Privacy Policy

Last updated: 4 September 2026. Governing law: Commonwealth of The Bahamas. This policy also addresses GDPR obligations for EU/UK data subjects.

1. Who we are

Lex is a product of Genesys Company Limited (trading as Genesys Now), a company incorporated in the Commonwealth of The Bahamas ("Genesys Now", "we", "us", "our"). Our registered address is 14 Collins Avenue, Nassau, New Providence, The Bahamas. We operate the Lex legal practice management platform at lex.law and any associated subdomains.

For the purposes of the General Data Protection Regulation (GDPR) and UK GDPR, where applicable, Genesys Company Limited is the data controller.

Contact us about privacy matters: support@lex.law

2. What data we collect

2.1 Marketing website visitors (lex.law)

• Information you submit via the demo request form: name, email address, firm name, firm size, phone number
• IP address (used for demo fraud prevention — see Section 5)
• Browser type, operating system, and referrer URL (collected automatically via server logs)
• Cookie identifiers (see our Cookie Policy)

2.2 Lex platform users (firms and their staff)

• Account information: name, email address, phone number, role, bar admission number
• Authentication data: hashed passwords, TOTP secrets (never stored in plain text), session tokens
• Usage data: login timestamps, actions performed, IP addresses (recorded in the tamper-evident audit log)
• Professional data entered into the platform: case details, client records, documents, invoices, notes, voice recordings, and their associated metadata

2.3 Data about your clients (as a law firm)

When your firm uses Lex, you enter personal data about your clients (the individuals and companies you represent). In relation to that data, your firm is the data controller and Genesys Now is the data processor. We process that data only on your firm's instructions, as described in Section 4.

3. How we use your data

Purpose	Lawful basis
Providing and operating the Lex platform	Contract (Article 6(1)(b) GDPR)
Sending demo invitation emails	Consent (Article 6(1)(a) GDPR)
Sending transactional emails (hearing alerts, invoices, password reset)	Contract
Fraud prevention on demo requests (IP and email rate limiting)	Legitimate interests (Article 6(1)(f) GDPR)
Security monitoring and tamper-evident audit logging	Legitimate interests / Legal obligation
Billing and payment processing	Contract
Responding to contact form enquiries	Consent / Legitimate interests
Improving the platform	Legitimate interests

We do not use your data for advertising. We do not sell your data. We do not share your data with third parties except as described in Section 6.

4. Data processing on behalf of law firms

The personal data that law firms enter into Lex (client names, case details, documents, etc.) is processed by Genesys Now as a data processor acting on the firm's instructions. The firm, as data controller, is responsible for ensuring it has a lawful basis for the personal data it enters, and for responding to its clients' data rights requests.

Genesys Now will:

• Process firm data only in accordance with the firm's instructions and this privacy policy
• Implement appropriate technical and organisational security measures
• Not transfer firm data outside the region without appropriate safeguards
• Delete or return all firm data upon termination of the subscription
• Assist the firm in responding to data subject rights requests where technically possible

5. Demo fraud prevention

To prevent abuse of the free demo system, we record the IP address and email address of each demo request and limit each to a maximum of two demo environments. This data is used only for this purpose and is not shared with third parties. The lawful basis for this processing is our legitimate interests in operating a fair and sustainable demo service.

6. Who we share data with

Third party	Purpose	Location
SendGrid (Twilio)	Transactional email delivery	USA (SCCs apply)
Twilio	SMS hearing alerts	USA (SCCs apply)
OpenAI	Voice transcription (Whisper API)	USA (SCCs apply)
Anthropic	AI analysis and summaries (Claude API)	USA (SCCs apply)
PowerTranz / Bank of The Bahamas	Payment processing	The Bahamas
Amazon Web Services	Cloud hosting and infrastructure	USA / configurable region

Where data is transferred outside the Bahamas or EEA, we rely on Standard Contractual Clauses (SCCs) or other appropriate safeguards. We do not transfer data to countries without adequate protection without appropriate mechanisms in place.

7. Data retention

• Demo environments: deleted in full after 6 hours of activation (automated)
• Demo request logs (email + IP): retained for 12 months for fraud prevention, then deleted
• Active firm data: retained for the duration of the subscription
• Audit logs: retained for 7 years (financial and legal compliance requirement)
• Billing records: retained for 7 years (tax and financial record-keeping)
• Contact form submissions: retained for 24 months, then deleted

Upon subscription cancellation, firm data is retained for 30 days during which a full export can be requested. After 30 days, all firm data is permanently deleted.

8. Your rights

Depending on your location, you may have the following rights in relation to your personal data:

• Right of access: request a copy of the personal data we hold about you
• Right to rectification: request correction of inaccurate data
• Right to erasure: request deletion of your data (subject to legal retention obligations)
• Right to portability: receive your data in a structured, machine-readable format
• Right to restriction: request we limit our processing of your data
• Right to object: object to processing based on legitimate interests
• Right to withdraw consent: where processing is based on consent, withdraw it at any time

To exercise any of these rights, contact us at support@lex.law. We will respond within 30 days. EU/UK data subjects have the right to lodge a complaint with their relevant supervisory authority.

9. Cookies

We use cookies on the marketing website and in the Lex platform. For full details, see our Cookie Policy.

10. Children

Lex is a professional B2B platform intended for use by law firms and their staff. It is not directed at children under 18. We do not knowingly collect personal data from anyone under 18.

11. Changes to this policy

We may update this policy from time to time. We will notify active subscribers of material changes by email at least 14 days before the change takes effect. The current version is always available at lex.law/privacy.

12. Contact

Genesys Company Limited (t/a Genesys Now)
14 Collins Avenue, Nassau, New Providence, The Bahamas
support@lex.law