ALEXIA FAX PRIVACY STATEMENT
ALEXIA FAX PRIVACY STATEMENT
ALEXIA FAX ENTERPRISE - ENTERPRISE PRIVACY STATEMENT A Service of Alexia Network LLC Effective: August 22, 2026 | Version 2.0 (supersedes v1.0, July 20, 2026)
1. Introduction and ScopeThis Privacy Statement ("Statement") explains how Alexia Network LLC, an Arizona limited liability company, with its wholly owned subsidiaries and controlled affiliates ("Alexia," "we," "us," "our"), processes information through the Alexia Fax Enterprise platform - including Alexia Secure Delivery, Alexia Email-to-Fax, Alexia Secure Chat, the Executive Vault, mobile and web applications, enterprise client portals, APIs, and support services (the "Platform"). Alexia Network LLC is the sole operator of the Platform, the sole controller or processor of record, and the sole contracting party for all Platform agreements. No other entity operates, funds, governs, or holds any interest in the Platform except as disclosed in Section 19. This Statement applies to Enterprise Customers and their Authorized Users, individual subscribers, recipients who do not create an account, external client-portal users, and site visitors, irrespective of device or access channel. Geographic scope. Alexia is organized under Arizona law with its principal place of business in Arizona, United States. The Platform is operated from the United States and offered to customers in the United States and, subject to Section 18, worldwide. Personal Information is transferred to, stored in, and processed in the United States and in such other locations as our Sub-processors operate. By accessing the Platform from outside the United States, you acknowledge that your information will be transferred to and processed in the United States, whose data protection regime may differ from your own, and you consent to that transfer to the extent such consent is lawful in your jurisdiction; where consent is not a valid basis, we rely on the mechanisms in Section 7.Executed agreements. This Statement must be read with, but does not replace, any Business Associate Agreement ("BAA"), Data Processing Addendum ("DPA"), Master Services Agreement, Standard Contractual Clauses, or other executed contract. Where an executed agreement conflicts with this Statement as to a specific data category or obligation, the executed agreement prevails as between Alexia and that Enterprise Customer only; for individuals not party to an executed agreement, this Statement controls in full. Acceptance. By creating an account, accessing the Enterprise Access Center, transmitting documents, sending or receiving Secure Chat messages, accessing a client portal, or otherwise using the Platform, users accept this Statement, including the limitations of liability in Section 23 and the dispute resolution provisions in Section 26. Individuals who do not agree are advised not to use the Platform. 2. Definitions. Where a term is defined by statute - "Protected Health Information" under HIPAA, "Personal Information" under the CCPA, "Personal Data" under the GDPR - it carries the statutory meaning in contexts governed by that statute. "Alexia" means Alexia Network LLC and its wholly owned subsidiaries and controlled affiliates. "Authorized User" means an individual permitted to access the Platform, whether provisioned by an Enterprise Customer or registered directly. "Closed-Network Communication" means a Secure Chat message exchanged between authenticated Alexia accounts without traversing external telephone, SMS, or third-party messaging networks. "Content" means anything you submit, transmit, generate, or store using the Platform - documents, fax images, messages, attachments, signatures, vault files - excluding account, administrative, technical, and audit data ("metadata"). "Controller" (or "Business") determines the purposes and means of processing; "Processor" (or "Service Provider") processes on a Controller's behalf. "Enterprise Customer" means an entity that has contracted with Alexia and administers one or more accounts. "Personal Information" or "Personal Data" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular individual or household. "PHI" has the meaning at 45 C.F.R. 160.103. "Sub-processor" means a third party engaged by Alexia to process Personal Information or Content in delivering the Platform. "Special Category Data" means the categories in GDPR Article 9 and materially equivalent categories under other law. 3. Information We Collect Provided directly: name, business email, telephone, organizational affiliation, job title, billing address, tax or VAT registration where applicable, and payment instrument data (processed by a PCI-DSS-compliant processor per Section 9). Account functions collect the information necessary to authenticate a request and effect the change.Content you transmit: documents and attachments, fax images and cover pages, electronic signatures and signing-event metadata, Executive Vault files, and Secure Chat messages. Content may include highly sensitive categories - PHI, financial account data, government identification numbers, legal case materials, personnel records - depending entirely on how the Enterprise Customer and its Authorized Users use the Platform. Alexia does not select, review, curate, or exercise editorial control over the substance of Content. The Enterprise Customer and its Authorized Users determine what is transmitted, to whom, and why, and bear sole responsibility for the lawfulness of that determination (Sections 22, 