Privacy Policy

Lexa Intelligence Corporation (hereinafter “Lexa,” “we,” “us,” or “our”) places critical importance on ethics, transparency, and the protection of personal information. In connection with the operation of our corporate website accessible at lexaintelligence.com (hereinafter the “Site”), we are committed to complying with applicable data protection laws, including Quebec's Act respecting the protection of personal information in the private sector (CQLR, c. P-39.1), as amended by Law 25; Canada's Personal Information Protection and Electronic Documents Act (PIPEDA); and the European Union's General Data Protection Regulation (GDPR), to the extent they apply.

The purpose of this Privacy Policy (hereinafter the “Policy”) is to describe the conditions under which Lexa processes, stores, protects, and destroys data generated while you browse the Site or voluntarily provide information to us.

For the purposes of this Policy, the following terms are defined as follows:

• “Personal Information” / “Personal Data”: Any information relating to a natural person that allows, directly or indirectly, for the identification of that person (for example, a name, an email address, or, in certain contexts, an IP address).
• “Processing”: Any operation or set of operations performed on personal information, regardless of the method used (collection, recording, organization, storage, modification, consultation, use, disclosure, dissemination, or destruction).
• “Data Subject” / “User”: Any individual who visits the Site or who voluntarily communicates with Lexa through its official channels.
• “Privacy incident”: Any access to personal information not authorized by law, any unauthorized use or disclosure of such information, its loss, or any other breach of its protection.

• Official title: Lucien Dubois, Privacy Officer
• Entity: Lexa Intelligence Corporation
• Email address: data@lexaintelligence.com

Our website was designed according to strict principles of data minimization at the source. Lexa refuses to engage in invasive profiling or behavioral targeting practices.

Therefore:

• No targeting cookies: We do not use any third-party advertising, analytics, or tracking cookies.
• No resale: We do not sell, exchange, rent, or monetize any personal information.
• No cross-site profiling: We do not track users from one website to another, and we do not work with any advertising networks or data brokers.
• No intrusive tools: We do not use platforms such as Google Analytics or advertising pixels (e.g., Meta Pixel) in order to ensure a neutral and secure browsing experience.

In accordance with the requirements of Act 25, the features and forms on our website are configured by default to ensure the highest level of privacy, with no non-essential data collection options pre-checked.

A. Technical Browsing Data (Collected Automatically)

When you access the Site, certain infrastructure data required for routing web requests is automatically generated by our servers and our hosting provider:

• Your device's public IP address, which is immediately processed temporarily and anonymized or aggregated to the extent possible;
• The technical specifications of the web browser and the operating system;
• File requests made (requested URL, file size);
• Precise connection timestamps and network latency measurements.

B. Audience Analytics Data (Aggregated and Anonymous)

We use the Vercel Analytics audience measurement solution to understand overall trends in the use of our Site. The data collected includes :

• The approximate country of origin (determined without precise geolocation);
• The pages of our Site that were viewed and the time spent on them;
• Referrers (the website or link that directed you to lexaintelligence.com).

This performance data is processed exclusively in aggregate and statistical form. According to Vercel’s documentation, Vercel Analytics does not use third-party cookies and distinguishes visitors using an identifier calculated by hashing the request. This session ID is deleted after 24 hours and does not allow for tracking your browsing activity across different sites.

C. Communication Data (Provided Voluntarily)

If you decide to contact us by email, we collect the information that you choose to include in your message:

• Your personal information (last name, first name);
• Your contact information (email address, phone number);
• Your professional information (company name, job title);
• The message as written and any attachments.

Every instance of personal information processing carried out by Lexa is based on a clear legal basis and serves specific purposes:

When the processing of your personal information is based on your consent, you have the right to withdraw that consent at any time. However, such withdrawal does not affect the lawfulness of any processing carried out prior to the withdrawal.

To withdraw your consent to the disclosure or processing of your correspondence, simply send us a written notice to the address data@lexaintelligence.com.

As part of the operation of our infrastructure, we rely on carefully selected external service providers:

• Vercel Inc. (Hosting): Vercel provides the distributed network architecture (edge infrastructure). Connection requests may be processed temporarily on servers located geographically close to your location in order to speed up the display of the Site.
• Vercel Analytics (Analytics): An audience measurement service provided by Vercel Inc., used to understand traffic trends on the Site based on aggregated statistics.

When using infrastructure providers such as Vercel Inc., your personal information may be transmitted, hosted, or processed outside of Quebec and Canada, including in the United States. In such cases, this data is subject to the applicable laws of those foreign jurisdictions.

Privacy Impact Assessment (PIA):
Before transferring personal information outside of Quebec or Canada, or entrusting such data to subcontractors, Lexa conducts a Privacy Impact Assessment. This analysis ensures that the data receives adequate protection equivalent to local requirements, formalized through written contracts that include strict security clauses and periodic audits.

