Privacy Policy

Last updated: 6 November 2026

This policy explains what personal data I collect when you use tomkranz.com, subscribe to my newsletter Ambulance Chasing, send me a message through the contact form, or book a call with me, what I do with it, and what rights you have. I have tried to write it in plain English.

1. Who I am

I am Thomas Kranz, an independent cybersecurity consultant and author, and I am the data controller for the personal data described in this policy. That means I decide why and how it is used.

Name: Thomas Kranz
Email: tom@tomkranz.com
VAT number (Partita IVA): IT02644000065
D-U-N-S number: 441520875
Address: via Mulino 8, Grognardo, 15010 AL

I am based in Italy, so the EU General Data Protection Regulation (GDPR) and the Italian data protection code (Codice Privacy, D.Lgs. 196/2003 as amended) apply to me.

I have not appointed a Data Protection Officer because I am not required to, so you can write to me directly at the address above.

2. What I collect, why, and on what legal basis

Newsletter. Your email address, the date and source of your sign-up, your IP address, and basic email-engagement data such as whether an email was opened or a link clicked. I use it to send you Ambulance Chasing, confirm your subscription, handle unsubscribes and keep a record that you agreed. The legal basis is your consent (Article 6(1)(a) GDPR), which you can withdraw at any time.

Contact form. Your name, email address, the message you write, and anything else you choose to tell me. I use it to read and reply to your enquiry, including media, speaking and consulting enquiries. The legal basis is my legitimate interests in answering the people who contact me (Article 6(1)(f)), and where your enquiry is about a service you want, steps taken at your request before a contract (Article 6(1)(b)).

Booking a call (Calendly). Your name, email address, the time you choose, your time zone, and anything you type into the booking questions. I use it to schedule and run the call, send reminders and prepare for it. The legal basis is steps taken at your request before a contract (Article 6(1)(b)), and my legitimate interests in running my diary.

Clients and enquirers. Details of our correspondence, proposals, any contract and invoices. I use them to provide my services, keep accounts and meet legal obligations. The legal basis is contract (Article 6(1)(b)), legal obligation (Article 6(1)(c), for example tax records) and legitimate interests.

Website visits. Your IP address, browser and device type, the pages you view, and the date and time, collected in server logs by Squarespace. I use it to keep the site secure and working. The legal basis is my legitimate interests in running a safe website (Article 6(1)(f)).

Analytics. If you accept analytics cookies, Google Analytics and Squarespace Analytics record how you use the site (pages viewed, time on page, approximate location, device, browser and how you reached the site). I use it to understand which content is useful. The legal basis is your consent (Article 6(1)(a)), and nothing is collected for this purpose if you decline.

Spam protection. Data about your browser and how you interact with the contact form, handled by Google reCAPTCHA. I use it to stop bots and spam. The legal basis is my legitimate interests in protecting the site.

I do not collect special category data (such as health, religion or political opinions) on purpose, and I do not use any of this for automated decision-making or profiling that affects you. Please do not put sensitive personal data in the contact form.

3. Cookies and similar technologies

When you first visit the site, a banner asks whether you accept cookies. Cookies that are strictly necessary to deliver the site securely and keep it working are always used. Everything else, including analytics, is switched on only if you click Accept all. If you click Decline non-essential, those cookies are not set. You can change your choice at any time with the Cookie Preferences button at the bottom of the page.

Necessary cookies. Squarespace, which hosts this site, sets cookies that are needed for security, load balancing and basic site functions. These do not need your consent.

Analytics cookies (only with your consent). I use Google Analytics 4 and Squarespace's own analytics to understand how visitors use the site, for example which pages are read and roughly where in the world readers are. Google Analytics sets cookies, collects your IP address, device, browser and page-view data, and shares it with Google. The legal basis is your consent (Article 6(1)(a) GDPR and Article 122 of the Italian Codice Privacy), and you can withdraw it at any time using the Cookie Preferences button.

Squarespace publishes a full list of the cookies it uses at support.squarespace.com (search for "Cookies and the Squarespace platform"). Google explains how Google Analytics handles data at policies.google.com/technologies/partner-sites.

Adobe Fonts loads typefaces from Adobe's servers, so your IP address is sent to Adobe when a page loads.

Some pages link to other sites such as LinkedIn, YouTube, Medium, GitHub and Bluesky. Those sites may set their own cookies once you click through to them, and their own privacy policies apply.

You can control cookies in your browser settings and delete any that have already been set.

