DATA PROTECTION POLICY

Lex Tech & Design Ltd (trading as LexTech Lab)

Last Updated: 2 October 2026

INTRODUCTION

This Data Protection Policy ("Policy") explains how Lex Tech & Design Ltd, a private company limited by shares incorporated in Mauritius under company number 171979 with registered office at Suite 620, 6th Floor, St James Court, St Denis Street, Port-Louis, Mauritius ("Company", "we", "us", "our"), collects, processes, uses, stores, and discloses personal data when you access the Site, create an Account, subscribe to the Services, or use any functionality of the LexTech Lab platform.

For the purposes of the Data Protection Act 2017 of Mauritius ("DPA 2017"), the Company acts as a data controller, meaning that it determines the purposes and means of processing personal data. Where processing occurs through third-party processors or automated systems, such relationships are governed by applicable data processing agreements and this Policy.

"You", "User", "data subject", and "personal data" refer to any natural person who accesses the Site, uses the Services, or whose personal data is otherwise processed by the Company in connection with the Services.

Please read this Policy carefully. During registration you are asked to accept this Policy expressly.

1. SCOPE AND APPLICATION

1.1 Scope of This Policy

This Policy applies to all personal data collected and processed by the Company in connection with:

(a) visiting the website at www.legaltech.muand app.legaltech.mu (the "Site");

(b) submission of an enquiry through a contact form on the Site;

(c) creation of an Account, including verification of an email address and, where the User chooses, a mobile telephone number;

(d) membership of an Organisation, including invitations sent to join one;

(e) subscription to the Services, whether on the Free Plan, a trial or a paid Plan;

(f) an application for a discounted Plan;

(g) access to and use of the Connector (as defined below) through a compatible MCP client such as Claude or ChatGPT, and use of the research interface on the Site;

(h) processing of payments, whether by card or bank transfer;

(i) communications with the Company, including support requests, correspondence, and feedback; and

(j) any technical interaction with the Services, including authentication, enforcement of usage allowances, and service logging.

1.2 Acceptance of Policy

During registration, Users are required to expressly accept this Policy. Where a new version of this Policy is published, Users are asked to accept it when they next sign in. The Company records each acceptance together with the version accepted and the date and time.

1.3 Amendments to This Policy

The Company reserves the right to amend, update, or modify this Policy at any time in order to reflect changes in legal requirements, operational practices, technological developments, or the addition of new services or processors.

(a) Any updated version of this Policy shall be published on the Site with its version number and effective date.

(b) Where amendments materially affect the rights of Users under the DPA 2017, the Company shall provide appropriate notice to Users by email or through the Site. Where legally required, the Company shall obtain the User's express consent prior to implementation.

2. DEFINITIONS

For the purposes of this Policy:

(a) "Account" means the user account created by a User on the Site, authenticated by email and password.

(b) "Personal Data" means any information relating to an identified or identifiable natural person, as defined in section 2 of the DPA 2017.

(c) "Connector" means the remote Model Context Protocol server operated by the Company at connect.legaltech.mu, which provides Users with access to legal research tools covering Mauritian legislation, regulations, proclamations and court judgments through a compatible MCP client.

(d) "Services" means the Connector and the Site collectively, including all legal research functionality, Account and Organisation management, subscription management, payment processing, installation guidance, support, and related features.

(e) "Authorised Client"means an MCP client that the User has authorised, by signing in to their Account in a browser, to access the Connector on the User's behalf.

(f) "Organisation" means the firm, team or other group under which one or more Accounts are grouped for the purposes of a subscription.

(g) "Processor" or "Data Processor" means a natural or legal person that processes personal data on behalf of the Company.

(h) "Data Subject" means the individual to whom personal data relates.

(i) "Commissioner" means the Data Protection Commissioner established under the DPA 2017.

3. CATEGORIES OF PERSONAL DATA PROCESSED

3.1 Direct Collection

The Company collects personal data directly from the User at the following stages:

(a) Enquiries

When a person submits an enquiry through a contact form on the Site: name, email address, the reason for or subject of the enquiry, firm name and team size (where given), and the message.

(b) Account Registration

When a User registers: email address, password (stored in hashed form), country, marketing preference, and consent records (the version of the Terms and Conditions of Use and of this Policy accepted, and the date and time of acceptance).

(c) Telephone Verification

Where a User chooses to verify a mobile telephone number, for example to obtain a trial: the telephone number and the fact and time of verification.

