Privacy Policy

Third Party Links Our Platform may contain links to websites or applications we do not own or control that have their own privacy policies and we do not accept any responsibility or liability for these policies or for any personal data that may be collected through these websites or services. Please check these policies before you submit any personal data to these websites or use these services. Children’s privacy Our Platform is not intended for children, including those under the age of 18 years of age.

Data we collect and how we use it We may collect, use and store different kinds of personal data about you depending on how you use our Platform, including:

Commercial Data such as your transaction data including details about payment to and from you, your postcode and details of purchases;
Company Data such as your company name, registration number, and registered address;
Connected Data: information stored on your Device that you permit the App to connect to, being Contacts lists, login information, or (other information you choose to share). We will only access this data if you grant the Platform permission;
Contact Data such as your name, postcode, e-mail address and telephone number.
Cookies and Similar Technologies Data, see below for more information and visit Cookies preferences on the website;
Device Data such as the type of mobile device you use; unique device identifier(s) (for example, your Device’s IMEI number, the MAC address of your Device’s wireless network interface and/or the mobile phone number used by your Device); mobile network information; your mobile operating system; and time zone setting;
Direct Data such as your direct marketing preferences, consents for receiving direct marketing from us and/or our third parties and the history of the direct marketing communications we have sent to you;
Feedback Data: your feedback and survey responses;
Financial Data such as the last four digits of your payment cards, bank details, invoice and purchase order history;
Identity Data such as name, title, date of birth, and Profile Data;
Location Data such as your general location (for example, country or city level) and IP address. We do not collect or use precise GPS or device-based location data. Approximate location information may be collected automatically through analytics tools (such as Google Analytics) to help us understand where our users are located in general terms and to improve our Services. When you enable location services on your device, your device’s operating system provider (such as Apple or Google) may also collect and process location data in accordance with their own privacy policies;
Marketing and Communications Data such as your preferences in receiving marketing from us and our third parties, your communication preferences and communications you send us;
Profile Data such as your email address, username and password, profile picture, purchases or orders made by you, your interests, preferences, feedback and survey responses;
Security Data such as information we collect about your use of our Platform in order to ensure your and our other users' safety and security, being Usage Data, the Cookies Data generated by our use of cookies, and the information provided to us by our payment processing provider;
Transaction Data such as billing and delivery addresses, payment card details, history of your payments, purchases, deliveries, returns and refunds and the applicable terms and conditions of your purchases;
Usage Data such as logs and detail of your use of our Platform and Services, being the dates and times on which you download, access and update the App and our Services, any error or debugging information, and the actions we and you take in relation to them and Cookies Data. Note: Some of this data (such as Connected Data, Location Data, or certain Device Data) is only collected if you grant the App or your device permission to access it. We also create, use and share aggregated data, such as statistical or demographic data for various purposes. In certain circumstances, aggregated data may be (wholly or in part) derived from your personal data but that aggregated data is not considered personal data in law as it will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data with the usage data of others in order to calculate the percentage of users accessing a specific feature or Service. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data and will treat it in accordance with this Privacy Policy. We do not routinely collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, wand genetic and biometric data).

If you fail to provide us with your personal data Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with our Services). In this case, we may have to cancel the service you have with us, but we will notify you if this is the case at the time. How do we collect your personal data? We will collect and process the following data about you:

Registration - We collect your Identity Data and Contact Data when you register an account with us.
Communications - When you communicate with us via email or our “contact us” form, we collect your Contact Data. If the communication relates to an error or problem you are having with the App or our Services, we will also collect Usage Data for diagnosis and improvement.
Information you generate when using our App and Services - Each time you access and use our App and Services, we collect Content, Device, Cookies, and Usage Data. We collect Content Data where you upload it to the App or interact with the content available on the App. We collect Device, Cookies, and Usage Data by Platform usage and using cookies and other similar technologies. Please see our cookie settings for further details.
Information we collect through monitoring the use of our Platform and Services. Each time you access and use our App and Services we collect information about that access and use, being Device, Content, Cookies, and Usage Data.
Additional information we otherwise collect through our Platform and Services where we have your consent to do so - Where you provide your consent, we will collect your Location Data on an ongoing basis while you have the App installed on your device.
Direct Marketing - We collect and record Direct Marketing Data when we add you to our marketing database, you request to change your direct marketing preferences, or you interact with our direct marketing communications, or we receive prospect information from our data broker partners].
Connected Data - We collect Connected Data when you choose to connect your connected device to your account.
Information we receive from third parties – We may receive personal data about you from third parties.

