Privacy Policy

1. Introduction

“TESLA QUANTUM CORE” limited liability company, with its registered seat in Banja Luka, Ulica Jovana Dučića 14, 78000 Banja Luka, Bosnia and Herzegovina, registration number (MB): 11261094, tax identification number (PIB): 4405283000006 (hereinafter: the “Company”, “we” or the “Controller”), as the provider of Lexra — an application for legal practice and law firm management available through the lexra.io and lexra.biz websites and through the Lexra mobile applications for Android and iOS devices (hereinafter jointly: the “Application” or the “Service”) — treats the protection of personal data as a priority and processes personal data in accordance with this Policy.

This Policy has been drawn up in accordance with Regulation (EU) 2016/679 — the General Data Protection Regulation (hereinafter: the “GDPR”) — as the baseline standard of protection, as well as with other data protection laws applicable in the jurisdictions in which we offer the Service. If the laws of the jurisdiction in which you are located provide for additional or broader rights than those described here, those rights belong to you in full and you may exercise them in the same manner — by contacting us using the contact details set out in this Policy.

The terms used in this Privacy Policy (hereinafter: the “Policy”), such as “personal data”, “processing”, “controller”, “processor” and “personal data breach”, have the meaning given to them in Article 4 of the GDPR.

The governing version of this document is the English version, available from the Application and on the lexra.io website. A Serbian-language version is provided for convenience and is available, together with the other Serbian-language documents, on the lexra.biz website.

This Policy contains the information we are required to provide to the individuals whose personal data we process: what data we collect, for what purposes, on what legal basis, to whom we disclose it, how long we keep it, and what rights you have in relation to the processing.

2. Roles: Controller and Processor

Depending on the specific processing activity, the Company acts in two distinct roles:

The Company as Controller. This Policy applies to the processing of personal data that the Company carries out on its own behalf, determining the purposes and means of the processing. This covers: data of individuals who register a user account and use the Application (account data, billing data), data of visitors to the lexra.io and lexra.biz websites, data of individuals who communicate with us, and data of individuals subscribed to the newsletter.

The Company as Processor. The content that customers enter into the Application in the course of their work — matters, documents, data about clients and other individuals appearing in the customer’s records — is processed by the Company solely on behalf of and under the documented instructions of the customer, who acts as the controller of that data. That processing is not governed by this Policy but by the Data Processing Agreement (DPA), available at: https://lexra.io/data-processing-agreement. The customer of the Application is responsible for the lawfulness of the collection and processing of the personal data it enters into the Application, including the obligation to inform the data subjects and to ensure an appropriate legal basis for the processing.

3. Processing principles

The Company processes personal data in accordance with the principles of: lawfulness, fairness and transparency; purpose limitation; data minimisation; accuracy; storage limitation; integrity and confidentiality; and accountability.

In particular, this means that:

• we base every processing operation on an appropriate legal basis;
• we collect data for specified, explicit and legitimate purposes;
• we process only the data necessary to achieve the purpose;
• we keep data only for as long as is necessary for the purpose; and
• we apply appropriate technical and organisational protection measures.

4. What data we process, for what purposes and on what basis

4.1 Registration and management of the user account

To create an account we mandatorily collect: first and last name and e-mail address. Optionally, you may provide a username and a contact telephone number. If you register as a business entity, we also process: the registration number of the registered natural person, the tax number of the natural person, and the address of the registered seat of the natural person performing the activity. Your password is stored exclusively in cryptographically protected (hashed) form and is never available to us in readable form.

We process this data because it is necessary for the conclusion and performance of the contract with the customers of the Application, and we retain certain data in order to comply with our legal obligations.

