Privacy Policy

Specta application — app.specta.dexo.ch

Last updated: 9 October 2026

This policy covers the Specta application at app.specta.dexo.ch only. The specta.dexo.ch website and the other Dexo sites have their own policy.

1. Who is responsible

The Specta application is operated by:

03 plates-formes Sàrl Route de Massongex 4, 1880 Bex (VD), Switzerland UID: CHE-274.893.645

Specta and Dexo are brands operated by 03 plates-formes Sàrl. In this policy, "Dexo" means 03 plates-formes Sàrl.

For any question about this policy or about your data: contact@dexo.ch · +41 24 552 55 22

2. Two distinct roles

This distinction determines who you need to contact, and it matters.

For account data — your name, e-mail address, organisation — Dexo is the controller. We decide what is collected and why.

For the content of inspection reports — observations, photographs, names and addresses of end clients, localities, maps — Dexo acts solely as a processor. The inspection company that created the report is the controller. It decides what goes in, who may see it, and how long it is kept. We host and process that data on its behalf and on its instructions.

If you are an end client who received a share link and you want a report about you corrected or deleted, please contact the company that carried out the inspection. We cannot alter report content on our own initiative.

3. Data we process

User account. Name, e-mail address, password (hashed, never stored in clear), language, role, organisation, profile picture if you add one, last sign-in time.

Report content. Everything an inspection company records: pipe sections, observations, severities, photographs, maps, altitude profiles, names and addresses of its clients and partners, work locations.

Comments. The text you write on a report, who wrote it and when. Comments marked "internal" are never visible to an external client.

External client accounts. When a client follows a share link and creates an account in order to comment, we record their name, e-mail address and the list of reports they may access. Such an account belongs to no organisation and sees only the reports explicitly shared with it.

Activity log. Significant actions (create, edit, delete, share, export) are recorded with their author and a timestamp, for traceability and security.

Technical data. Our hosting provider's server logs record IP addresses and requests, for security and troubleshooting.

We never ask for payment details inside the application, and we process no sensitive personal data within the meaning of the Swiss FADP (health, opinions, beliefs).

4. Purposes and legal bases

We process this data to provide the service you or your employer asked for: creating and viewing reports, generating PDFs, sending notifications, sharing a report with a client, securing access, and meeting our legal and accounting obligations.

The legal bases are performance of the contract with your organisation and our legitimate interest in the security and operation of the service.

5. Where your data is held

In Switzerland. The application, the database, the photographs and the PDF-generation service all run at Infomaniak Network SA in Geneva, on infrastructure located in Switzerland.

Photographs, inspection videos and documents are held in private storage and are never publicly accessible. Each display goes through a signed, short-lived link.

6. Processors

We do not sell data and do not share it for advertising.

One external resource: the national map. The application loads no fonts, scripts or images from a third-party server, with one exception: when you add a network plan from the map in the editor, your browser loads the map and the address search directly from the Federal Office of Topography swisstopo (geo.admin.ch, Switzerland). Like any web server, swisstopo then receives your IP address, the map area shown and the addresses you search for. Everywhere else, and always for a client viewing a shared report, displaying a page reports your visit to nobody but us.

7. Artificial-intelligence features

Some features of the application call a language model: writing a report page from your observations, and translating the content of a report or a page template.

They are optional: nothing is sent unless you explicitly ask for a page to be written or a translation to be made.

Processing takes place in Switzerland, at Infomaniak Network SA (their AI Tools service), under the same processing agreement as the hosting.

What is sent is limited to what the feature requires:

• Writing a page: the report's technical data — number of pipe sections, lengths, observations, severities. No client name, no address, no contact details: none of it is needed to describe the state of a pipe.
• Translation: the texts to be translated, that is the fields the inspector typed. People's names, order numbers, vehicle registrations and road references are excluded from what is sent, because they are not translated.

The texts sent are not used to train a model. The result is never published automatically: a written page arrives unsaved in the editor, and a translation is stored beside the report without changing what you wrote.

8. Usage statistics

We measure use of the application with Matomo, which we host ourselves. No usage data is sent to any third party.

The measurement is deliberately narrow:

• No cookies are set for this purpose, so no banner is needed.
• No address you visit is recorded as such. We record only the kind of screen viewed (for example "report editor"), never the real address. This matters most for share links: a share link is an access key, and it never leaves your browser in the direction of our statistics.
• No page title is recorded, because titles contain client names.
• No personal identifier: no name, e-mail address, account id or organisation name.
• Your IP address is anonymised before anything is stored.
• If your browser sends the "Do Not Track" signal, we measure nothing.

Dexo staff are excluded from these statistics.

9. Cookies

The application sets a session cookie, strictly necessary to keep you signed in and to protect against request forgery. It is not used for audience measurement and is not shared.

No advertising, tracking or third-party cookies are used.

10. Retention

Reports and their content are kept for as long as the customer organisation keeps them: deletion is its decision.

User accounts are kept for the duration of the contractual relationship. The activity log is kept for traceability.

Access granted to an external client is revoked rather than deleted, so that the sharing history remains visible to the responsible company.

Messages you send us. Problem reports and messages sent from the application are kept for two years after they are dealt with, then deleted. They contain what you wrote and, for a problem report, technical details about the screen concerned (page address, window size, browser). They are used only to reply to you and to fix the problem.

11. Your rights

You may request access to your data, its correction or deletion, a copy in a machine-readable format, and you may object to processing.

For account data, write to contact@dexo.ch.

For report content, contact the inspection company that produced the report: it is the controller, and we may act only on its instructions (see § 2).

You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC).

12. Security

Passwords are hashed. Traffic is served over HTTPS. Access is partitioned by organisation, and an external client sees only the reports explicitly shared with them. Files are never publicly accessible.

A share link is an access key: anyone holding it can read the corresponding report. Only pass it to intended recipients. A link can be revoked at any time from the application.

Access by Specta staff. To reproduce a problem you have reported to us, our administrators can open a session under your account and see the application exactly as you see it. This is tightly bounded:

• Specta administrators only — an administrator at your own organisation cannot use it to get into a colleague's account.
• Never the account of an external client (the "Viewer" role).
• A written reason is required, and every such access is recorded in our activity log with its author, its timestamp and that reason.
• Any session opened this way carries a permanent banner marking it as one.

You may ask us at any time for the record of this kind of access to your account.

13. Changes

Any change to this policy will be published on this page with a new update date.