Data protection

1. Introduction

Lema is a business management software provided as a SaaS (Software as a Service) and also available as a desktop application. Protecting your data and the data of your customers is a priority for us. We process personal data only to the extent necessary to provide the service, in a lawful, fair and transparent manner.

This notice applies to the Lema website, application and related services. Please read it carefully. If you do not agree with its content, please do not use the service.

2. Data controller

The controller of the personal data, i.e. the entity that decides the purposes and means of processing, is:

• Arcaweb Sagl
• Via Lugano 13, 6982 Agno (Ticino), Switzerland
• Business identification number (UID): CHE-206.419.551
• Phone: +41 (0)79 855 0978
• E-mail: info@arcaweb.ch

For any data protection matter you can contact us at the details above. As we are based in Switzerland and our data is hosted in Switzerland, we are not required to appoint a representative in the European Union; we nevertheless remain available to data subjects residing in the EU/EEA.

3. Key definitions

• "Personal data": any information relating to an identified or identifiable natural person (e.g. name, e-mail, IP address).
• "Processing": any operation performed on personal data (collection, storage, use, disclosure, deletion).
• "Controller": the party that decides the purposes and means of processing (for the website and account: Arcaweb Sagl).
• "Processor": the party that processes data on behalf of the controller. For the data you enter into your workspace (tenant), Arcaweb Sagl acts as processor and you as controller.
• "Data subject": the natural person to whom the personal data relates.

4. What data we collect

4.1 Registration and account data

• User first and last name.
• E-mail address and password (stored exclusively in hashed, encrypted form).
• Language and interface preferences.
• Company name and data of the workspace (tenant) you create.

4.2 Billing and subscription data

• Master and tax data needed to issue invoices.
• Subscribed plan and modules, number of seats.
• Payment (card) data is processed directly by our PCI-DSS certified payment provider (Stripe) and is not stored on our servers.

4.3 Technical and usage data

• IP address, browser and device type, operating system.
• Access and security logs (date, time, actions performed), kept for security and diagnostic purposes.
• Browsing data collected through technical cookies (see Cookies section).

4.4 Content data (uploaded by the customer)

When using Lema you enter data relating to your business: contacts, customers and suppliers, invoices, products, documents, staff data and other management information. With respect to this data we act as processor on your behalf (see section 6).

5. Purposes and legal bases

We process personal data for the following purposes, indicating for each the legal basis under the GDPR (the FADP provides for analogous principles):

• Providing and delivering the service, managing the account and authentication — performance of the contract (Art. 6(1)(b) GDPR).
• Invoicing, accounting and compliance with legal obligations — legal obligation (Art. 6(1)(c) GDPR).
• Ensuring security, preventing abuse and fraud, diagnosing technical issues — legitimate interest (Art. 6(1)(f) GDPR).
• Sending service communications (e.g. technical notices, deadlines, service changes) — performance of the contract / legitimate interest.
• Sending marketing communications or newsletters, where applicable — consent (Art. 6(1)(a) GDPR), revocable at any time.
• Improving the product through aggregated and anonymous statistics — legitimate interest.

Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

6. Lema as data processor

For the data that you, as a customer, enter and manage within your workspace (tenant) — including the data of your customers, suppliers and collaborators — you are the controller and Arcaweb Sagl acts as processor, processing such data solely on your instructions and to provide you with the service.

• Multi-tenant architecture with logical data separation: each company has a dedicated, isolated database.
• We access your content data only when necessary for delivery, maintenance or support, or due to a legal obligation.
• We do not use your tenant content data for our own purposes, nor do we sell or transfer it to third parties.
• Upon request we provide a Data Processing Agreement (DPA) pursuant to Art. 28 GDPR and Art. 9 FADP.

You remain responsible for the lawfulness of the data you enter and for compliance with information obligations towards your data subjects.

7. Cookies and similar technologies

We use cookies and local storage technologies (e.g. localStorage) to run the service and remember your preferences. We distinguish the following categories:

• Strictly necessary cookies: essential for authentication, session security and correct operation of the application. They do not require consent.
• Preference cookies: store settings such as interface language and theme.
• Statistical/analytics cookies: used, where active, solely in aggregated form and with your consent, to understand site usage and improve it.

Lema does not use third-party advertising profiling cookies. You can manage or delete cookies through your browser settings; however, disabling technical cookies may impair the operation of the service.

8. Recipients and providers (sub-processors)

To deliver the service we rely on selected providers that process data on our behalf, bound by specific contracts and adequate security safeguards. The main categories are:

• Hosting and infrastructure providers, for data storage and processing.
• Payment provider (Stripe), for managing subscriptions and transactions.
• Transactional e-mail service providers, for sending notifications and service communications.

We do not disclose your personal data to third parties for their own independent purposes. We may disclose it to public authorities where required by law or to protect rights.

9. International data transfers

Data is primarily hosted in Switzerland. Should some providers process data outside Switzerland or the European Economic Area, we ensure that the transfer takes place to countries with an adequate level of protection or on the basis of appropriate safeguards, such as the Standard Contractual Clauses (SCC) approved by the EU Commission and recognised by the Swiss FDPIC.

10. Retention period

• Account and content data is retained for the entire duration of the contractual relationship.
• After the service ends, content data is deleted within a reasonable period (usually 30–90 days), unless otherwise instructed or required by law; you are given the opportunity to export it before deletion.
• Billing and accounting data is retained for the period required by law (in Switzerland, usually 10 years).
• Security logs are kept for a limited period proportionate to the purpose.

11. Data security

We adopt appropriate technical and organisational measures to protect data against unauthorised access, loss, alteration or disclosure, including:

• Encryption of communications in transit (TLS/HTTPS).
• Password hashing and secure credential management.
• Role- and permission-based access control, with token-based authentication.
• Separation and isolation of data between different workspaces (multi-tenant).
• Periodic backups and recovery procedures.

In the event of a personal data breach posing a high risk to the rights of data subjects, we will inform the competent authorities and, where required, the data subjects within the time limits provided by law.

12. Your rights

In accordance with the FADP and the GDPR, you have the right to:

• Access your personal data and obtain a copy of it.
• Rectify inaccurate or incomplete data.
• Request deletion of data ("right to be forgotten"), within legal limits.
• Restrict or object to certain processing.
• Receive your data in a structured, commonly used format (portability).
• Withdraw consent given at any time.
• Not be subject to decisions based solely on automated processing producing significant legal effects.

To exercise your rights write to info@arcaweb.ch. We will respond within the legal time limits. You also have the right to lodge a complaint with the competent supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the supervisory authority of your country of residence.

13. Artificial intelligence features

Lema offers AI-assisted features (e.g. data import, classification, text generation). These features are optional and activated at your initiative. They are not used to make automated decisions with legal effects on individuals without human intervention. Any data sent to such features is processed for the stated purposes and with adequate safeguards.

14. Minors

The service is intended for businesses and professionals and is not directed at minors. We do not knowingly collect personal data from minors. If you believe a minor has provided us with data, please contact us for its removal.

15. Changes to this notice

We may update this notice to reflect regulatory or service changes. The updated version will always be published on this page with the relevant last-updated date. In case of material changes, we will provide appropriate notice.

16. Contact

For any question or request regarding data protection, you can contact the data controller:

• Arcaweb Sagl — Via Lugano 13, 6982 Agno (Ticino), Switzerland
• E-mail: info@arcaweb.ch
• Phone: +41 (0)79 855 0978