24). Technical and usage data collected include IP address, device identifiers and model, operating system and application version, browser type, login timestamps, session duration, feature usage, API call metadata, crash and diagnostic logs, and coarse geolocation derived from IP address. We do not collect precise GPS location unless a specific feature requires it and you grant explicit permission. Cookies: strictly necessary cookies (sessions, load balancing, security) cannot be turned off without disabling the Platform; functional cookies store display preferences; analytics cookies measure aggregate usage. We use no third-party advertising or cross-context behavioral advertising technologies in authenticated areas. Where required, including under the ePrivacy Directive as implemented in EEA member states, the UK PECR, and applicable U.S. state law, we present a compliant consent mechanism, obtain prior consent for non-essential technologies, and honor Global Privacy Control and analogous opt-out signals. Audit metadata: The Platform generates immutable audit records of authentication events, including failures and lockouts; document access and transmission events; delivery and delivery-failure events; signature ceremonies; administrator actions; security and retention configuration changes; and account lifecycle events. These are stored separately from Content, designed to resist alteration or deletion, and used for security monitoring, incident investigation, compliance reporting, dispute resolution, and regulatory recordkeeping. Audit records are retained independently of any Content deletion request. From third parties: your employer when it provisions your account; identity providers, SSO, and directory services where federated authentication is enabled; fraud prevention, sanctions screening, and identity verification vendors as required by Section 18; and payment processors and financial institutions for billing and chargeback resolution.4. How We Use InformationTo operate, maintain, secure, and improve the Platform, including authentication, routing and delivering faxes and secure documents, format conversion and rendering, delivery confirmations, and Closed-Network Communication; to process subscription billing, plan changes, renewals, cancellations, refunds, chargebacks, and applicable transaction taxes; to process account lifecycle requests; to detect, investigate, prevent, and respond to fraud, unauthorized access, malware, abuse, and denial-of-service activity, and to enforce rate limits and acceptable use; to generate audit trails, certified delivery records, and compliance reports for regulated Enterprise Customers; to provide support; to comply with applicable law wherever the Platform is used, respond to legal process (Section 17), conduct export and sanctions screening (Section 18), and establish, exercise, or defend legal claims and enforce our agreements; to send service, security, and billing notices and, absent opt-out and where permitted by CAN-SPAM, UK PECR, and applicable EEA law, product and marketing communications; to conduct aggregate analytics using de-identified data wherever feasible; and to evaluate and complete corporate transactions (Section 12).We do not sell Personal Information or share it for cross-context behavioral advertising, as defined under the CCPA/CPRA and analogous state law. We do not use Content to train general-purpose AI or machine learning models made available outside the Enterprise Customer relationship that generated it, except as described in Section 5.5. Artificial Intelligence and Automated Processing: Document classification, delivery-failure prediction, fraud and anomaly detection, and optical character recognition ("OCR") rely on automated systems, some incorporating machine learning, governed consistently with the NIST AI Risk Management Framework, applicable state automated decision-making regulation, and GDPR/UK GDPR Articles 13, 14, and 22 where applicable. Fraud and anomaly systems may flag an account or transmission for manual review; final decisions to suspend an account, reject a transmission, or terminate service are subject to human review on request. OCR and classification process documents solely to facilitate delivery, format conversion, indexing, and search within the originating Enterprise Customer's own account, and are not used to build cross-customer behavioral profiles, advertising profiles, or general-purpose training corpora. Content is not used to train foundation models or models deployed outside the originating environment absent separate, explicit, written opt-in authorization, withdrawable prospectively at any time. Where an automated decision produces a legal or similarly significant effect, we provide a mechanism to request human review, express a point of view, and contest the decision. Production systems undergo documented pre-deployment evaluation, bias assessment proportionate to risk, access logging, and periodic review; records are available to Enterprise Customers under an executed agreement on written request.6. Regulatory Framework. This Section is provided for transparency, creates no private rights beyond those the referenced statutes afford, and is not an admission that any statute applies to any particular processing activity. Our practices are subject to Section 5 of the FTC Act. Where an Enterprise Customer is a HIPAA covered entity or business associate transmitting or storing PHI, Alexia acts as a business associate under a separately