Last updated: 21 October 2026

This page explains how personal data is handled on tmz.it, in line with the EU General Data Protection Regulation (GDPR) and German data protection law.

Who is responsible

The data controller is Thomas Marco Zimmermann, Südstr. 27, 52064 Aachen, Germany. You can write to me at thomas@tmz.it.

What data is processed

• Technical data when you visit. Like any website, tmz.it is served by a hosting provider that receives your IP address, browser type, requested page and time of the request. This is needed to deliver the site and keep it secure.
• Approximate country. The hosting provider tells the site which country a request comes from. It is used only to point shopping links to the right Amazon store (amazon.it or amazon.de). It is not stored.
• Your cookie choice. If you accept or decline cookies, that choice is saved in a small cookie so you are not asked again (see the Cookie Policy).
• Visit statistics, only with your consent. If you accept analytics, Google Analytics 4 measures how the site is used (pages viewed, approximate location, device, source of the visit). If you decline, it is not loaded.
• Contact form. See the section below.
• Email. If you write to me at thomas@tmz.it, I receive your address and what you send, and use it only to answer you.
• Amazon links. The Books section contains affiliate links. As an Amazon Associate I earn from qualifying purchases. When you click, you leave this site and Amazon processes your data under its own privacy notice. I do not receive your purchase details, only aggregated commission reports.

Contact form

• Data you enter: your name, email address, your message and any other fields shown in the form.
• Data recorded with it: your IP address (used for spam protection and rate limiting), the time, the page you sent the form from, how you arrived on the site (landing page, referring site and campaign tags, kept in your browser only for the visit and read only when you send the form), the number of pages viewed, your device type, and your approximate country, region and city as reported by the hosting provider.
• Purpose: to answer your request.
• Legal basis: Art. 6(1)(b) GDPR where your request concerns a possible contract, otherwise Art. 6(1)(f) GDPR, my legitimate interest in answering enquiries and protecting the form from abuse.
• Where it is stored: in a database run by Supabase, hosted in the EU (Ireland), which acts as my processor. I am notified of each message by email, sent through Resend.
• Spam protection: a hidden field that people never see, a minimum time to fill in the form, and a limit on how many messages one address can send per hour. No CAPTCHA and no third-party tracking is used for this.
• Retention: messages are deleted when they are no longer needed to answer you, and at the latest 12 months after they were sent, unless the law requires me to keep them longer.

Legal bases

• Delivering and securing the site: legitimate interest (Art. 6(1)(f) GDPR).
• Remembering your cookie choice: strictly necessary so the site respects your choice (§ 25(2) TDDDG; Art. 6(1)(f) GDPR).
• Google Analytics: your consent (Art. 6(1)(a) GDPR and § 25(1) TDDDG). You can withdraw it at any time through "Cookie settings" in the footer.
• Answering your messages: Art. 6(1)(b) or (f) GDPR.

Who processes data on my behalf

• Vercel Inc. hosts the site, with functions running in Europe (Dublin).
• Sanity AS stores the website content and delivers images.
• Supabase provides the database for contact form messages and the sign-in of the platform the site runs on (Abluo). Hosted in Ireland.
• Resend sends the notification email about contact form messages.
• Google Ireland Ltd / Google LLC provides Google Analytics, only after your consent.

Transfers outside the EU

Some providers are US companies (Vercel, Resend, Google, and Amazon for its own processing). Transfers rely on the EU-US Data Privacy Framework where the provider is certified, or otherwise on the EU Standard Contractual Clauses.

How long data is kept

• Cookie choice: up to 12 months.
• Server logs: kept by the hosting provider only for a short period, according to its settings.
• Google Analytics: event data is kept for 2 months.
• Contact form messages: see above, at most 12 months.
• Emails: as long as needed for the exchange, and as long as statutory retention duties require.

Your rights

You can ask for access, correction, deletion, restriction or portability of your data, object to processing based on legitimate interest, and withdraw consent at any time, by writing to thomas@tmz.it.

Complaints

You have the right to lodge a complaint with any data protection supervisory authority. The authority responsible for me is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW), Kavalleriestr. 2-4, 40213 Düsseldorf, Germany, www.ldi.nrw.de.

Children

This site is not aimed at children, and I do not knowingly collect data from them.

Changes

If something changes, for example a new tool is added, I will update this page and its date.