Lexia · Legal information
Security and privacy
This policy explains data, purposes and safeguards for the Lexia public website, contact and free-trial requests, and their relationship with fiduciary services. It follows the Swiss data-protection framework and does not replace the application’s or ERP’s own terms.
1. Scope, controller and contact
Lexia is the brand shown on this website. Contact contact@lexiapps.ch about privacy or security. The operator’s full legal identity and postal address still need to be completed in the legal notice before public publication.
This policy distinguishes browsing, email correspondence and data entrusted to application services. Swiss data-protection law protects personal data relating to natural persons, including information contained in company and fiduciary client files.
2. Website data and purposes
Browsing involves technical data needed to deliver pages and protect the service, such as IP addresses, browser information and request times. Hosting logs are separate from audience statistics.
These processes deliver the website, answer requests, prevent abuse and understand usage. Website analytics are not a decision tool for subscription eligibility or a client’s financial position.
3. Contact and free-trial requests
Trial buttons open your email application; a message is sent only when you choose to send it. We process the contact, organisation and message details you provide to reply and, where relevant, prepare a trial or contract.
Provide only information needed for your request. Do not send passwords, payroll files or confidential client documents through ordinary email. Agree an appropriate channel and service terms first.
4. Cookies and audience measurement
The necessary lexia_consent cookie remembers your choice for 180 days. Optional cookie-based enhanced analytics remain disabled until you agree. Change your choice through the footer’s cookie settings.
Before consent and after refusal or withdrawal, no audience measurement or IP/browser-derived visitor fingerprint is used. Technical logs and security rate limits are separate and serve only to provide and protect the service.
Details of events, cookies and retention appear below and in the cookie policy. Rejecting optional cookies does not prevent browsing.
5. Security measures and limits
The website’s deployment configuration provides for HTTPS and restrictions on content loading. Fonts are served with the site. The analytics collector is designed to store data outside the public web root and reject cross-origin requests.
Swiss law requires technical and organisational safeguards proportionate to risks. Access must be restricted to authorised people, with configuration and updates managed during operation. No system is invulnerable. This page is not a certification, an application audit or a guarantee of uninterrupted availability.
6. Hosting, recipients and access
The announced website hosting is with Infomaniak in Switzerland; actual operating and logging settings must be confirmed with the operator. Website hosting alone does not establish where all application, email and provider processing takes place.
Recipients may include authorised staff answering requests, hosting or email providers and authorities where disclosure is legally required. Processing by a provider must be governed appropriately and its ability to maintain suitable security checked.
7. International disclosure
Swiss hosting does not guarantee that no foreign access or services are involved. International personal-data disclosure must meet articles 16 and 17 FADP, and required information about destination countries and safeguards must be provided.
This policy does not certify that no international transfer occurs. Providers, processing countries and service-specific safeguards must be identified in the relevant information before the processing concerned.
8. Retention
Cookie choices last 180 days. Analytics are designed to retain aggregates and consented browser hashes for at most 180 days. Session state expires after 30 minutes of inactivity or one hour from its start. Deletion runs during processing or maintenance; backup retention must be limited separately.
Correspondence is kept as needed to handle requests and, where relevant, the contract. Legal retention duties or establishing, exercising or defending rights may justify longer storage. Data must then be deleted or anonymised when retention is no longer justified. Hosting-log retention depends on the service actually configured.
9. Client files, application and ERP
Login leads to app.lexiapps.ch. Website examples and demonstrations are not a repository for real client files. Service terms, access, processing locations and application safeguards need to be examined in that service’s documentation.
Where a fiduciary determines the purposes of mandate-data processing, it retains its controller obligations. If Lexia processes data on its behalf, instructions, confidentiality, providers, security, incidents, return and erasure require an appropriate agreement. The informational data-processing page does not replace it.
AI-assisted extraction requires review before use. The relevant providers, data transmitted, purposes, processing locations and safeguards must be specified in service documentation. The website presentation alone does not establish those arrangements.
10. Your rights
You may request whether and what personal data about you are processed, their purposes and the other information required by Swiss law. Access is generally free and answered within 30 days, subject to legal exceptions. Proportionate identity verification may be necessary.
You may request correction and, where legal conditions are met, erasure, object to processing or request delivery or transmission of certain data. These rights do not remove lawful retention duties or overriding interests recognised by law. Truly anonymised totals do not allow a visit to be identified and isolated.
Send requests to contact@lexiapps.ch. You may also contact the Federal Data Protection and Information Commissioner (FDPIC), without prejudice to other legal remedies.
11. Incidents and reports
Report suspected exposure or a vulnerability to contact@lexiapps.ch without attaching third-party data or secrets and without further exploiting the issue.
Incidents require assessment under applicable obligations. Article 24 FADP requires notification to the FDPIC as soon as possible where a high risk is likely, and information to affected people where necessary for their protection or requested by the FDPIC. A processor must notify its controller as soon as possible.
12. Updates
This policy must follow the processing actually performed. The update date identifies its version. New purposes or material changes to recipients or processing require the relevant information and, where necessary, a renewed choice or agreement.
Related documents
Optional audience measurement
Before consent and after refusal or withdrawal, no audience event is sent. No visitor identifier is derived from IP or browser information. Earlier analytics choices are requested again for this version.
Hosting logs and abuse prevention are separate from audience measurement. A temporary security counter uses an IP hash, without the raw IP or user agent, to limit requests; it is not used to analyse visits. This site installs no visitor counter without consent.
After you consent, we measure distinct browsers, sessions, pages, referring domains and campaigns, device and browser families, language, foreground time, scroll milestones, and contact or outbound link clicks. A browser is not necessarily a person. An email click does not confirm a message was sent.
A random browser identifier, stored as a hash on the server, deduplicates totals without linking a page history. Session state expires after 30 minutes of inactivity or one hour from its start, and is deleted at the next purge. Analytics retain no raw IP, full user-agent string, form content or full referrer URL. Intermediate identifiers are pseudonymous, not necessarily anonymous. No cross-site tracking or advertising.
Aggregates, browser hashes and technical consent records (date and version) are retained for up to 180 days, with purging during processing and maintenance. Request identifiers prevent duplicates for 24 hours, until the next purge. Abuse counters cover a one-minute window; data are replaced on the next request or deleted during maintenance. You can withdraw consent at any time: collection stops and optional cookies are deleted. Previously aggregated data remain until expiry.