Our purposes and lawful basis for using your personal data We will only use your personal data where we have a lawful basis to do so. Most commonly we will use your personal data in the following circumstances:

where you have consented to the processing;
where we need to perform a contract with you;
where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests; and
where we need to comply with a legal or regulatory obligation. We will only send you direct marketing communications (including in App messages, push notifications, email or text) where we have your consent. You will have the right to withdraw that consent at any time by following the instructions in any relevant communication or by contacting us at support@lexo-app.com The information about the purposes for which we will use your personal data below is outlined below, Purpose/activity Type of Data Lawful basis for processing your personal data To provide you with Contact Data Performance of a contract with you. our Services, Device Data including Identity permitting you to install Financial Data our App, and register you as a new App user To process in App Commercial Data Performance of a contract with you. purchases and Contact Data deliver services, Device Data including Financial Data managing payments Location Data and sending you Marketing and service Communications messages Data Contact Data Necessary for our legitimate interests Commercial Data (to recover debts owed to us and settle To collect money owed Identity Data payments and ancillary services). to us, make payments, Financial Data issue refunds and/or receipts, or enforce Profile Data our Terms and Conditions. To notify you of Contact Data For ongoing or prospective changes to our App or Profile Data contracts, Performance of a services and/or terms contract. and Otherwise, Legitimate interests conditions (in servicing our users and prospective users). To administer and Contact Data Necessary for our legitimate interests protect our business, Commercial Data (for running our business, provision of our App and the Device Data administration and IT services, for Services, Financial Data network security and fraud prevention). including managing Location Data accounts or records, Marketing and troubleshooting, data Communications Data analysis, system testing and fraud prevention. To make Contact Data Consent, recommendations to Commercial Data Necessary for our legitimate interests you about our goods Device Data (to promote our business to existing and/or services that Identity Data and former customers). may interest you. Location Data

Marketing and Communications Data Profile Data Usage Data To monitor trends Contact Data Necessary for our legitimate and usage of our Commercial Data interests (running our business, App, or Device Data provision of administration and IT services so that we Identity Data services, network security, can improve our App Location Data maintaining the security of our App or Marketing and and services, providing a secure services, and Communications service to users and preventing deploy security Data Profile Data fraudulent and other misuse of our measures Transaction Data App).

Usage Data To create Contact Data Necessary for our legitimate interests aggregated user Commercial Data (to study users (and their use) of our data Device Data App or services in order develop our

Identity Data App or services and grow our Financial Data business).

Location Data Marketing and Communications Data Sensory Data Usage Data Applying security All personal data Legal obligation (applying measures to our under this Privacy appropriate technical and Policy organisational measures). processing of your personal data, including processing in connection with the

App To send you direct Contact Data Consent, marketing Device Data Unless we can rely on the soft opt-in communications via Direct Marketing and you have not opted out, in which email, or text. case we rely on legitimate Interest (to publicise and grow our business). Automated decision-making We do not carry out any solely automated decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

Marketing We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We may use your Identity, Contact and Commercial Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you. You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and you have not opted out of receiving that marketing by emailing us at support@Lexo-app.com. We will only send you direct marketing communications by App, e-mail or text where we have your consent. You have the right to withdraw that consent at any time by updating your choices on the app or by emailing us at support@Lexo-app.com.

Disclosing your personal data We may disclose your personal data with the third parties below for the purposes set out in above.

External third parties, including: ▪ Your App store provider and network operator to allow you to install the App; ▪ Service providers acting as processors who provide IT and system administration services, hosting services for our App, delivery and logistics services, payment processing, fraud and identity verification providers, customer service support, email delivery and administration, and data storage and analysis; ▪ Your service providers that you have appointed and we need to contact to fulfil your requests, such as your banking or payment card provider to process your transactions; ▪ Our professional advisors including lawyers, auditors, insurers, consultants who provide legal, accounting, or insurance services; ▪ Marketing and promotional partners and co-operatives with whom we share data to enhance our offerings and identify prospective customers; ▪ Third party partners where you have expressly subscribed to receive marketing from or with them.
At your direction or with your consent, such as when you use our social media features to provide information to Lexo about our service or when you direct us to share information with third parties;
Law enforcement or where we otherwise believe it appropriate to investigate, prevent, or take action regarding possible illegal activities, and/or to protect our rights and property and the rights and property of other users;

International Transfers The personal data we collect from you may be transferred to, and or stored at, a destination outside the UK/European Economic Area (“EEA”) depending on where we use service providers located outside the UK/EEA. Where personal data is transferred outside the UK/EEA to a country not deemed to provide adequate protection, we have complied with the need for additional safeguards as set out in legislation.