Lexa retains personal information only for as long as necessary to fulfill the purposes set forth in this Policy, or to comply with its legal, tax, or regulatory obligations:

• System logs (infrastructure logs): Retained for a period of up to ninety (90) days, after which they are automatically deleted or overwritten.
• Email communication data: Retained for as long as necessary to process the request for information, then securely destroyed or archived for a maximum period of two (2) years after the last contact, for purposes of administrative record-keeping, unless a subsequent business or contractual relationship is established.
• Audience analytics data: Since this data is strictly anonymized and does not allow for the re-identification of any individual, it may be retained in aggregated form indefinitely for Lexa’s audience history.

Secure destruction:
Upon expiration of the retention period, Lexa securely and permanently destroys the data using electronic overwriting methods that comply with industry technical standards, or irreversibly anonymizes it in accordance with the criteria and procedures set forth in Law 25 and its implementing regulations, so that it may be used solely for statistical purposes and legitimate interests.

Lexa implements physical, organizational, and technical security measures at the enterprise level to safeguard the integrity and confidentiality of the data it processes:

• Systematic Encryption: All connections between your browser and our website are encrypted using modern security protocols (SSL/TLS— HTTPS, TLS 1.3).
• Strict access control: Access to information systems and customer communications is limited exclusively to authorized Lexa employees and contractors whose job duties require it.
• Internal Awareness: Our employees receive ongoing training in best practices for cybersecurity and data privacy.
• Infrastructure Monitoring: The hosting infrastructure is equipped with automated monitoring systems to detect suspicious or malicious activity.

Although no information system is completely immune to cyber threats, Lexa has a formal response plan in place in the event of a data breach.

If an incident involving unauthorized access, loss, or leakage of your personal information were to occur and posed a risk of serious harm, we would immediately take the following steps:

1. We will contain the incident to secure our systems;
2. We will record the event in our official privacy incident log ;
3. We will notify the appropriate regulatory authority (such as the Quebec Commission for Access to Information or the Office of the Privacy Commissioner of Canada);
4. We will notify you directly, as soon as possible, of the nature of the incident, the mitigation measures taken, and the recommended steps to protect your personal information.

Depending on the jurisdiction where you reside, you have the following legal rights regarding your personal information:

• Right of Access and Disclosure: You may request a written copy of the personal information we hold about you.
• Right to rectification: You may request that information that is incomplete, outdated, ambiguous, or inaccurate be corrected.
• Right to erasure (“Right to be forgotten”): You may request the deletion of your personal information when its retention is no longer justified by law or a contract.
• Right to Withdraw Consent: The right to withdraw your consent at any time for the future processing of your data.
• Right to Data Portability: The right to receive the personal information that you have provided to us in a structured, commonly used, and machine-readable format, so that you can transfer it to another data controller.

Application Process:

To exercise any of these rights, you must submit a signed and dated request by email to the Privacy Officer at the following address: data@lexaintelligence.com.

To prevent identity theft, we may need to request reasonable proof or verification of your identity before we can process your request.

Processing times:

Lexa is committed to processing your requests for access or correction within a maximum of thirty (30) days following receipt. If exceptional circumstances require it, this period may be extended in accordance with legal provisions, in which case you will be notified in writing.

Administrative Appeal:

If you believe that Lexa has not respected your rights after you have contacted us, you have the right to file a formal complaint with the appropriate authority:

• In Quebec: Commission d'accès à l'information (CAI) – cai.gouv.qc.ca
• In Canada: Office of the Privacy Commissioner of Canada (OPC) – priv.gc.ca

Lexa does not use any fully automated decision-making algorithms or any behavioral profiling methods on its Website with respect to its visitors.

The Site may occasionally contain hyperlinks to external websites that are not under Lexa’s control. The presence of these links does not constitute an endorsement by Lexa under any circumstances. We strongly recommend that you review the privacy policies of these third-party sites, as we assume no responsibility for their data protection practices.

Our Website is intended exclusively for adults and professionals. We do not knowingly collect information from minors. If you are a parent or legal guardian and learn that a minor has provided us with personal information, please contact us immediately so that we can securely delete that information.

This Policy is governed by the laws of the Province of Quebec and Canada. Any dispute regarding the interpretation, enforcement, or validity of this Policy shall be subject to the exclusive jurisdiction of the courts sitting in the judicial district of Montreal, Quebec, Canada.

Lexa reserves the right to revise this Policy to reflect any technological, legal, regulatory, or operational changes.

Any changes will take effect as soon as they are posted on the Site. We recommend that you check this page regularly to stay informed about our most recent commitments regarding the protection of personal information.