Your Website Is Business Data Too: Why DSG Compliance Starts on Your Homepage
Your marketing site collects leads, uses cookies, and stores customer data — which means Swiss DSG and GDPR rules apply. Here's how an AI-built, integrated website keeps you audit-ready.
When Swiss SMEs think about compliance, they think about the OR bookkeeping obligations, MWST filings, and the revised Federal Act on Data Protection (DSG). Rarely does anyone think about the marketing website. Yet the website is often the very first place a business collects personal data — through a contact form, a newsletter signup, or a quote request. If that website lives on a separate platform, disconnected from the rest of the business, it quietly becomes a compliance blind spot.
The Website Is a Data Processor — Whether You Treat It Like One or Not
Under the revised DSG (and GDPR, if you serve EU visitors), any tool that collects names, emails, or IP addresses is processing personal data. That includes:
- Contact and lead capture forms
- Cookie-based analytics tracking visitor behavior
- Newsletter signups feeding an external mailing tool
The law expects a business to know where that data goes, who can access it, how long it is kept, and whether visitors were properly informed via a privacy notice and consent mechanism. In practice, most SMEs cannot answer these questions with confidence, because the website was built years ago by an agency, sits on a WordPress install nobody dares touch, or runs on a Webflow seat only one person can log into. The data trail between "visitor filled out a form" and "sales rep followed up" is manual, undocumented, and easy to lose track of.
Where Manual Website Setups Create Risk
A few recurring gaps show up again and again in fiduciary reviews and internal audits:
- Consent banners bolted on as an afterthought, often misconfigured, sometimes missing entirely on secondary language versions of the site.
- Leads captured on the website but copy-pasted into a CRM by hand — or not copied at all, leaving personal data sitting in an email inbox with no retention policy.
- Third-party analytics scripts that drop cookies before consent is given, a common and easily overlooked DSG/GDPR violation.
- No clear data residency or tenant isolation when the website vendor is a generic international SaaS with no visibility into where visitor data is actually stored.
- Inconsistent multi-language legal texts — a French or Italian version of the site that never got the updated privacy policy the German version has.
None of these are exotic problems. They are the ordinary result of running your public-facing website as an island, separate from the systems — CRM, accounting, HR — that the rest of the business actually governs and audits.
Bringing the Website Into the Same Compliance Perimeter
Flitz treats the company website as part of the same workspace as your books, customers, and deals — not a separate subscription with its own rules. That has direct compliance consequences.
Consent and analytics, built in correctly from day one
The public site ships with a GDPR-style cookie-consent banner and cookieless page-view analytics by default. You are not relying on a plugin someone installed once and forgot about; the privacy posture is part of how the site is built, not an add-on.
Leads that never touch an unmanaged inbox
Lead capture forms are wired directly into the CRM. A form submission becomes a CRM lead the moment it happens — no manual copy-paste, no personal data parked in someone's mailbox waiting to be actioned or forgotten. That single change closes one of the most common audit findings: "where did this person's data go after they submitted the form?"
Multi-language, done consistently
Every page and post is translatable per locale, with locale-aware navigation. If your privacy notice or terms update, they update everywhere the site is published — not just in the language someone remembered to edit.
Tenant isolation, not a shared black box
Like everything in Flitz, the website is tenant-isolated. You are not sharing infrastructure assumptions with thousands of unrelated WordPress installs or guessing at where a generic site builder actually stores your visitor data.
SEO and technical hygiene without extra tooling
Site-wide SEO defaults, generated sitemap.xml, robots.txt, and llms.txt, automatic HTTPS on your own custom domain — the technical baseline auditors and customers expect is there without a separate agency contract to maintain it.
What This Means for Audit-Readiness
Being audit-ready is not about having a perfect website. It is about being able to answer, on demand: what personal data do we collect, where does it go, who can see it, and how is consent handled. When your website runs in the same workspace as your CRM and is subject to the same tenant isolation as your accounting data, those answers are structural rather than something you reconstruct under pressure. The AI page editor and AI blog writer mean content still moves fast — describe a page in a sentence, ask for a blog post, publish — but the compliance groundwork underneath does not depend on someone remembering to configure it correctly.
One less subscription, one less login, and your site finally lives next to the data it is supposed to reflect — including the data protection rules that already apply to the rest of your business.
For Swiss SMEs juggling OR bookkeeping duties, MWST deadlines, and DSG obligations, the marketing website should not be the one system nobody in the business actually governs. Bringing it inside the same platform as your books and your CRM turns an overlooked risk into just another well-documented part of how the business runs.