Google Privacy Policy.
- For GitHub Pages hosting: mention Microsoft/GitHub as processor, USA transfer.
- If
uses-cookies= no: include a short "No cookies" statement — users appreciate explicit confirmation. - If
targets-eu= yes: add DSGVO Art. 13 rights block (access, erasure, portability, objection, supervisory authority).
Phase 4 — Deliver and advise
- Present the generated Privacy Policy.
- List any
[bitte ergänzen]fields as a checklist. - Remind the user:
"Place this at
/datenschutzor/privacyreachable within one click from every page. Link it from your footer next to the Impressum." - Mitigation tip for Google Fonts:
"To avoid disclosing Google Fonts IP transfers entirely, self-host your fonts. Download from https://google-webfonts-helper.herokuapp.com and serve from your own domain. Then remove the Google Fonts
<link>tag."
Reference files
references/template-de.md— German Datenschutzerklärung templatereferences/template-en.md— English Privacy Policy templatereferences/processing-activities.md— Standard descriptions for common processing activities (hosting, fonts, analytics, forms)references/rights-blocks.md— nDSG and DSGVO data subject rights blocks