SOREX Suite Privacy Policy

1. Introduction

Techxon Innovation Limited (“Techxon,” “we,” “us,” or “our”) is committed to protecting personal information processed through SOREX Suite.

SOREX Suite provides business software, enterprise management tools, communication services, workflow automation, access-management solutions, and related digital products.

This Privacy Policy explains how we collect, use, disclose, store, protect, and delete personal information in connection with our websites, applications, subscriptions, customer support, and associated services.

This Policy applies to personal information processed by Techxon in its own capacity and, where relevant, describes how we process information on behalf of organizational Customers.

Depending on the activity, Techxon may act as a data controller, determining the purposes and means of processing, or as a data processor acting on a Customer's documented instructions.

2. Scope of This Policy

This Policy applies across SOREX Suite, including:

• SOREX ERP and business management applications.
• HR, attendance, procurement, inventory, finance, and workflow modules.
• SOREX Meet and collaboration services.
• SOREX Mail and email services.
• SOREX Access Control, including ProAccess and VIP Access.
• SOREX Appointment Management.
• Customer account management, billing, support, websites, and integrations.

Individual products may publish additional privacy notices explaining specific data collection, such as meeting recordings, email processing, visitor records, access logs, or biometric functionality.

Where a product-specific notice or a signed agreement establishes additional requirements for a particular processing activity, that notice or agreement will apply to the extent stated and permitted by law.

3. Personal Information We Collect

The information collected depends on the product, features enabled, Customer configuration, and your relationship with Techxon.

4. How We Use Personal Information

We may process personal information to:

• Create and administer accounts.
• Provide the SOREX products and features requested.
• Manage organizational tenants, user permissions, and subscriptions.
• Operate workflows, communications, appointments, and business processes.
• Maintain service availability and performance.
• Authenticate users and protect accounts.
• Detect fraud, spam, malware, unauthorized access, and other security threats.
• Provide technical support and resolve service issues.
• Process payments and manage billing where applicable.
• Communicate service updates, security notices, and relevant administrative information.
• Improve reliability and develop our Services using appropriately authorized information.
• Comply with applicable legal, regulatory, and contractual obligations.
• Protect the rights, safety, and security of Techxon, Customers, users, and others.

We will not use personal information for purposes incompatible with the applicable agreement or lawful basis.

5. Lawful Basis for Processing

Where required by applicable law, we process personal information on one or more lawful bases, depending on the circumstances.

Contract

Processing may be necessary to create accounts, deliver Services, administer subscriptions, or fulfill contractual obligations.

Legitimate Interests

Processing may be necessary to secure systems, prevent abuse, maintain service reliability, respond to support requests, or protect our legitimate business interests, where those interests do not override individuals' rights.

Legal Obligations

We may process or retain information where necessary to comply with applicable legal and regulatory requirements.

Consent

We may rely on consent where required for a specific processing activity, such as certain optional cookies or other features for which consent is the appropriate legal basis.

Other Legally Recognized Bases

Where applicable, we may rely on other lawful bases recognized by the relevant data protection legislation.

Organizational Customers are responsible for determining the appropriate lawful basis for personal information they process through their use of SOREX Suite.

6. Customer Data and Our Role

When a business or organization uses SOREX Suite to manage its employees, customers, suppliers, visitors, or other individuals, that organization will generally determine the purposes for which the information is used.

In these circumstances:

• The Customer may act as the data controller.
• Techxon may act as the data processor.
• Techxon will process the relevant Customer Data according to documented instructions and applicable contractual arrangements.
• The Customer remains responsible for the lawfulness of its processing activities and for providing required privacy notices.

For account administration, billing, direct customer support, platform security, and other activities where Techxon independently determines the purposes and means of processing, Techxon may act as a data controller.

7. How We Share Personal Information

We may disclose personal information to the following categories of recipients where necessary and lawful.

8. International Data Transfers

SOREX Suite may use infrastructure and service providers operating in different countries.

The actual storage and processing locations depend on the Service, hosting architecture, provider arrangements, and Customer configuration.

Where personal information is transferred internationally, Techxon and the relevant parties will implement appropriate legal transfer mechanisms and safeguards where required.

Customers with specific data-residency requirements should confirm those requirements in writing before deployment.

9. Data Retention and Deletion

We retain personal information only for as long as reasonably necessary for the relevant purpose, subject to applicable legal, contractual, security, and operational requirements.