executed BAA incorporating the Privacy, Security, and Breach Notification Rules (45 C.F.R. Parts 160 and 164), as amended by HITECH; this Statement is not a BAA and does not substitute for one, and PHI must not be transmitted before a BAA is executed. Electronic communications are handled consistent with the Wiretap Act (18 U.S.C. 2510-2523) and the Stored Communications Act (18 U.S.C. 2701-2713). Messages we send comply with CAN-SPAM. Enterprise Customers and Authorized Users, not Alexia, initiate outbound fax transmissions; the Enterprise Customer is solely responsible for compliance with the Telephone Consumer Protection Act, 47 U.S.C. 227, and the Junk Fax Prevention Act, including obtaining any required prior express invitation or permission or establishing an applicable established business relationship, providing compliant opt-out notices, and honoring opt-outs, and Alexia does not review transmissions for TCPA compliance (Section 24). The Platform is not directed to children; we do not knowingly collect Personal Information from children under thirteen, and an administrator provisioning an account warrants the user is not under thirteen and meets any higher minimum age set by law, including GDPR Article 8. For California residents not otherwise exempt, and for residents of other states with comprehensive privacy statutes where applicable and not exempt, we provide the rights in Section 13; we have not sold or shared Personal Information for cross-context behavioral advertising in the preceding twelve months. We observe applicable biometric statutes including the Illinois BIPA, the Texas CUBI Act, and Washington's My Health My Data Act. Where an Enterprise Customer is a financial institution subject to GLBA, we act as a service provider consistent with 16 C.F.R. Part 314 and support retention configurations accommodating SEC Rule 17a-4 and FINRA Rule 4511, without certifying compliance on the customer's behalf. Our governance program is informed by the NIST Privacy Framework and the AICPA Trust Services Criteria; these describe the design orientation of our controls and do not indicate that Alexia has completed or maintains a SOC 2 attestation, ISO certification, or other third-party audit. 7. Roles: For account, billing, technical, and audit metadata from subscribers and site visitors, Alexia acts as Controller. For Content and Authorized User data processed for an Enterprise Customer, Alexia acts as Processor on documented instructions. Legal Bases As Controller under GDPR, UK GDPR, and equivalent laws, Alexia relies on: contract performance (Art. 6(1)(b)) to provide the Platform, authentication, delivery, and subscriptions; legitimate interests (Art. 6(1)(f)) for security, fraud prevention, audits, analytics, and legal claims; legal obligations (Art. 6(1)(c)) for tax, accounting, export controls, and lawful disclosures; consent (Art. 6(1)(a)) for non-essential cookies, optional permissions, and marketing, withdrawable at any time; and vital interests (Art. 6(1)(d)) in rare life-safety circumstances. For Special Category Data processed on customer instructions, the Enterprise Customer is responsible for establishing an Article 9 condition. International Transfers: Personal Data from the EEA, UK, Switzerland, and other transfer-restricted jurisdictions is transferred using applicable safeguards, including EU Standard Contractual Clauses (2021/914), UK IDTA or Addendum, Swiss-recognized safeguards, adequacy decisions, narrowly applied Article 49 derogations, or successor mechanisms. Where required, Alexia conducts transfer impact assessments and applies supplementary safeguards, including Section 10 encryption. Alexia also complies, where applicable, with relevant privacy laws including PIPEDA, Quebec Law 25, UK data-protection law, Australian and New Zealand privacy laws, LGPD, APPI, PIPA, Singapore PDPA, India DPDP Act 2023, and POPIA. Data Localization: Some jurisdictions impose residency, localization, or regulatory approval requirements that Alexia’s U.S.-based architecture may not satisfy. Enterprise Customers subject to such requirements must obtain written confirmation of Platform suitability before transmitting regulated Personal Data and remain responsible for compliance (Sections 22, 24). Representatives and Complaints: Where required by GDPR or UK GDPR Article 27, Alexia will appoint and publish the applicable representative. Alexia will also publish any legally required Data Protection Officer appointment. Individuals may lodge complaints with their competent supervisory authority and are encouraged to contact Alexia first for direct resolution.8. Sub-processors. Categories include cloud hosting, compute, and storage; content delivery; telecommunications carriers terminating outbound send-only fax transmissions onto the public switched telephone network and international equivalents; electronic signature infrastructure; payment processors; identity, SSO, and multi-factor authentication providers; support ticketing; transactional email; performance monitoring and error reporting; security operations and vulnerability scanning; and sanctions and export screening.Each Sub-processor is bound by a written agreement requiring confidentiality, processing solely to deliver the contracted service, and protections no less protective than this Statement - including, where PHI is involved, a subcontractor BAA consistent with 45 C.F.R. 164.308(b) and 164.314(a), and, where GDPR or UK GDPR data is involved, Article 28 terms and