(d) Organisations and Invitations

Where a User creates or joins an Organisation: the Organisation's name, the User's role within it, and the email addresses of persons invited to join it.

(e) Applications for Discounted Plans

Where a User applies for a Student or Young Pro Plan: contact email, and, according to the Plan applied for, the institution attended and expected date of completion, or the date of call or admission, the professional body and the membership number; together with the supporting document uploaded as evidence.

(f) Payment Information

Where a User pays by bank transfer: the Plan and number of seats selected, the invoice reference, the amount, and any remittance advice uploaded as proof of payment. Where a User pays by card, card data are entered into and processed by Peach Payments directly — no card numbers, CVVs, or other sensitive payment card data are collected or stored by the Company. Where the User gives permission for a card to be stored for renewals, the Company stores a tokenised reference to the card issued by Peach Payments, and a record of that permission (its wording, and the date and time it was given).

(g) Support Requests

When a User contacts the Company for support: the content of the correspondence and the contact details used.

3.2 Automatic Collection

The Company automatically collects and processes the following data in connection with the provision of the Services:

(a) Usage records: for each use of a research tool, the name of the tool, the date and time, whether the request succeeded, how long it took, the number of results returned, and the IP address from which the request was made. These records are used to enforce usage allowances and to secure the Services.

(b) Authorisation records: the MCP clients a User has authorised, the date of authorisation, and the IP address and browser or client identifier (user agent) last used by each.

(c) Security audit records: a record of security-relevant actions on an Account (for example registration, telephone verification, the start of a trial, the issue of a sign-in token to an MCP client, and deletion requests), with the date and time and, where recorded, the IP address and user agent.

(d) Subscription lifecycle data: Plan, subscription status, trial dates, payment dates, billing period, and status changes.

(e) Technical identifiers: a system-generated User ID and timestamps of Account creation and updates.

(f) Verification challenge:certain forms on the Site are protected by an automated challenge (Cloudflare Turnstile) which processes technical information about the visitor's browser and connection in order to distinguish people from automated traffic.

3.3 Content of Research Requests

The Company draws particular attention to how the content of research requests is handled, because Users may be bound by duties of professional secrecy:

(a) The usage records described in section 3.2(a) do not include the content of the request. The Company's account database does not record the search terms, questions or text a User submits to a research tool, or the results returned.

(b) Server logs may contain request content in limited cases. The servers that operate the Connector keep operational logs. Requests made through an MCP client are not written to those logs in the ordinary course. The following are: (i) text typed into the search box of the research interface on the Site, as suggestions are fetched while the User types — this is logged without the User's identity or IP address; and (ii) where a request fails, diagnostic details of the failure, which can include the text submitted. These logs are kept on a rolling basis — older entries are overwritten as storage limits are reached, rather than after a fixed period — and are accessible only to the Company's administrators.

(c) Search, answer-extraction and verification tools use third-party artificial intelligence models. When a User runs a search, the text of the query is transmitted to the AI model provider identified in section 5.1, which converts it into a numerical representation and ranks the candidate results. When a User uses a tool that extracts an answer from a source or verifies a quoted proposition, the question or proposition is likewise transmitted to that provider. No text is generated by these models. The User's identity, Account details and IP address are not transmitted to the provider. Tools that retrieve a named document or section by reference do not transmit the request to the provider. The provider does not retain the text it receives and does not use it to train its models.

(d) The conversation in the User's MCP client is not received by the Company. The Company receives only the requests that the MCP client sends to the Connector. The MCP client's own processing of the User's conversation is governed by the terms and privacy policy of its provider.

(e) Payment card data are not stored by the Company, as described in section 3.1(f).

4. PURPOSE AND LEGAL BASIS FOR PROCESSING

The Company processes personal data for the following purposes and on the following legal bases under section 28 of the DPA 2017:

4.1 Performance of a Contract (section 28(1)(b)(i))

(a) Creating and managing Accounts and Organisations;

(b) Providing access to the Connector and legal research tools;

(c) Authenticating requests and enforcing usage allowances;

(d) Managing subscriptions, trials, and billing periods;

(e) Assessing applications for discounted Plans;

(f) Processing payments and generating invoices;

(g) Sending transactional communications (verification emails and codes, invitations, payment confirmations, subscription status notifications, and account-related alerts).

