How Fixly processes personal data, in accordance with the Swiss Federal Act on Data Protection (FADP).
Roles
The client organisation is responsible for the data of its buildings, tenants and vendors; the operator processes it on its behalf. The operator is responsible for user account and billing data.
Data processed
Accounts (name, e-mail, language, role, sign-ins), data entered by the organisation (buildings, units, occupants, vendors, tickets, photos, amounts), tenant reports (name, contact, description, photos; IP address stored only as a hash), technical and security logs.
Purposes
Providing the service, authenticating users, sending requested e-mails (work orders, invitations, reports), billing, securing the platform and preventing abuse.
Hosting and providers
Data is hosted in Switzerland. Providers used depending on configuration: e-mail delivery, payment (Stripe), bot protection (Cloudflare Turnstile).
Backups and retention
The entire site is backed up on two cycles: a copy every hour, when data has changed, of which the latest 24 are kept on a rolling basis (at least 24, each new copy replacing the oldest), and a backup every day, of which the latest 7 daily backups are kept (about 7 days, 7 by default); the oldest are deleted. Backups serve to restore the service; they are not an archive from which items can be requested one by one. Data entered since the last backup (up to one hour of activity) cannot be restored in the event of an incident. Data are kept as long as the account exists, then deleted within a reasonable period, subject to legal obligations.
Operator access
For support, security and legal compliance, the operator may view organisations’ data through a reserved administration account, read-only by default. Every view is logged (date, organisation, screen viewed, masked IP address) and the log is kept out of reach of the application. If the operation is transferred, the transferee takes over the data protection obligations (FADP).
Controller
The operator named at the bottom of this page is the controller for account, billing and support data. For the data entered by a customer organisation (buildings, tenants, contractors), the organisation is the controller; the operator processes them on its behalf. Contact: the operator’s address below, or “Send a message” in the account menu.
Legal bases
Performance of the contract (providing the service, billing, sending the e-mails requested), legitimate interest (platform security, abuse prevention, technical logs) and legal obligations (keeping accounting records). No separate consent is requested for the operation of the service.
Sub-processors and transfers
Hosting: Infomaniak Network SA (Switzerland). E-mail delivery: SMTP provider configured by the operator. Payments: Stripe (United States / Ireland). Bot protection: Cloudflare Turnstile (United States). Transfers outside Switzerland and the EU rely on the European Commission’s standard contractual clauses or the Data Privacy Framework. No other third-party service is called and no audience measurement is used.
Retention periods
Data are kept according to the table below.
| Data | Period |
|---|---|
| Active account and data entered | term of the contract |
| Closed account (archive) | grace period: 14 days, then deletion |
| Hourly copies | latest 24 copies (at least 24), rolling |
| Daily backups | 7 days (7 by default), rolling, at Infomaniak, encrypted by default |
| Technical and security logs (IP address) | 12 months at most |
| Log of e-mails sent | 12 months at most |
| Operator’s accounting records | 10 years (art. 958f CO) |
| Register of closed accounts | unlimited, minimal (name, dates) |
Account deletion
In “My account”, after a new authentication: the account is closed immediately, an archive is kept for 14 days during which the deletion can be cancelled (link sent by e-mail), then the data and the archive are permanently deleted. A reminder is sent 2 days before deletion.
Data breach
In the event of a data security breach posing a high risk, the operator reports it as soon as possible to the Federal Data Protection and Information Commissioner (FDPIC) and informs the customer organisations concerned.
Your rights
You may request access to your data, their rectification, their deletion and their delivery in a common format. Self-service in “My account”: “Download my data” (ZIP in JSON and CSV with the uploaded files, link valid for 24 h), profile changes and account deletion. A request sent to the operator is handled within 30 days. For data managed by a customer organisation (tenants, contractors), contact it first. Competent authority in Switzerland: the FDPIC (www.edoeb.admin.ch); in the EU, the data protection authority of your country.
Operator
Leologic (sàrl)
CP 225
2740 Moutier
info@leologic.ch
www.leologic.ch
A daily backup of the entire site is performed by the hosting provider. Data entered since the last backup may be lost in the event of an incident; within the limits of the law we are not liable for it. Keep your own exports.