Data Protection — Lexa

01Overview

Lexa Labs Inc. is committed to protecting your personal data in accordance with Ghana's Data Protection Act, 2012 (Act 843) — the primary legislation governing the collection, processing, and storage of personal information in Ghana.

This page explains what the Act requires, what rights it gives you, and exactly how Lexa fulfils its obligations as a data controller.

If you are a resident of the European Union, additional rights under the GDPR may apply. Contact us for more information.

02Ghana Data Protection Act (Act 843)

The Data Protection Act 2012 regulates the processing of personal data in Ghana. It requires data controllers (like Lexa) to:

Collect data only for a specified, explicit, and lawful purpose
Ensure data is accurate, adequate, relevant, and not excessive
Not retain data longer than necessary
Take appropriate technical and organisational security measures
Register with the Data Protection Commission (DPC) of Ghana
Respect the rights of data subjects (you)

Lexa is registered with the Data Protection Commission of Ghana as a data controller.

03Your Rights as a Data Subject

Under Act 843, you have the following rights regarding your personal data:

Type	Details
Right to Access	Request a copy of all personal data we hold about you. We will provide this within 30 days.
Right to Correction	Request that inaccurate or incomplete data be corrected or updated.
Right to Deletion	Request deletion of your personal data, subject to legal retention requirements.
Right to Object	Object to processing of your data for specific purposes, including direct marketing.
Right to Portability	Receive your data in a structured, commonly used, machine-readable format.
Right to Restriction	Request that we restrict processing of your data in certain circumstances.

To exercise any of these rights, email privacy@neesimera.com. We will respond within 30 days. Requests are free of charge.

04Lawful Basis for Processing

We process your personal data only where we have a lawful basis under Act 843:

Type	Details
Contract performance	Processing necessary to deliver the Services you signed up for (e.g., contract analysis, account management).
Legitimate interests	Analytics and fraud prevention, where our interests don't override your rights.
Legal obligation	Retaining financial records as required by Ghanaian tax law.
Consent	Marketing communications — you can withdraw consent at any time.

05AI Processing of Legal Documents

When you upload a contract for analysis, your document is processed by one or more AI providers (Groq, Google Gemini, Anthropic Claude, OpenAI). We take the following steps to protect your data:

Documents are transmitted over encrypted TLS connections
AI providers process documents for analysis only — they do not retain content beyond the request
We have data processing agreements with all AI providers
We never use your documents to train AI models
Analysis results are stored securely and associated only with your account

You control your documents. You can delete any uploaded contract at any time from within the platform.

06International Data Transfers

Some of our service providers are based outside Ghana (e.g., US-based AI providers). When we transfer data internationally, we ensure appropriate safeguards are in place:

Standard contractual clauses (SCCs) with data processors
Data processing agreements requiring equivalent protection
Minimising the personal data included in AI prompts
Using anonymisation or pseudonymisation where possible

07Technical & Organisational Measures

We implement the following measures to protect your data:

Type	Details
Encryption in transit	TLS 1.3 for all data transmission
Encryption at rest	AES-256 for stored documents and databases
Access control	Role-based access; least-privilege principle
Audit logging	All access to personal data is logged
Vulnerability management	Regular security audits and penetration testing
Incident response	Data breach notification within 72 hours per best practice

08Filing a Complaint

If you believe we have not handled your personal data in accordance with Act 843, you have the right to file a complaint with:

Type	Details
Lexa (first step)	privacy@neesimera.com — we aim to resolve complaints within 30 days
Data Protection Commission	The DPC of Ghana — www.dataprotection.gov.gh

We take all complaints seriously and will work transparently to resolve any concerns.

09Contact Our Data Protection Team

For data protection enquiries, contact our Data Protection Officer:

Type	Details
Email	privacy@neesimera.com
Response time	Within 30 days of receiving your request
Company	Lexa Labs Inc., Accra, Ghana