applicable onward transfer safeguards. A current list of material Sub-processor categories is available to Enterprise Customers on written request. Where an executed DPA so provides, we give advance notice of new Sub-processors and a reasonable opportunity to object on documented data protection grounds; the sole remedy for a sustained objection is termination of the affected Service without penalty for the unused prepaid term. Sub-processors may not use Content or Personal Information for their own purposes, including marketing, unrelated analytics, or AI model training, except where the contracted role requires limited automated processing to deliver the function.9. Payment Processing. A third-party PCI-DSS-compliant processor processes subscription fees. Alexia does not store full payment card numbers. Card data is tokenized; we retain only the token, last four digits, card brand, expiration date, and the transaction history necessary for billing support, tax reporting, and reconciliation. For invoice or bank transfer payment, we retain the banking reference necessary to reconcile. We are not responsible for a payment processor's independent practices as a controller for its own fraud prevention and regulatory purposes. 10. Data Security. We maintain administrative, physical, and technical safeguards calibrated to the sensitivity of the information processed, consistent with 45 C.F.R. 164.308, 164.310, and 164.312 where PHI is involved and GDPR Article 32 where applicable.Encryption. In transit: TLS 1.2 or higher with modern cipher suites. At rest, including Executive Vault documents, fax images, and Secure Chat messages: industry-standard symmetric encryption (AES-256 or equivalent), keys managed by a dedicated key management service subject to periodic rotation. Secure Chat operates as a Closed-Network Communication system; no message content traverses third-party carrier networks, SMS gateways, or unaffiliated messaging platforms. Inherent limitation of fax: outbound delivery necessarily terminates onto the public switched telephone network or an international equivalent; once a transmission leaves our infrastructure and enters carrier or recipient-controlled networks and devices, we cannot and do not control, encrypt, or secure it, and customers transmitting sensitive information by fax assume this risk (Section 22).Access and infrastructure. Least-privilege, role-based access limited to personnel whose functions require it, subject to background screening where lawful and confidentiality obligations surviving termination. Multi-factor authentication is available on all plans and may be mandated by the administrator for regulated data categories. Administrative actions are recorded in the immutable audit trail, and we maintain a documented process for timely access revocation on role change or separation. Infrastructure is hosted in facilities with independently audited physical controls; Alexia does not operate its own data centers, and infrastructure security relies on the contracted safeguards of our cloud Sub-processors, evaluated before engagement and reassessed periodically. Our security program includes secure development practices, vulnerability scanning, periodic third-party penetration testing, change management, and annual personnel training, and our documented incident response process covers identification, containment, eradication, recovery, notification, and shared responsibility. No method of electronic transmission or storage is entirely secure, and Alexia does not guarantee absolute security. Enterprise Customers and Authorized Users are responsible for safeguarding credentials and API keys, configuring account-level security features, verifying destination fax numbers, email addresses, and recipient identities prior to transmission, promptly deprovisioning departed personnel, and reporting suspected compromises without delay. Alexia is not responsible for misdirected transmissions resulting from incorrect recipient identifiers provided by senders, unauthorized access due to compromised end-user credentials or devices, or the security practices of any recipient (Sections 22-24).practices (Sections 22-24). 11. Data Retention and Destruction. We retain Personal Information and Content as long as reasonably necessary to provide the Platform, comply with legal, regulatory, tax, and accounting requirements, resolve disputes, and establish, exercise, and defend claims, then delete or irreversibly de-identify it. Email-to-Fax images and delivery confirmations are retained per the customer's plan configuration and, by default, for a rolling period sufficient to support delivery dispute resolution. Secure Delivery and Executive Vault documents are retained for the active subscription and any contractually agreed post-termination window. Secure Chat messages are retained per the customer's configured policy and may be extended as needed to satisfy regulatory recordkeeping obligations. Audit and compliance records are retained per applicable regulatory requirements; for HIPAA-regulated documentation, not less than six (6) years from creation or last effective date. Billing and financial records are retained for at least seven (7) years. Security and abuse records are retained as long as necessary for investigation, enforcement, and defense of claims. Notwithstanding any retention setting or deletion request, information subject to a litigation hold, regulatory investigation, subpoena, preservation request under 18 U.S.C. 2703(f), or other preservation obligation is preserved while that obligation remains in effect.Destruction. On expiration of the retention period, or on a valid deletion request under Section 16 where no overriding obligation applies, we delete or irreversibly de-identify using commercially reasonable methods, including cryptographic erasure of encryption keys where physical media destruction is impracticable in shared cloud infrastructure. Deletion from active systems may not immediately purge encrypted backups, disaster recovery snapshots, or replicated storage; such copies are isolated from production access, remain encrypted, and are overwritten in ordinary backup rotation. We do not restore residual copies to fulfill access requests. 