4.2 Consent (section 28(1)(a))

(a) Sending marketing communications (where the User has opted in);

(b) Responding to an enquiry submitted through a contact form;

(c) Storing a card for automatic renewal (where the User has given the separate permission described in section 3.1(f)).

4.3 Legitimate Interests (section 28(1)(b)(vii))

(a) Maintaining the security and integrity of the Services, including fraud prevention, abuse detection, limiting trials to one per person, and keeping a security audit trail;

(b) Improving the Services based on aggregated usage patterns;

(c) Administrative record-keeping and internal reporting.

4.4 Legal Obligation (section 28(1)(b)(ii))

(a) Retaining financial and billing records as required by Mauritian tax and commercial law;

(b) Responding to lawful requests from regulatory authorities.

5. DATA SHARING AND THIRD-PARTY PROCESSORS

5.1 Processors

The Company engages the following third-party processors in connection with the Services. Each processes personal data only on the Company's instructions and for the purposes described in this Policy.

5.2 No Sale of Personal Data

The Company does not sell, rent, or trade personal data to any third party.

5.3 Disclosure Within an Organisation

Where an Account belongs to an Organisation, the owner of that Organisation can see which Users hold its seats and the aggregate usage of the Organisation's allowance.

5.4 Disclosure Required by Law

The Company may disclose personal data where required to do so by any enactment, court order, or lawful request from a competent authority, in accordance with the DPA 2017.

6. CROSS-BORDER TRANSFERS

6.1 Nature of Transfers

By the nature of cloud-based services, personal data collected in Mauritius may be transferred to and processed in other countries, including Singapore, the United States, and South Africa, as detailed in Section 5.1 above.

6.2 Legal Basis for Transfers

Cross-border transfers of personal data are carried out in accordance with section 36 of the DPA 2017, on the following bases:

(a) Consent: By accepting this Policy, the User gives explicit consent to the transfer of personal data to the countries identified in Section 5.1, having been informed of the possible risks of such transfers (section 36(1)(b));

(b) Contractual necessity: Transfers are necessary for the performance of the contract between the User and the Company, including the provision of the Services (section 36(1)(c)(i)); and

(c) Appropriate safeguards: The Company selects processors that maintain appropriate technical and organisational security measures. Where available, the Company enters into data processing agreements that require processors to protect personal data to a standard consistent with the DPA 2017.

6.3 Specific Safeguards

(a) Payment card datais processed only by Peach Payments and never reaches the Company's servers.

(b) Encryption in transit:personal data is encrypted in transit between the User, the Site, the Connector and the Company's processors.

(c) AI model provider:text sent to the AI model provider is sent without the User's identity, Account details or IP address.

7. DATA RETENTION

7.1 Retention Periods

The Company retains personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by law:

7.2 Deletion

Upon expiry of the applicable retention period, personal data shall be securely deleted or anonymised. Where deletion is not technically feasible (for example, data embedded in backup systems), the Company shall ensure that such data is isolated and protected from further processing until deletion becomes feasible.

7.3 Account Deletion Requests

A User may request deletion of their Account from their Account settings. The request is recorded and carried out by the Company's staff, and is not instantaneous. Records the Company is required or entitled to keep — including invoices and payment records, consent records, and the evidence supporting a discounted Plan that has been applied — are retained for the periods stated above.

8. DATA SECURITY

8.1 Technical Measures

The Company implements the following technical measures to protect personal data:

(a) Encryption in transit: All communications between Users, the Site, and the Connector are encrypted using TLS/HTTPS.

(b) Authorisation of clients: Access to the Connector requires the User to sign in to their Account and authorise the MCP client. Authorisations can be reviewed and revoked by the User.

(c) Usage allowances: The Services enforce daily usage allowances per User or Organisation to prevent abuse.

(d) Password security: Passwords must be at least twelve characters and are stored in hashed form.

(e) Access control: Access to records in the database is restricted so that a User can read only their own records and those of their Organisation that they are entitled to see.

(f) Request content:As described in section 3.3, the Company's account database does not record the content of research requests. The service that searches the Knowledge Bases is not exposed to the internet and is reachable only from the Connector.

(g) Card data:Card payment data is handled exclusively by Peach Payments. No card data is stored on the Company's servers.

8.2 Organisational Measures

(a) Access to User data is restricted to authorised administrators of the Company.

