This Privacy Policy provides information about the processing of personal data by Lagutta Systems GmbH, Blattenstrasse 7, 8603 Schwerzenbach, Switzerland, in connection with the use of our website lagutta.com and our software solutions and services. These include, in particular, the point-of-sale system “lagutta”, Lagutta Back Office, the “TexPoint” customer app, including customer-branded versions, and the associated functions and services, particularly for order management, payment processing, customer management, employee management, Smart Lockers and Collect Points. This Privacy Policy explains which personal data we process, for what purposes, and what rights individuals have in relation to their personal data.
We place great importance on protecting your personal data. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and the European Union General Data Protection Regulation (GDPR), to the extent that these laws apply to the respective processing activities.
Who is responsible for processing the personal data?
Lagutta Systems GmbH, Blattenstrasse 7, 8603 Schwerzenbach, Switzerland, is generally responsible for processing personal data in connection with our website, user account administration, the establishment and management of contractual relationships, billing, customer support, and the handling of contact inquiries and demo bookings. If you have questions about data protection or wish to exercise your rights, you can contact us at info@lagutta.com.
Where our business customers use the lagutta point-of-sale system, Lagutta Back Office, the TexPoint customer app or associated functions to process personal data relating to their own customers, employees or other individuals, the respective business customers are generally responsible for determining the purposes and means of such processing. Lagutta Systems GmbH generally processes this data as a processor in the course of providing its services and in accordance with the agreements concluded with the respective business customers. For certain processing activities carried out for its own purposes, particularly the security, administration and billing of its services, Lagutta Systems GmbH may itself act as a controller.
Which personal data do we process?
We only collect personal data to the extent necessary to provide our services effectively.
Where our business customers collect or process personal data relating to their customers, employees or other individuals through the use of our services, they are responsible for ensuring that such processing is lawful. This includes, in particular, ensuring that an applicable legal basis exists for the processing, that the individuals concerned are appropriately informed, and that their data protection rights are respected. Consent must be obtained where required by applicable law. When acting as a processor, Lagutta Systems GmbH generally processes such personal data in accordance with the instructions of the respective business customer.
Below, we explain the main types of data we process:
- Account and Registration Data: When users register for and use our services, we process information required to create and manage user accounts and administer the contractual relationship. This may include names, usernames, business contact details, email addresses, telephone numbers, company names, business addresses, account settings and securely protected authentication information. This data is used for user administration, authentication, provision of our services and communication with our business customers.
- Operational and Content Data: When the lagutta point-of-sale system, Lagutta Back Office, the TexPoint customer app and associated functions are used, we process data entered, provided or generated by our business customers, their employees and their end customers in connection with the relevant services. This may include customer master data such as names, telephone numbers, email addresses and postal addresses; order and transaction data; information about garments and services; processing and collection dates; order statuses; payment transactions; customer histories; loyalty points; memberships; and information relating to the use of Smart Lockers and Collect Points. Depending on the functions used, we may also process employee data, user roles, access permissions, employee time records, operational reports and technical event logs. The nature and extent of the data processed depend on the functions used by the respective business customer.
- Contract, Transaction and Payment Data: We process data required to establish, perform and bill our contractual relationships and to provide payment functionality. This includes, in particular, information about selected subscription plans, invoices, payments, payment statuses, payment references and, where applicable, payment reminders. We use the payment service provider Stripe to process subscription payments. Payments made through the payment functions used by our business customers in the lagutta point-of-sale system and the TexPoint customer app may also be processed through the payment service provider SumUp. Complete credit and debit card details are processed by the respective payment service providers. Lagutta Systems GmbH does not itself store complete card numbers or card verification values (CVV/CVC). However, we receive and process the transaction information required to execute, confirm, allocate and document payments.
- Communication and Support Data: When you contact us by email, telephone, through our website contact form or via other communication channels, we process the information you provide and the data generated in connection with the communication. This may include names, contact details, message contents, support requests, technical information and communication timestamps. This data is used to handle your inquiry, provide customer support, resolve technical issues and maintain the quality of our services.