4. Who I share your data with

I do not sell your personal data and I do not share it for advertising. I use a small number of service providers (called processors) who handle data only on my instructions and under data processing terms:

Squarespace, Inc. hosts the website, the contact form, the site analytics and the email notifications from the contact form. Data may be held in the United States and Ireland.
Buttondown stores the newsletter list, sends Ambulance Chasing, and runs the sign-up form and the public archive. Data is held in the United States.
Calendly runs the booking page and sends calendar invitations and reminders. Data may be held in the United States.
Google provides Google Analytics (only if you accept analytics cookies) and reCAPTCHA on the contact form. Data may be held in the United States and elsewhere. Gmail is covered separately in the next point.
Adobe serves the site's typefaces through Adobe Fonts. Data may be held in the United States and elsewhere.
Google (Gmail) receives the contact-form notifications and your emails to me, and stores my email correspondence. Data may be held in the United States and elsewhere.

I may also share personal data where the law requires it (for example with tax authorities, a court or a regulator), or to protect my legal rights.

If we work together on a consulting project, I may also use a video-call, document-sharing or invoicing tool, and I will tell you which before you share anything confidential.

5. Transfers outside the EU

Several of these providers are based in the United States, so your data may be transferred outside the European Economic Area. Where that happens, I rely on safeguards such as the EU-US Data Privacy Framework (where the provider is certified under it) or the European Commission's Standard Contractual Clauses, which these providers include in their terms. You can ask me for more information about these safeguards using the email address above.

6. How long I keep your data

Newsletter subscription: until you unsubscribe. After that, Buttondown keeps a minimal record that you opted out so that you are not added again by mistake.
Contact form messages and emails (held in Gmail and Squarespace): up to 24 months after the last message, unless it becomes a client relationship.
Booking records (Calendly): up to 24 months after the call.
Client records, contracts and invoices: as long as the law requires. In Italy, accounting records must be kept for 10 years.
Website logs and analytics: server logs are kept by Squarespace for a short period. Google Analytics data is kept for 14 months.

After that I delete the data or anonymise it.

7. Your rights

Under the GDPR you have the right to:

be informed about how I use your data (this policy)
access the personal data I hold about you and get a copy
have wrong or incomplete data corrected
have your data erased, in the cases the law allows
restrict how I use your data in some cases
object to processing that is based on my legitimate interests
receive the data you gave me in a structured, commonly used format (data portability), where I process it by consent or contract
withdraw your consent at any time, for example by using the unsubscribe link at the bottom of every newsletter or by emailing me. This does not affect anything I did before you withdrew.

To use any of these rights, email tom@tomkranz.com. I will reply within one month, and I may need to check who you are first. It is free, unless a request is clearly unfounded or excessive.

8. Complaints

If you are unhappy with how I have handled your data, please tell me first so I can put it right. You also have the right to complain to a data protection authority:

In Italy: the Garante per la protezione dei dati personali (garanteprivacy.it)
In the UK, if you live there: the Information Commissioner's Office (ico.org.uk)
Or the authority in the country where you live or work

9. The newsletter in more detail

By signing up with Buttondown's form you agree to receive Ambulance Chasing. I will send you the newsletter, and occasionally a message about the newsletter itself, such as a change of address or a confirmation request. You may be asked to confirm your address by email before you are added.

Every email has an unsubscribe link, and one click is enough to stop it. Some issues include links to my services or my books, because they relate to the topics covered. I do not send you unrelated marketing and I do not pass your address to anyone else. The public archive of past issues does not show subscriber data. Buttondown handles your data under its own privacy policy and data processing terms, at buttondown.com/legal/privacy.

10. The contact form and booking a call

Messages sent through the contact form are stored by Squarespace and emailed to me. I use them only to reply to you and to keep a record of the conversation.

If you book a call through Calendly, Calendly collects your details, adds the event to my calendar, and emails you and me. If I connect a video-call link such as Zoom or Google Meet, that service's own privacy policy applies to the call itself. I do not record calls unless I ask you first and you agree.

The form and the booking page are not meant for children. If you are under 16, please do not use them.

11. Security

I use reputable providers, two-factor authentication on the accounts that hold your data, and access controls, and I limit who can see your data. No online service is completely secure, but if a breach affecting your data occurs I will tell you and the relevant authority as the law requires.

12. Links to other sites

My site links to other websites, for example LinkedIn, Medium, GitHub, and the Manning, NVIDIA and Amazon book pages. I am not responsible for their content or how they handle your data, so please read their privacy policies.

13. Changes to this policy

I may update this policy as my website or the law changes. The date at the top shows when it was last updated, and for any significant change that affects newsletter subscribers I will say so in an issue.