4.2 Billing and financial operations

Payments for the Service are processed through the Paddle service and the PayPal service, at the customer's choice at the time of payment. When you pay through the Paddle Checkout, the seller (merchant of record) is Paddle — an authorised reseller of the Service: Paddle.com Inc. for customers from the United States, Paddle.com (Canada) Ltd. for customers from Canada, and Paddle.com Market Limited, London, United Kingdom, for customers from all other countries (hereinafter: “Paddle”). With respect to the data it processes for billing purposes and the provision of its services, Paddle acts as an independent controller: the data you enter when paying through the Paddle Checkout — including payment card details or details of another means of payment — is collected and processed exclusively by Paddle, in accordance with its buyer terms and its privacy policy, available on Paddle's website. Paddle processes data primarily in the United Kingdom and the United States of America, with possible processing in other countries in which Paddle and its service providers operate; transfers to the United Kingdom are covered by the European Commission's adequacy decision, and other transfers are carried out subject to appropriate safeguards (standard contractual clauses and intra-group agreements). When you pay directly through the PayPal service, payments are processed by the companies of the PayPal group — for customers from the European Union and the EEA, as a rule, PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg, and for other customers the PayPal entity determined by PayPal's legal agreements for the relevant country — and its affiliates (hereinafter: “PayPal”). Payment is made using your PayPal account. With respect to the data it processes in order to provide payment services, PayPal acts as an independent controller: the data you enter when making a payment — including your PayPal account details — is collected and processed exclusively by PayPal, in accordance with its terms of use and its privacy statement, available on PayPal's website. PayPal processes payment data primarily in the European Union (Luxembourg) and the United States of America, with possible processing in other countries in which PayPal and its service providers operate, applying appropriate safeguards for data transfers (standard contractual clauses and intra-group agreements). For customers from Bosnia and Herzegovina, e-commerce card payment is also available through the payment gateway service of Nova Banka a.d. Banja Luka (“Nova Banka”). With respect to the data it processes in order to execute payment transactions, Nova Banka acts as an independent controller: you enter your payment card details on Nova Banka's secure payment page and that data is processed exclusively by Nova Banka, in accordance with its terms, its privacy policy and the rules of the card organisations. The Company does not receive, store or transfer payment card data.

We do not receive or store your full payment card details. Within the Application we retain only technical and business payment metadata: transaction identifier, payment status, amount and time of the transaction, as well as the data necessary for issuing invoices.

We process this data because it is necessary for the performance of our contract with you (charging the subscription and managing the subscription relationship), and we retain records of completed payments in order to comply with our tax and accounting obligations, within the periods prescribed by applicable law.

Where a customer or the card issuing bank disputes a payment transaction made by e-commerce payment, we also process the data relating to that transaction in order to handle that dispute: we receive the notice of the dispute and we collect and provide the payment service provider with documentation concerning the charge, the invoice issued and the Service provided, including records of the activation and use of the Subscription. We carry out this processing in order to comply with our contractual obligation towards the payment service provider and for the establishment or defence of legal claims.

Where a change to the Subscription during a billing period results in a credit (Subscription Credit, governed in more detail by the Terms of Service), the balance is held by the seller of the Subscription. Where Paddle is the seller, the balance is held by Paddle on the customer’s billing account, and the Application reads the amount of the available credit from Paddle for display to the administrator and does not store it; where Lexra is the seller, we keep the record of the credit as part of the technical and business payment metadata and financial documentation, within the periods set out in Section 9.

4.3 Communication and technical support

When you contact us (by e-mail, telephone or otherwise), we process your first and last name, e-mail address and any other data you choose to share with us, to the extent necessary to respond to your enquiry.

We process this data because it is necessary in connection with the conclusion or performance of the contract with the customers of the Application, and, where your enquiry does not relate to the contract, on the basis of your informed consent, which you may withdraw at any time, without affecting the lawfulness of processing carried out before the withdrawal.

4.4 Newsletter and marketing communications

If you subscribe to the newsletter, we process your first and last name and e-mail address for the purpose of sending information about the Company’s news, benefits and activities. Subscribing to the newsletter is not a condition for using the Application.

We process this data on the basis of your informed consent, which you may withdraw at any time (via the unsubscribe link in every message or by contacting the Company), without affecting the lawfulness of processing carried out before the withdrawal. In certain cases the Company may use profiling for marketing and service-improvement purposes, but such processing does not involve automated decision-making.