- Technical and Access Data: When our website, the lagutta point-of-sale system, Lagutta Back Office, the TexPoint customer app and associated services are used, technical data and usage information may be processed. This includes, in particular, IP addresses, device types, operating systems, browser information, language settings, access timestamps, technical logs and information about the use of individual functions. This data is used primarily to provide, secure, troubleshoot and technically improve our services. Where the relevant functions are used and the necessary permissions have been granted, location information may also be processed to display nearby branches, and technical identifiers may be processed to deliver notifications.
- Cookies and Similar Technologies: When our website and certain software functions are used, cookies, local storage technologies and comparable technical methods may be employed. These are used in particular to provide essential functionality, store preferences, ensure security and, where such services are used, analyze and improve our services. Non-essential technologies requiring consent under applicable law are only used with the relevant consent. Further information is provided in the section “How do we use cookies?”.
Why do we process your personal data?
We process personal data only for specified, lawful purposes and to the extent permitted by applicable data protection law. These purposes include, in particular, initiating, establishing and performing contractual relationships; providing and operating our services; handling contact and support inquiries; organizing demo appointments; processing payments; ensuring IT security; preventing misuse; improving our services; and complying with legal obligations.
Where the GDPR applies and we act as a controller, the processing of personal data is based, depending on its purpose, in particular on the performance of a contract or pre-contractual measures (Article 6(1)(b) GDPR), compliance with legal obligations (Article 6(1)(c) GDPR), our legitimate interests (Article 6(1)(f) GDPR), or consent (Article 6(1)(a) GDPR). Our legitimate interests include, in particular, the secure and reliable operation of our services, handling business inquiries, preventing misuse and developing our services. Where we process personal data on behalf of our business customers, the respective business customer is responsible for determining the applicable legal basis.
We process your personal data for the following purposes:
- To establish and fulfill our contractual relationship with you, manage communication, operate our services, handle billing, and analyze our customer base.
- To enable the use of our services, including providing customer support, personalized features, and ensuring the security of the services.
- To display historical sales information.
- To measure, adapt, and improve our services and develop new products.
- To send you important communications such as service updates, support messages, technical notices, security alerts, and any other requested information.
- To detect and prevent fraudulent activities, unauthorized access, and other illegal actions.
- To comply with legal obligations.
Contact Form on Our Website
We use Formspark, a service provided by Trampoline Software SRL, based in Belgium, to operate the contact form on lagutta.com. When you send us a message through the contact form, the information you provide, in particular your contact details and message content, is transmitted to Formspark, where it is processed and stored before being forwarded to us. Formspark may also process technical information associated with the submission, such as IP addresses, browser information and other submission metadata.
To protect our contact form against automated submissions, spam and misuse, we use Cloudflare Turnstile, a service provided by Cloudflare, Inc., USA. Technical information, including IP addresses, browser and device information, and technical verification signals, may be processed to help distinguish human users from automated requests.
The data is processed to handle your contact inquiry, manage the associated communication and protect our contact form against misuse. Further information is available in the privacy policies of Formspark at https://formspark.io/legal/privacy-policy/ and Cloudflare at https://www.cloudflare.com/turnstile-privacy-policy/.
Online Appointment Booking for Product Demonstrations
We use Cal.com, an appointment scheduling service provided by Cal.com, Inc., USA, to enable online bookings of product demonstrations through our website. When the appointment booking function is used, information required to organize and conduct an appointment, particularly names, email addresses, selected appointment dates and times, time zones and any additional information voluntarily provided, is processed through Cal.com. The appointment booking function is provided through an integration of Cal.com on our website. Technical information may also be transmitted to Cal.com when the booking function is accessed or activated. Appointment management is connected to Google Calendar. For online demonstrations, video conference links may be created automatically through Google Meet. The necessary appointment information is transferred to the corresponding Google services for this purpose. The data is processed exclusively to organize, confirm and conduct the requested appointments and to manage the associated communication. Further information is available in the privacy policies of Cal.com at https://cal.com/privacy and Google at https://policies.google.com/privacy.
Where is your data stored and processed?
