Our principle: your vault's data stays with you
LEGATEM is designed so that your vault's data never reaches us. Your vault's content is encrypted and saved only on your device. We do not collect, view or store it. We have no access to your password.
Data we process
Only the data needed for sales and support is processed: name, e-mail address, order and billing data (including the name you provide to personalise your file and the licence number assigned), messages you send us, and the technical logs of our website's server (IP address, date, page requested). Card or TWINT data is processed by Stripe and never reaches us. No vault data is involved.
Legal bases and framework
Two situations must be distinguished: the content of your vault, which only you process, and the data relating to your purchase and our exchanges, which we process.
1. The content of your vault: processed by you alone. What you record in your vault (including information about your relatives, your health or your wishes) is encrypted and saved only on your device. LEGATEM has no access to it and is therefore not its controller. You process this data for your personal use, which in principle falls outside the scope of the Swiss Federal Act on Data Protection (Art. 2(2)(a) FADP) and of the GDPR (Art. 2(2)(c) GDPR). The application is built on the principle of data protection by design and by default (Art. 7 FADP; Art. 25 GDPR): no vault data leaves your device, and the application makes no outside connection.
2. Your purchase data and our exchanges. When you buy LEGATEM or write to us, LEGATEM is the controller of the data needed: name, e-mail address, order and billing data, the content of your messages. This processing is governed by the Federal Act on Data Protection (FADP, SR 235.1) and its ordinance (DPO, SR 235.11). We follow the principles of lawfulness, good faith, proportionality, purpose limitation and accuracy (Art. 6 FADP) and process this data only:
- to conclude and perform the sale and licence agreement, and to support you (Art. 31(2)(a) FADP; Art. 6(1)(b) GDPR);
- to send you service messages relating to your purchase (delivery, security fixes, subscription, billing), never advertising (Art. 31(2)(a) FADP; Art. 6(1)(b) GDPR);
- to meet our legal obligations, notably for accounting (Art. 958f of the Swiss Code of Obligations; Art. 6(1)(c) GDPR);
- to send you the information you asked for, based on your consent, which you may withdraw at any time (Art. 6(1)(a) GDPR).
We do not sell, rent or transfer any data, and we carry out no profiling and no automated individual decision-making.
3. Geographic scope. LEGATEM is sold in Switzerland. Should the GDPR apply to your situation (Art. 3 GDPR), you have the rights set out in Articles 15 to 21 GDPR and may lodge a complaint with the supervisory authority of your country.
4. Providers and transfers abroad. Our website and e-mail are hosted in Switzerland by Infomaniak. Payments are processed by Stripe (Stripe Payments Europe, Limited, Dublin, Ireland), which receives your payment data directly and is responsible for it in its own right; LEGATEM keeps none of it. Ireland is among the countries the Swiss Federal Council recognises as offering adequate protection; Stripe may have some data processed by its group companies in the United States. If data must be disclosed to a country whose legislation does not ensure an adequate level of protection, we do so only with the safeguards provided by law, for example standard contractual clauses (Art. 16 and 17 FADP; Art. 44 et seq. GDPR).
5. Security and breaches. We take technical and organisational measures appropriate to the risk (Art. 8 FADP; Art. 32 GDPR). If a breach of the security of the data we process is likely to result in a high risk to you, we report it to the Federal Data Protection and Information Commissioner (FDPIC) and, where necessary, to the people concerned (Art. 24 FADP; Art. 33 and 34 GDPR). The content of your vault, for its part, is not in our possession.
6. Supervisory authority. In Switzerland: the Federal Data Protection and Information Commissioner (FDPIC), Bern, edoeb.admin.ch. In the European Union: the data protection authority of your country.
Retention
We keep data for as long as needed for the purposes set out above or as required by law, in particular for accounting records (Art. 958f of the Swiss Code of Obligations).
Your rights
You may ask for access to your data (Art. 25 FADP), its rectification (Art. 32 FADP), its erasure where no legal obligation requires us to keep it, its delivery in a common format (Art. 28 FADP), and you may object to processing. Write to contact@legatem.ch; we reply within the time limits set by law. You may also contact the FDPIC or, in the European Union, the authority of your country.
Cookies
The application sets no cookies and uses no trackers. It only keeps, in your browser, the language you chose and the auto-lock delay; while in use, the tab holds an encrypted copy of the vault and a few technical details, erased when the tab is closed. The legatem.ch website uses no advertising cookies and no audience-measurement tool; it only keeps, in your browser, the language of the page you viewed. Stripe's payment page uses its own cookies, needed for payment and fraud prevention.