If you enter a prize contest or sign up for a promotional offer of the Company, we process the data from your entry in order to run the contest or activate the offer, on the basis of your acceptance of the separate rules published with the contest or offer, in accordance with those rules and this Policy.

4.5 Website and analytics

When you visit the lexra.io or lexra.biz website, data may be processed — subject to your consent — through analytics cookies (e.g. anonymised IP address, browser and device type, navigation behaviour). The details are set out in the Cookie Policy, available at: https://lexra.io/cookie-policy. The Application itself, including the mobile applications, does not use cookies or any advertising, user-tracking or marketing-profiling technologies. The technical processing of a device token for the sole purpose of delivering push notifications in the mobile application is described in Section 4.7.

We process this data on the basis of your informed consent (for analytics cookies), or on the basis of the Company’s legitimate interest in providing the strictly necessary technical functions of the website.

4.6 System security

In order to protect the Application and our infrastructure from abuse and attacks, we process technical data such as IP address, device and browser information, access patterns and login attempts, as well as security and audit logs of actions performed in the system.

We process this data in pursuit of the Company’s legitimate interest in ensuring the security, integrity and availability of the Service, and in order to comply with our legal obligations to the extent that keeping such records is required by law.

4.7 Mobile applications

The Lexra mobile applications for Android and iOS allow existing users to sign in to their user account; it is not possible to register a new account within the mobile application. No purchases are made and no payment data is entered within the mobile application; Subscriptions are concluded exclusively through the web platform.

The mobile application uses the Google Firebase Cloud Messaging (FCM) service to deliver push notifications about matters, tasks, deadlines and activities. On iOS devices, notifications are delivered via the Apple Push Notification service (APNs) operated by Apple Inc. For this purpose, we process a device token or application instance identifier, solely in order to deliver notifications to the correct device; this identifier is not used for advertising, tracking or profiling purposes. You may disable push notifications at any time in your device settings, without affecting your ability to use the Application.

We process this data because it is necessary for the performance of the contract with the customers of the Application, or on the basis of the Company's legitimate interest in providing the notification functionality of the Service.

4.8 Google services and Google user data

Google Sign-In. If you choose to connect your Google account to your Lexra account, Lexra receives your Google account identifier, email address and name. Lexra uses them only to let you sign in to your existing Lexra account with Google. Lexra does not receive or store your Google password or Google access tokens for sign-in.

Google Drive storage. If your office chooses Google Drive as its document storage, Lexra requests the drive.file permission. With it Lexra can access only the files and folders it creates in your Google Drive or that you explicitly select in the Google folder picker — Lexra does not request broad access to your entire Google Drive. Lexra uses this access only to store, read, version, preview, rename and delete your office’s documents at your request. Lexra stores the OAuth tokens needed for this on its servers and uses them only for this purpose.

Sharing. Lexra does not sell Google user data, does not use it for advertising, and does not transfer it to third parties except as necessary to provide the service, to comply with law, or as part of a merger or acquisition with notice to you. Lexra personnel do not access the contents of your documents except when you request support and authorize such access, or where access is required for security or legal reasons.

Removal. You can disconnect Google Drive in office settings; Lexra then revokes its access at Google and deletes the stored tokens. You can unlink Google Sign-In in your profile settings; Lexra then removes the link and the Google email stored with it (Lexra does not store Google tokens for Sign-In). You can also remove Lexra’s access at any time at https://myaccount.google.com/permissions. Documents already stored in your Google Drive remain in your Drive.

Lexra’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

5. Special categories of data

The Company, as Controller, does not collect or process special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic and biometric data, or data concerning health, sex life or sexual orientation). If the records that customers enter into the Application contain such data, that data is processed exclusively on behalf of the customer as controller, under the terms of the Data Processing Agreement (DPA) and with appropriate protection measures applied.

6. How we collect data

We collect personal data primarily directly from the data subjects (upon registration, communication or newsletter sign-up). Where we do not obtain the data directly — e.g. where an account administrator adds authorized users — we require that the person providing the data is authorised to disclose it and that they inform the data subjects about the processing, or refer them to this Policy.