We primarily use Microsoft Azure cloud infrastructure to provide our software solutions. The main operational and customer data of our business customers is stored in regionally separated databases. For business customers based in Switzerland and business customers located outside the European Union, the primary storage of this data takes place in Microsoft Azure data centers in Switzerland. For business customers based in the European Union, particularly Germany and Italy, primary storage takes place in Microsoft Azure data centers in Germany. This regional separation is intended in particular to support the secure and reliable provision of our services and to take account of different data protection requirements.
Our website lagutta.com is hosted through Hostinger, with the hosting infrastructure currently configured, according to our information, in France. We use external service providers for certain additional functions, particularly the handling of contact inquiries, online appointment scheduling and payment processing. The personal data required for the respective function may therefore also be processed outside Switzerland, particularly in European Union countries and, depending on the service provider, the United States of America. This concerns the information necessary for the respective services and does not mean that our complete operational and customer databases are transferred to these providers. Personal data is disclosed in accordance with the applicable data protection requirements.
Who do we share your data with?
We disclose personal data only where necessary or legally permitted for the provision of our services, the performance of contractual relationships, payment processing, the operation and security of our technical infrastructure, the handling of inquiries, compliance with legal obligations or the protection of legitimate interests. Recipients may include IT and hosting service providers engaged by us, payment service providers, communication and appointment booking services, technical integration partners, and competent authorities or public bodies. Where service providers process personal data on our behalf, we implement the necessary contractual and organizational safeguards to protect that data.
Potential recipients of personal data include, in particular, the following categories:
- Authorities: We may disclose personal data to authorities, courts, and other public bodies, both domestically and internationally, when we are legally obligated or entitled to do so. This may include instances such as criminal investigations, police actions, regulatory requirements, court proceedings, and other legal obligations related to disclosures and cooperation.
- Service Providers: We work with external service providers and technical partners to operate and provide our services. These include, in particular, Microsoft Azure for cloud infrastructure and data storage, Hostinger for website hosting, Formspark for contact form processing, Cloudflare for protection against automated access, Cal.com for online appointment booking, and Google for associated calendar and video conferencing functions. We also use payment service providers, particularly Stripe and SumUp. Depending on the functions used and applicable legal requirements, additional technical service providers and integration partners may be involved, for example for payment functions, legally required fiscalization or Smart Locker integrations. Personal data is disclosed only to the extent necessary for the respective function.
How is your data protected?
We take appropriate security measures to safeguard the confidentiality, integrity, and availability of your personal data. These measures are designed to protect against unauthorized processing and reduce the risk of data loss, alteration, or unauthorized access.
We primarily use Microsoft Azure cloud infrastructure, including data centers in Switzerland and Germany, to store and process application data. We implement appropriate technical and organizational measures to protect personal data against unauthorized access, unlawful processing, loss, alteration or disclosure. These measures include, in particular, secure transmission connections using TLS encryption (HTTPS), appropriate access restrictions and other security measures corresponding to the systems and services used. When selecting and engaging external service providers, we take into account their security standards and the applicable data protection requirements.
How long do we retain your data?
We generally retain personal data only for as long as necessary for the respective processing purposes or where statutory retention obligations apply. The retention period depends in particular on the nature of the data, the purpose of processing, the duration of the contractual relationship and the applicable legal requirements.
Following the end of paid use of lagutta, the operational and customer data of the respective business customer is generally retained for a period of twelve months. During this period, access to Lagutta Back Office remains available for viewing and exporting existing data and reports. However, use of the point-of-sale system remains suspended unless paid use is reactivated. After the twelve-month period, the relevant data is deleted unless statutory retention obligations or other legally permitted grounds for continued retention apply. Upon written request by the business customer, the data may be deleted before the end of this period, provided that no statutory or contractual obligations prevent such deletion.
User accounts for which only the free trial period was used and no paid subscription was subsequently activated are generally deleted, together with the associated trial data, six months after the trial period expires, unless legal grounds require longer retention.
Independently of this, we retain contractual, invoicing, accounting and payment information required to fulfil our own statutory obligations for the applicable retention periods. Under Swiss law, accounting books and supporting accounting records must generally be retained for ten years from the end of the relevant financial year. This applies in particular to our own invoices and associated business and payment records and does not mean that all operational and customer data is retained for ten years.
