Profile · measured
www.kpt.ch
When this home page loads, 3 third-party services load with it - 3 of them are based in a country without generally recognised data protection. These services typically receive at least your IP address.
Where the data flows
Legend:
OWN INFRASTRUCTURE ·
SEAT WITH RECOGNISED DATA PROTECTION ·
SEAT WITHOUT GENERALLY RECOGNISED PROTECTION
The seat shows which data-protection law applies to the provider: recognised countries
offer a level of protection comparable to Switzerland's; elsewhere, protection depends on
contracts and certifications that only the website's own declaration can name. Own
infrastructure means: the data stays with the website itself.
Measured
3 embedded third-party services
- Google (statische Inhalte/Fonts) Content delivery US www.gstatic.com
- Google reCAPTCHA Security US www.google.com
- Google Tag Manager Tag management US www.googletagmanager.com
What do the categories mean?
Content delivery: Delivers parts of the website from a third-party network.
Security: Protects the website, for instance against automated attacks.
Tag management: A tool that can load further services – what it loads is invisible to this measurement.
Also observed
2 further external hosts
External addresses the page embeds that could not be attributed to a known service – often the organisation's own delivery networks.
- cdn.ablyft.com
- www.google.com
Declaration file found
Nearly there: the file does not pass the standard check yet
A file exists at /.well-known/datenfluss.json – but it does not yet pass
the check against standard v0.1. That is not an accusation, it is a route description:
once the points below are fixed, this profile carries the DECLARED mark. (Findings are
reported in German, the specification's normative language.)
- Datei ist kein gueltiges JSON-Objekt (Expecting value: line 1 column 1 (char 0))
The generator produces a guaranteed-conformant file; the open validator checks any file locally.
Is this your website?
Add your own side of the story
This page only shows what is measurable from the outside. Your declaration shows what you actually do – purposes, recipients, retention periods, and the way to exercise the right of access.
The generator walks you through every question in 20 to 45 minutes and produces the finished file. Free, no sign-up, and your input never leaves your browser. Once the file is on your domain, it appears here after the next weekly run.
Create a declaration (currently in German) →
Something in this measurement is wrong? An e-mail to kontakt@datenfluss-standard.ch is enough – we correct it, or remove the profile entirely on request.
Good to know
When a third-party service loads, its server typically receives at least your IP address – without you clicking anything.
For customers
From knowing to acting
Do you like this business? Recommend the mark to them - as a note between customers, not as criticism. The text is prepared; for the business, declaring is free of charge.
Want to know what this company has stored about you? The right of access (Art. 25 FADP) obliges it to answer you within 30 days - generally free of charge. The request is prepared.
Both buttons open your own mail program; you add the recipient address yourself. Nothing passes through this register - we see and store none of your input.
Transparency about this measurement
Method and corrections
How this was measured: a single fetch of the home page on
2026-08-17, without executing JavaScript. The scanner honours robots.txt and
identifies itself as DatenflussScanner/0.1. It recognises statically
embedded resources of known providers.
What the measurement cannot do: see dynamically loaded services, check sub-pages, say where data is actually processed (the provider's seat does not tell), or judge whether an embedding is lawful. The finding is a lower bound, not a rating.
Something wrong? We are happy to correct it – a message to kontakt@datenfluss-standard.ch is enough. On request we also remove a profile entirely.
Raw data: measurement profile as JSON