Retention periods vary according to the type of information and the Service involved. Examples include:

• Account and subscription records: for the duration of the account and an appropriate period afterward.
• Business records: according to Customer configuration, contractual requirements, and applicable law.
• Email and communication content: according to relevant product settings, retention arrangements, and applicable agreements.
• Meeting recordings and collaboration content: according to host or Customer settings and relevant product policies.
• Access and attendance records: according to documented security, operational, and legal requirements.
• Security and diagnostic logs: for a proportionate period necessary for security, troubleshooting, and incident investigation.
• Billing and legal records: for the period required by applicable law and legitimate record-keeping obligations.

Customers are responsible for establishing appropriate retention periods for Customer Data they control. Techxon will follow applicable instructions and agreements when processing Customer Data on their behalf.

When personal information is no longer required, we will delete it, anonymize it, or securely dispose of it, subject to applicable obligations and technical limitations.

Deleted information may remain temporarily in protected backups or records that must be retained by law. Deletion from one Service may not delete copies held independently by other users, recipients, or third-party systems.

10. Security of Personal Information

Techxon will implement appropriate technical and organizational measures designed to protect personal information against unauthorized access, loss, alteration, disclosure, and destruction.

Depending on the Service and deployment, safeguards may include:

• Role-based access controls.
• Authentication and account security measures.
• Encryption in transit and, where implemented, at rest.
• Security monitoring and audit logging.
• Vulnerability management and software maintenance.
• Backup and recovery procedures.
• Incident response and access reviews.
• Confidentiality and access-management requirements for authorized personnel.

The specific controls available may vary by product, hosting arrangement, and subscription.

No online system can guarantee absolute security. Customers must also protect their credentials, devices, administrator accounts, and access permissions.

Where a personal data breach occurs, Techxon will assess and respond in accordance with applicable legal obligations and contractual commitments.

11. Cookies and Similar Technologies

SOREX websites and applications may use cookies or similar technologies for:

• Authentication and session management.
• Security and fraud prevention.
• Remembering user preferences.
• Service performance and diagnostics.
• Analytics and usage measurement where appropriate.

Non-essential cookies and similar technologies will be managed in accordance with applicable law, including obtaining consent where required.

You may manage available cookie preferences through the relevant controls or your browser settings. Disabling essential cookies may affect service functionality.

12. Artificial Intelligence and Automated Processing

Certain SOREX products may introduce automation, analytics, classification, or artificial intelligence capabilities.

Where such features process personal information, processing must be consistent with the relevant product notice, applicable agreement, and law.

We will not assume that Customer Data may be used to train general-purpose artificial intelligence models merely because it is processed through SOREX Suite.

Any materially different use of Customer Data must be assessed against applicable contractual commitments, privacy requirements, and any required notice or consent.

Where automated decisions with legal or similarly significant effects are introduced, additional disclosures and safeguards may be required under applicable law.

13. Your Privacy Rights

Depending on your location and applicable law, you may have the right to:

• Request access to personal information.
• Request correction of inaccurate or incomplete information.
• Request deletion in appropriate circumstances.
• Request restriction of certain processing.
• Object to processing where the law provides that right.
• Request a portable copy of eligible information.
• Withdraw consent where processing relies on consent.
• Lodge a complaint with the relevant data protection authority.

These rights are subject to applicable legal conditions and exceptions.

If your information is managed by an employer, school, customer organisation, or other Customer, that organisation may be the appropriate first contact for requests concerning its records.

Where Techxon processes the relevant information on the Customer's behalf, we will assist as required by the applicable agreement and law.

For personal information controlled directly by Techxon, contact us using the details in Section 17.

14. Children's Privacy

SOREX Suite is primarily intended for business, organisational, and professional use, although certain Customers may use individual products in educational environments.

Customers must ensure that any processing involving children complies with applicable privacy, safeguarding, and child-protection requirements.

Techxon does not intend to collect children's personal information unlawfully or for purposes unrelated to the provision of the Services.

15. Third-Party Websites and Services

SOREX Suite may link to or integrate with third-party websites, applications, infrastructure, and devices.

Third parties may operate under their own privacy policies and contractual terms. This Policy does not govern independent processing by third parties acting as separate controllers.

Customers should review relevant third-party policies before enabling integrations or transferring information to external services.

16. Changes to This Privacy Policy

We may update this Policy to reflect changes in our Services, technology, processing activities, providers, or legal obligations.

Where required, material changes will be communicated through the SOREX Suite, our website, email, or another appropriate channel.

The updated effective date will be displayed at the beginning of this Policy.

17. Contact Information and Privacy Requests