7. Recipients of data

Personal data may be disclosed to the following categories of recipients, solely to the extent necessary to achieve the purpose of the processing:

• Cloud infrastructure providers (processors): Microsoft Azure and Amazon Web Services (AWS), on whose infrastructure the Application, the database, the built-in document storage, backups and cryptographic key management are hosted, in regions that geographically correspond to the customer’s location or that the customer selects (for customers from the EU/EEA, primarily within the EU/EEA);
• Payment service providers: Paddle (seller — merchant of record; an independent controller with respect to the data it processes for billing purposes), PayPal (an independent controller with respect to the data it processes in order to provide payment services) and Nova Banka a.d. Banja Luka (an independent controller with respect to the data it processes in order to execute payment transactions — e-commerce payment for customers from Bosnia and Herzegovina);
• Push notification service providers: Google (Google Ireland Limited / Google LLC), as a processor, for the delivery of push notifications via the Firebase Cloud Messaging service, and Apple Inc., for the delivery of push notifications on iOS devices via the Apple Push Notification service. Where the related processing involves transfers to third countries, such transfers are carried out in accordance with Section 8 of this Policy (adequacy decisions or appropriate safeguards, primarily standard contractual clauses);
• External document storage services (Google Drive, Microsoft OneDrive) — only if the customer connects them itself; the selection, configuration and terms of use of those services are the customer’s responsibility, and the processing of Google user data is described in more detail in Section 4.8 of this Policy;
• The accounting agency and providers of professional services (legal, audit), bound by confidentiality obligations;
• Companies maintaining our IT systems and other sub-contractors providing services on our behalf, authorised to use the data only to the extent necessary to provide those services;
• Competent public authorities, where necessary for the Company to comply with its legal obligations, with access limited to the minimum required to satisfy the specific legal request.

The Company has data processing agreements in place with its processors, or the processing is carried out under their standard data processing terms compliant with the GDPR, and the Company remains responsible for the processing operations it has entrusted to them. An up-to-date list of sub-processors is available in Annex 1.3 of the Data Processing Agreement (DPA).

8. Transfers of data to third countries

Data is stored and processed in the data centres of our cloud infrastructure providers, in the region that geographically corresponds to the customer’s location or that the customer selects, and for customers from the EU/EEA primarily within the EU/EEA. If individual processing operations take place in third countries (e.g. the USA or other countries outside the EU/EEA), the transfer is carried out exclusively:

• to countries covered by a European Commission adequacy decision, or
• subject to appropriate safeguards, primarily the standard contractual clauses adopted by the European Commission, with supplementary measures where necessary.

9. Data retention periods

We keep data only for as long as is necessary to achieve the purpose for which it was collected, taking into account our legal obligations:

• User account data and account content: for the duration of the subscription and for a further 90 days after the subscription ends, during which the customer may reactivate the account, request an export of the data or raise claims relating to rights and obligations arising from the period of use. After the 90 days expire, the data is permanently deleted from active systems. Residual copies may temporarily persist in encrypted backups until they expire in the regular backup cycle;
• Data collected on the basis of consent (including the newsletter): until consent is withdrawn. After withdrawal, the data is deleted or anonymised without undue delay, and at the latest within 10 days;
• Financial and accounting records (including records of completed payments): for the periods prescribed by applicable tax and accounting regulations;
• Documentation concerning payment transactions and the Service provided that serves as evidence in a payment transaction dispute (including records of the charge, the invoice issued and the activation and use of the Subscription): 18 months from the date of the transaction, including after the period referred to in the first indent of this Section has expired, after which it is deleted unless another ground for retention exists;
• Security and audit logs: for a period limited to what is necessary to ensure system security, demonstrate the integrity of processing and comply with legal obligations, after which they are deleted or archived.

Deletion of a user account within the Application may be initiated by the customer's account administrator for the users of its office. In addition, any user may at any time request the deletion of their user account and the associated personal data directly, by contacting the Company using the contact details set out in Section 14 of this Policy. Deletion is carried out in accordance with the retention periods set out in this Section and with the Terms of Service.