Data security Lexo has implemented administrative, physical, and technical security measures to protect your information under our control. All information you provide to us is stored on our secure servers (or those of our third party service providers). Mobile platform providers (such as Apple and Google) may also process certain technical and device data when you download or update the App; these providers act as separate controllers of that data. Any payment transactions carried out by our chosen third-party provider of payment processing services will be encrypted. You should take steps to keep your information safe (including your password) and log out of your account after use. Where we have provided you, or you have chosen, a password that enables you to access certain parts of our Platform, you are responsible for keeping your password confidential. You must not share these with anyone or store them in a way that may allow a third party to access them. If that happens, you should report it immediately to support@Lexo-app.com. Once we have received your information, we will use strict procedures and security features to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way. While Lexo takes precautions against possible security breaches of its Platform, no internet transmission is completely secure, and we cannot guarantee that unauthorised access, hacking, data loss, or other breaches will never occur. We cannot guarantee the security of your information while it is being transmitted to our Platform or stored in our systems, and any transmission is at your own risk. We have put in place procedures to deal with any suspected personal data breaches and in the event of a personal data breach, we will notify you and any applicable regulator when we are legally required to do so.

Data retention We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal or other requirements.

Your legal rights Under certain circumstances you have the following rights under data protection laws in relation to your personal data. Please note, these rights are not absolute. You have the right to:

request access to your personal data (commonly known as a ‘data subject access request’). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it;
request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us;
request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where:
you have successfully exercised your right to object to processing (see below);
we may have processed your information unlawfully; or
we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you (if applicable) at the time of your request;
object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms;
request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios:
if you want us to establish the data’s accuracy;
where our use of the data is unlawful but you do not want us to erase it;
where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
request the transfer of your personal data to you or to a third party. We will provide to you (or a third party you have chosen) your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you;
withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide services to you. We will advise you if this is the case at the time you withdraw your consent. You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances. We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response. If you would like to exercise any of these rights, please contact us by email at support@lexo-app.com

Cookies and other electronic technologies Like most Platforms, Lexo uses cookies and similar technologies, including web beacons, embedded scripts, and e-tags (together referred to as “cookies,” unless otherwise stated) to provide users an efficient user experience in using our website or Services. When we refer to “cookies,” this also includes mobile identifiers and local storage technologies used within our App (such as analytics SDKs and local storage mechanisms like IndexedDB and Cache Storage for PWA functionality). A cookie is a small data file placed on your computer or mobile device by your web browser. It is a tool that stores information about website visits, recognises you and your preferences each time you visit our Platform, optimises functionality, and enables us to provide the service. Some parts of the Platform may use cookies to track user traffic patterns. We ask for your consent before using any non-essential cookies or similar technologies (such as analytics SDKs), and you can change your preferences at any time in the App, by using the website’s cookie banner, or by contacting us. Lexo uses cookies for various reasons, including providing you the Service you have requested, enhancing our Platform’s performance, or analysing how users use our Platform. You may also control and block the cookies used by our website by clicking on preferences on the bottom left of the Home page. You can also adjust your settings so that your browser blocks all cookies or only cookies from third parties. You can also delete cookies that have already been placed. However, please note that if you use your browser or device settings to block all cookies, you may not be able to access all or parts of our website. For more information about how cookies can be managed and deleted, please visit http://www.allaboutcookies.org/.

Online analytics and tailored advertising Analytics – We use third-party analytics services such as Google Analytics (GA4). These service providers use these technologies to help us analyse how users use the Service, including analysing website and App usage, compiling reports on user activity (such as page views, session duration, clicks, and device type), and providing us with other related services. Google Analytics may also collect approximate location (city/country) based on IP address. We do not receive personally identifiable information from Google Analytics, and we do not combine analytics data with user account information. To prevent Google Analytics from using your data, you may install the Google Analytics Opt-Out Browser Add-on or adjust your cookie preferences on our website. Tailored advertising – We and our third-party service providers may use device identifiers and other automated technologies (including cookie identifiers), along with other collected information, to deliver content or tailor ads when you are on our Service or other devices, apps or websites. These ads may be based, for instance, on the types of websites that you visit over time, the types of apps you have on your device, or de-identified information about you and your likely interests, based on your activities off our Service. Partners that we or others work with to do the above may track your activities over time (including across different apps or websites) by collecting information through automated means, and they may use this information, and other information they receive from us or other sources, to deliver advertisements to you.

Complaints and concerns Please contact us at support@lexo-app.com should you have any questions about how or why we process your personal data. You also have the right to make a complaint at any time to the Information Commissioner’s Office, the UK regulator for data protection issues at HYPERLINK "http://www.ico.org.uk"www.ico.org.uk.

Changes to the Privacy Policy We keep our Privacy Policy under regular review. We may change this Policy to reflect changes in the law, our information practices, or the Service features. This version was last updated on 10 October 2025. By using our Services, you are confirming that you have read and understood the latest version of this Privacy Policy.