(b) The Company selects processors that provide sufficient guarantees in respect of security and organisational measures, in accordance with the DPA 2017.

8.3 Research Preview Disclaimer

The Services are currently offered as a Research Preview — early access, evolving rapidly, with no service level agreement (SLA) or uptime guarantee. The Company continually reviews and enhances its security measures as the product matures.

9. RIGHTS OF DATA SUBJECTS

Under Part VII of the DPA 2017, Users have the following rights in respect of their personal data:

9.1 Right of Access (section 37)

You have the right to obtain confirmation as to whether your personal data are being processed and, if so, to receive a copy of such data together with information about the purposes of processing, categories of data, recipients, retention periods, and any automated decision-making.

9.2 Right to Rectification (section 39(1))

You have the right to have inaccurate personal data rectified without undue delay, and to have incomplete data completed.

9.3 Right to Erasure (section 39(2))

You have the right to request erasure of your personal data where the data are no longer necessary for the purpose for which they were collected, where you withdraw consent, where you object to processing, or where the data have been unlawfully processed. This right is subject to the exceptions set out in section 39(4) of the DPA 2017 (e.g., legal obligations, legal claims).

9.4 Right to Restriction of Processing (section 39(5))

You have the right to request restriction of processing in the circumstances specified in section 39(5) of the DPA 2017.

9.5 Right to Object (section 40)

You have the right to object at any time to the processing of your personal data on grounds relating to your particular situation, unless the Company demonstrates compelling legitimate grounds for the processing. Where personal data are processed for direct marketing purposes, you have the right to object at any time, and the data shall no longer be processed for that purpose.

9.6 Right to Withdraw Consent (section 24(2))

Where processing is based on consent, you have the right to withdraw your consent at any time. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.

9.7 Right to Lodge a Complaint

You have the right to lodge a complaint with the Data Protection Commissioner if you consider that the processing of your personal data infringes the DPA 2017. The Data Protection Office may be contacted at:

Data Protection Office

5th Floor, SICOM Tower

Wall Street, Ebene

Republic of Mauritius

Email: [email protected]

Website: https://dataprotection.govmu.org

9.8 How to Exercise Your Rights

To exercise any of the rights described above, please contact the Company at:

Data Protection Contact:

Lex Tech & Design Ltd

Suite 620, 6th Floor, St James Court, St Denis Street, Port-Louis, Mauritius

Email: [email protected]

The Company shall respond to your request within one (1) month of receipt. This period may be extended by a further month where necessary, taking into account the complexity and number of requests, in accordance with section 37(5) of the DPA 2017.

10. AUTOMATED DECISION-MAKING

10.1 Automated Processes

The Services involve the following automated processes:

(a) Subscription status management: Subscription statuses change automatically according to predefined rules (for example, a trial ending and the subscription returning to the Free Plan, or a subscription being cancelled after a renewal payment has remained unpaid). These changes directly affect access to the Services.

(b) Usage allowance enforcement: The Services automatically count requests and enforce daily allowances.

(c) Automated challenge: Certain forms apply an automated check to distinguish people from automated traffic.

10.2 Human Decisions

Applications for discounted Plans, and confirmation of payments made by bank transfer, are decided by a member of the Company's staff and not by automated means.

10.3 Human Oversight

No decision that significantly affects a User is made solely on the basis of automated processing without the possibility of human review. A User affected by an automated status change may contact the Company to have it reviewed.

11. COOKIES AND TRACKING

The Site uses cookies that are necessary for signing in and keeping a session. Forms protected by the automated challenge described in section 3.2(f) load a script from that provider. The Company does not currently deploy third-party analytics tools, advertising pixels, or tracking cookies on the Site.

12. CHILDREN

The Services are not directed at children under the age of eighteen (18). The Company does not knowingly collect personal data from minors. If the Company becomes aware that personal data has been collected from a minor, it shall take steps to delete such data promptly.

13. CONTACT INFORMATION

For any questions, concerns, or requests relating to this Policy or the processing of your personal data, please contact:

Lex Tech & Design Ltd

Suite 620, 6th Floor, St James Court, St Denis Street, Port-Louis, Mauritius

Email: [email protected]

Website: www.legaltech.mu

This Policy is governed by the laws of the Republic of Mauritius. Any dispute arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts of Mauritius.

Document Version: 3.0

Effective Date: 2 October 2026

Supersedes: Version 2.0 dated 23 March 2026