10. Rights of data subjects

Under the GDPR, you have the following rights:

• Right of access — to obtain confirmation as to whether we process your data, information about the processing and a free copy of the data;
• Right to rectification — to have inaccurate data corrected and incomplete data completed without undue delay; you can update most of your account data yourself in the account settings;
• Right to erasure (“right to be forgotten”) — to request the deletion of your data where the conditions under the GDPR are met; please note that we must retain certain data in order to comply with legal obligations or to establish, exercise or defend legal claims;
• Right to restriction of processing — the right to require that we temporarily only store your data, without further use — for example while the accuracy of data you have contested is being verified, or while your objection to processing is being assessed; during the restriction we process the data only with your consent or for the establishment, exercise or defence of legal claims;
• Right to data portability — to receive the data you have provided to us in a structured, commonly used and machine-readable format and to transmit it to another controller;
• Right to object — to processing based on legitimate interest, and, at any time and without giving reasons, to processing for direct marketing purposes;
• Rights relating to automated decision-making — the Company does not make decisions based solely on automated processing that produce legal effects or similarly significantly affect individuals;
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before the withdrawal;
• Right to be notified of a data breach — where a breach is likely to result in a high risk to your rights and freedoms;
• Right to lodge a complaint with a supervisory authority — the authority competent for personal data protection, without prejudice to any other legal remedy.

To exercise your rights, contact the Company using the contact details in Section 14. We will respond to your request without undue delay and at the latest within 30 days of receipt; this period may be extended by a further two months where necessary due to the complexity or number of requests, in which case we will inform you.

11. Data protection measures

The Company applies appropriate technical and organisational data protection measures, including in particular:

• encryption of data at rest (AES-256) and in transit (TLS);
• strict role-based access control (RBAC) and the principle of least privilege;
• authentication through unique accounts, hashed passwords and short-lived, regularly refreshed security tokens (JWT);
• logical isolation of the data of different customer offices in a multi-tenant system;
• encrypted, access-restricted audit logs of security- and business-relevant events;
• regular backups and tested data recovery procedures;
• pseudonymisation and anonymisation of personal data in documents;
• physical protection of data centres provided by the cloud providers in accordance with industry standards and certifications.

A detailed description of the measures is available in Annex 1.2 of the Data Processing Agreement (DPA).

12. Handling personal data breaches

In the event of a personal data breach, the Company will, without undue delay: assess the nature and risk of the breach; where applicable, notify the competent supervisory authority within 72 hours of becoming aware of it; notify the data subjects where the breach is likely to result in a high risk to their rights and freedoms; and take all necessary measures to contain and mitigate the consequences of the breach. Where we act as a processor, we notify the affected customers, as controllers, of the breach without undue delay and at the latest within 72 hours, in accordance with the Data Processing Agreement (DPA).

13. Minors

The Service is intended for legal professionals and persons over 18 years of age. The Company does not knowingly collect personal data of minors. If we learn that we have collected a minor’s personal data without an appropriate basis, we will delete that data without delay.

14. Contact and the person responsible for data protection

The Company has designated a person responsible for personal data protection (Privacy Officer), whom you can contact with any questions regarding the processing of personal data and in order to exercise your rights, at the e-mail address: support@lexra.io. We respond to requests without undue delay and at the latest within 30 days, with the possibility of an extension in complex cases in accordance with Section 10 of this Policy.

You can also contact the Company:

• by telephone: +387 51 498 410
• by post: Jovana Dučića 14, 78000 Banja Luka, Bosnia and Herzegovina

15. Changes to this Policy

This Policy enters into force on the day of its publication and is available on the Websites (the English version at lexra.io, the Serbian-language version at lexra.biz) and at the Company’s business premises. The Policy may be updated from time to time. Data subjects will be notified of all material changes via the website, or by e-mail where appropriate, and changes enter into force on the day of publication. We recommend that you review the Policy regularly.

‍