Data controller
The data controller is Elvexa Sagl, based at Via Nassa 46, 6900 Lugano (Switzerland), registered with the Commercial Register under number CHE-215.511.090. For any request regarding the processing of your data, you can write to info@elvexa.com.
What data we collect
We collect three categories of data.
- Contact form data: first name, last name, role, company name, website, email, phone number, and a short description of your situation. Provided voluntarily when you request the free assessment.
- Technical browsing data: IP address (masked), browser type, operating system, pages visited, referrer, date and time. Used for security and abuse prevention.
- Aggregated measurement data: via Google Analytics 4 configured in Consent Mode v2. Before your consent, measurement is anonymous and aggregated (cookieless mode, no persistent identifier). With your consent, measurement cookies are set allowing a more complete reading of visits.
Purpose of processing
- Reply to your requests and organise the free assessment.
- Communicate with you regarding contractual activities, if you decide to start a project.
- Protect the site from automated abuse via Google reCAPTCHA Enterprise.
- Measure aggregate site usage and improve it.
We do not send commercial communications without explicit consent.
Legal basis
Processing of form data is based on the execution of pre-contractual measures at your request (Art. 6.1.b GDPR). Processing of technical security data and anonymous aggregated measurement is based on our legitimate interest (Art. 6.1.f GDPR). Processing via non-anonymous measurement and attribution tools takes place exclusively on your consent (Art. 6.1.a GDPR), collected through the on-page banner and revocable at any time.
Retention
- Form data: 24 months from the last meaningful interaction, except for longer contractual needs.
- Server technical logs: 90 days (automatic rotation).
- Cookie consent choice: 6 months in the user's browser (localStorage key
elvexa_consent_v1), renewable. - Aggregated measurement data in Google Analytics: according to the retention settings of our account (currently 14 months).
Recipients and providers
Data is accessible to authorised Elvexa Sagl personnel. We rely on the following providers, each under contract:
- Hostpoint AG (Switzerland): site and email hosting infrastructure.
- Google Ireland Ltd / Google LLC: Google Analytics 4 for aggregated measurement and reCAPTCHA Enterprise for anti-bot protection.
We do not share data with third parties for their own commercial purposes.
Non-EU transfers
Application and email servers are located in Switzerland, a country recognised by the European Commission as providing an adequate level of protection (adequacy decision 2000/518/EC). Use of Google services may involve transfers to the United States: these are covered by the Standard Contractual Clauses (SCC) and by the EU-U.S. Data Privacy Framework, to which Google has adhered.
Your rights
You can exercise the rights of access, rectification, erasure, restriction, objection and portability at any time by writing to info@elvexa.com. You can also revoke consent to full measurement by deleting the key elvexa_consent_v1 from your browser or re-presenting the banner from the settings. You have the right to lodge a complaint with the competent supervisory authority: in Switzerland, the FDPIC (EDÖB); for EU residents, the Authority of your jurisdiction.
Security
We adopt technical and organisational measures to protect data: HTTPS connection, access control, form rate limiting, anti-bot protection, environment separation, backups.