Privacy Policy

This Privacy Policy applies to personal data collected through our website and through our business communications with you. It does not apply to any third-party websites, applications or services that may be linked from our website; you should read the privacy policies of those third parties separately.

Last updated May 2026

Introduction

This Privacy Policy explains how Lexical Limited (“Lexical”, “we”, “us”, “our”) collects, uses and protects personal data in connection with our website at www.lexical.ltd and our business as a managed technology services provider.

We are committed to protecting the personal data of our website visitors, prospective clients, clients and business contacts, and to complying with the General Data Protection Regulation (Regulation (EU) 2016/679) (“GDPR”) and the Maltese Data Protection Act (Chapter 586 of the Laws of Malta).

Who is the Data Controller

The data controller responsible for your personal data is:

Lexical Limited

A company incorporated in Malta under company registration number C 86331.

Registered office: Regent House, 61 Bisazza Street, Sliema, SLM 1640, Malta.

Email: website@lexical.ltd

What Personal Data We Collect

The categories of personal data we may collect depend on how you interact with us.

3.1 When you visit our website

Our website is a static, single-page site that does not require you to register, log in or submit any personal data. We do not use tracking pixels or advertising cookies.

The only personal data automatically collected when you visit our website is the technical data our hosting provider records in standard server logs, which may include:

• your IP address;

• the date, time and duration of your visit;

• the pages you accessed and the URLs you were referred from;

• your browser type, operating system and device type; and

• other diagnostic information necessary for the security, availability and operation of the website.

Please see our Cookie Policy for further information on cookies and similar technologies used on the website.

3.2 When you contact us

The contact form on our website opens your own email client with a pre-populated email addressed to website@lexical.ltd. We do not receive or store any information you type into the form until you actually send the email from your own email client.

When you send us an email (whether via the contact form or directly), we receive:

• your name and email address;

• the content of your message and any attachments; and

• any additional contact information you choose to share.

3.3 When we engage with you as a business contact or client

If you are (or work for) a client, prospective client, supplier, professional advisor or other business counterparty, we may collect and process additional personal data in the ordinary course of the relationship, including:

• your name, job title, employer, business address, telephone number and email address;

• records of our correspondence and communications with you;

• administrative and billing information necessary to provide our services and manage the relationship; and

• any personal data you choose to share with us during the engagement.

Purposes and Legal Bases for Processing

We process personal data only where we have a lawful basis to do so under Article 6 of the GDPR. The main purposes and legal bases are:

• Responding to enquiries. We process contact information and message content in order to respond to enquiries you submit through our website or by email. Legal basis: legitimate interests (Article 6(1)(f) GDPR), namely responding to communications initiated by you.

• Providing our services. Where you are a client, we process personal data in order to enter into and perform our services agreement with you or your organisation. Legal basis: performance of a contract (Article 6(1)(b) GDPR), or legitimate interests in managing the business relationship where the contract is with your employer.

• Managing our business. We process personal data as necessary to operate our business, including accounting, billing, supplier management, professional-advisor engagement and record-keeping. Legal basis: legitimate interests (Article 6(1)(f) GDPR), or compliance with legal obligations (Article 6(1)(c) GDPR).

• Operating and securing our website. We process technical data recorded in server logs in order to operate, secure, monitor and troubleshoot our website. Legal basis: legitimate interests (Article 6(1)(f) GDPR), namely maintaining a functional and secure online presence.

• Complying with legal obligations. We may process personal data in order to comply with legal, regulatory, tax and accounting obligations to which we are subject in Malta and the European Union. Legal basis: compliance with a legal obligation (Article 6(1)(c) GDPR).

How Long We Keep Personal Data

We retain personal data only for as long as necessary for the purposes for which it was collected, taking into account applicable legal, accounting and tax retention obligations.

• Contact enquiries. Personal data received through the contact form or by email is retained for up to 24 months from the last communication, unless the correspondence forms part of an ongoing client, supplier or professional relationship.

• Client, supplier and business records. Personal data relating to clients, suppliers and other business counterparties is retained for the duration of the relationship and, following its termination, for a further period of up to ten (10) years to comply with Maltese accounting, tax and commercial record-keeping requirements, or longer where a specific legal obligation requires it.

• Server logs. Technical data recorded in server logs is retained for short periods (typically a small number of weeks or months) sufficient to allow diagnostics, security review and operational monitoring, and is thereafter automatically overwritten or deleted.

We do not sell personal data to any third party, and we do not share personal data for advertising or marketing purposes.

We may share personal data with the following categories of recipient, only to the extent necessary for the purposes described in this Privacy Policy:

• Service providers we rely on. Including our website hosting provider, email service provider, telecommunications providers, IT infrastructure providers, professional advisors (accountants, auditors, lawyers) and banks. These recipients act as either data processors on our behalf under appropriate contractual arrangements, or as independent controllers where required for their own services (for example, our accountants and lawyers).

• Public authorities and regulators. Where we are legally required or permitted to disclose personal data to a court, regulator, tax authority or other public authority, whether in Malta or in another relevant jurisdiction.

• Successors and advisors in corporate transactions. In the context of a merger, acquisition, reorganisation, restructuring, financing, insolvency or sale of business or assets, we may disclose personal data to relevant counterparties and their professional advisors, subject to appropriate confidentiality obligations.

International Data Transfers

Most of our processing takes place within the European Economic Area (EEA). Where personal data is transferred outside the EEA, we take steps to ensure that an appropriate level of protection is provided in accordance with Chapter V of the GDPR. This may include transfers to countries that benefit from a European Commission adequacy decision, or transfers subject to the European Commission’s Standard Contractual Clauses together with any supplementary measures we consider appropriate.

You can request further information about the safeguards applied to international transfers of your personal data by contacting us using the details in Section 12.

Your Rights

Subject to the conditions set out in the GDPR, you have the following rights in relation to your personal data:

• Right of access. To obtain confirmation as to whether we process personal data about you and, if so, to obtain a copy of that personal data and information about how we process it.

• Right to rectification. To have inaccurate personal data corrected and incomplete personal data completed.

• Right to erasure. To have personal data deleted in certain circumstances, sometimes referred to as the “right to be forgotten”.

• Right to restriction of processing. To have the processing of your personal data restricted in certain circumstances.

• Right to data portability. To receive certain personal data in a structured, commonly used, machine-readable format and to have that data transmitted to another controller, where technically feasible.

• Right to object. To object to processing carried out on the basis of our legitimate interests, on grounds relating to your particular situation.

• Right to withdraw consent. Where we rely on your consent, to withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, please contact us using the details in Section 12. We will respond to your request within one month, subject to any extension permitted by the GDPR.

Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and access. These measures include access controls, encryption in transit, backup arrangements, staff confidentiality obligations and the use of reputable service providers.

No transmission of information over the internet and no method of electronic storage is entirely secure. While we take reasonable steps to protect your personal data, we cannot guarantee its absolute security.

Cookies

For information about the cookies and similar technologies used on our website, please see our Cookie Policy at www.lexical.ltd/cookie-policy.html.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in the services we offer or in applicable law. The current version is always the version published at www.lexical.ltd/privacy-policy.html, and the “Effective from” date at the top of the policy indicates when the current version was last updated. We encourage you to review this Privacy Policy periodically.

How to Contact Us and How to Complain

If you have any questions about this Privacy Policy, wish to exercise any of your rights, or have a concern about how we handle your personal data, please contact us at: