GDPR Compliance

Your Rights Under GDPR

Right to Access

Request a copy of your personal data we hold

Right to Rectification

Correct inaccurate or incomplete data

Right to Erasure

Request deletion of your personal data

Right to Restrict Processing

Limit how we use your data

Right to Data Portability

Receive your data in a portable format

Right to Object

Object to processing for certain purposes

Rights Related to Automated Decisions

Challenge decisions made solely by algorithms

Right to Withdraw Consent

Withdraw consent at any time

Lawful Basis for Processing

We process personal data under the following lawful bases: • **Contract Performance**: Processing necessary to provide our services • **Legitimate Interests**: Improving services, security, and fraud prevention • **Legal Obligations**: Compliance with applicable laws and regulations • **Consent**: Where you have explicitly agreed to processing

International Data Transfers

When we transfer data outside the EEA, we ensure adequate protection through: • Standard Contractual Clauses (SCCs) approved by the European Commission • Adequacy decisions for countries with equivalent protection • Binding Corporate Rules for intra-group transfers • Your explicit consent where appropriate

Data Retention

We retain personal data only as long as necessary: • Account data: Duration of account plus 30 days • Documents: Deleted within 30 days of processing • Billing records: 7 years (legal requirement) • Support inquiries: 2 years for quality purposes You can request earlier deletion at any time.

Data Protection Officer

Our DPO oversees GDPR compliance: **Contact**: dpo@getlexorbit.com **Address**: 123 Legal Tech Plaza, San Francisco, CA 94102 The DPO is available to address any questions or concerns about how we handle your personal data.