Data contained in technical backups may remain until the applicable backup retention and deletion periods expire. Where we process personal data on behalf of our business customers, we take account of applicable contractual and statutory obligations when returning or deleting such data.
What are your data protection rights?
Subject to applicable data protection law, you have various rights concerning the processing of your personal data. These may include, in particular, the right to obtain information about personal data we process, the right to request correction of inaccurate data, the right to erasure, the right to restrict certain processing activities, and the right to receive or transfer personal data in a commonly used electronic format. Where the legal requirements are met, you may also object to certain processing activities and withdraw consent at any time with effect for the future. Subject to applicable law, you may also have rights concerning decisions based solely on automated processing that produce legal effects or similarly significantly affect you.
Where provided for by applicable data protection law, you also have the right to lodge a complaint with a competent data protection supervisory authority. In Switzerland, this is in particular the Federal Data Protection and Information Commissioner (FDPIC). Where the GDPR applies, you may contact the competent data protection supervisory authority of a Member State of the European Union.
If you wish to exercise your data protection rights, you can contact us at info@lagutta.com. Where we have reasonable doubts about your identity, we may request additional information if necessary to verify your identity.
Please note that your rights are subject to certain conditions, exemptions, or restrictions under applicable data protection laws. We will notify you if necessary. In some cases, we may need to process and retain your data to fulfil contractual obligations, protect our legitimate interests (such as legal claims), or comply with legal requirements.
If your request concerns personal data that we process on behalf of one of our business customers, please generally contact the relevant business as the controller responsible for that data. We assist our business customers in handling such requests in accordance with the applicable agreements and legal obligations.
How do we use cookies?
Our website uses cookies and comparable technologies to provide certain functions, store preferences and enable the secure and reliable operation of the website. Technically necessary cookies and similar technologies may be used where required to provide functions expressly requested by users or to ensure the secure operation of our services. In addition, where the corresponding services are used, other technologies may be employed to analyze and improve our services or integrate external content. Where consent is required under applicable law, such technologies are used only after the relevant consent has been obtained.
When certain functions of our website are used, particularly the contact form and online appointment booking, technologies provided by external service providers may also be used. These include, in particular, Cloudflare Turnstile for protection against automated access and Cal.com for the provision of appointment booking functionality. Further information about these services is provided in the relevant sections of this Privacy Policy.
Google Analytics and Conversion Measurement
With your consent, we use Google Analytics 4, a service provided by Google Ireland Limited, Ireland, to analyse how visitors use our website. This may involve processing information about pages visited, access times, devices and browsers, approximate locations, and cookie identifiers.
We also measure certain interactions on our website, such as clicks on buttons to start a free trial or open the demo-booking interface. These measurements do not mean that a registration or appointment booking has actually been completed. The information collected may also be used to measure the effectiveness of our Google Ads campaigns and may be transmitted to Google for this purpose. Data may also be processed in the United States. Advertising personalization is not enabled through this website, and advertising-cookie storage remains disabled. Further information is available in Google's Privacy Policy at https://policies.google.com/privacy.
Google Analytics uses cookies, among other technologies, to recognize visitors. These cookies may have a default lifetime of up to two years, although their actual lifetime depends on the relevant settings and the browser used. Google Analytics is activated only after you provide consent. Your decision regarding optional cookies is stored in your browser for six months. You can change your preferences at any time through the “Cookie Settings” link in our website's footer or legal navigation section and withdraw your consent with effect for the future.
Can we update this privacy policy?
We may update this Privacy Policy from time to time, particularly when our services, technologies, data processing activities or applicable legal requirements change. The current version will be published on our website. Where possible, we will provide appropriate notice of material changes at least one month before they take effect. Changes that must be implemented at short notice due to mandatory legal requirements or urgent security reasons remain reserved. Your rights under applicable data protection law remain unaffected.
This Privacy Policy is available in German, English, French and Italian. In the event of discrepancies between the language versions, the German version shall prevail, provided that this does not restrict any mandatory rights of individuals under applicable data protection law.
Current version: October 2026