12. Disclosure to Third PartiesWe disclose Personal Information and Content only: (1) to Sub-processors, solely to provide the Platform; (2) to the intended recipient of a fax, secure document, or Secure Chat message, as directed by the sending Authorized User; (3) to an Enterprise Customer's administrators, as to the accounts, Content, and audit records its plan and configuration entitle it to access - Authorized Users should not expect privacy, as against their own organization, in Content transmitted through an account that organization provisioned; (4) to professional advisors, including auditors, accountants, insurers, and legal counsel, under confidentiality obligations; (5) to a successor entity in a merger, acquisition, financing, reorganization, receivership, bankruptcy, or asset sale, subject to assumption of obligations no less protective than these; (6) to comply with law or valid legal process (Section 17); (7) to protect rights and safety, where we reasonably believe disclosure is necessary to investigate, prevent, or act on suspected fraud, security incidents, agreement violations, or risks to physical safety; and (8) with your explicit consent or at your direction. We do not disclose Content to third parties for their independent marketing purposes and do not sell Personal Information as defined under the CCPA or analogous law. 13. Your Privacy RightsSubject to identity verification and statutory exceptions, you may exercise the following by contacting us (Section 29) or through the Enterprise Access Center: access and know the categories and specific pieces of Personal Information collected, sources, purposes, and categories of recipients; correct inaccurate information; delete, subject to Section 11 and to an administrator's superseding right over an account it provisioned; portability where technically feasible; restrict or object to certain processing, including processing based on legitimate interests; withdraw consent without affecting prior lawfulness; opt out of non-essential commercial communications; human review of automated decisions with legal or similarly significant effects; non-discrimination for exercising any right; and appeal a denial where law provides an appeal mechanism.We verify identity using information already in our possession and may decline requests we cannot verify to a reasonable degree of certainty. We respond within the period applicable law requires - generally forty-five (45) days under U.S. state law and one (1) month under GDPR/UK GDPR, each extendable as permitted. Manifestly unfounded, excessive, or repetitive requests may be refused or subject to a reasonable fee where permitted.California. In the preceding twelve months, we collected the categories in Section 3 for the purposes in Section 4 and disclosed them to the recipients in Sections 8 and 12. We have not sold or shared Personal Information for cross-context behavioral advertising, and have not used or disclosed sensitive Personal Information beyond the purposes permitted by Cal. Civ. Code 1798.121(a). Residents may designate an authorized agent subject to proof of authorization. Nevada residents may submit a verified request under Nev. Rev. Stat. 603A.340; we do not engage in such sales.Enterprise-controlled Content. Where Content or Personal Information was submitted by an Enterprise Customer or its Authorized Users for that customer's business operations, we act as Processor or Service Provider, will refer the request to that Enterprise Customer for disposition, and will support its response per the parties' agreement unless direct action is required by law. Because much Personal Information relates to individuals as employees or agents of an Enterprise Customer, certain statutory obligations may run to the Enterprise Customer rather than to Alexia; direct such requests to your organization's administrator. 14. Mobile Application Permissions. Each permission is optional and may be revoked at any time in device settings, though doing so may limit features. Camera - scanning documents and capturing handwritten signatures. Photo Library - attaching existing images or documents. Push Notifications - delivery confirmations, incoming messages, and security events. Biometric Authentication - where enabled, a convenience unlock in place of your password; biometric data is processed and stored entirely by your device's operating system in secure hardware and is never transmitted to, accessed by, or stored by Alexia, which receives only a success or failure signal. Contacts - where separately enabled, to select recipients from your address book; contact data is used locally and is not uploaded absent your affirmative action to select a recipient. Local Storage - caching documents for offline viewing and queuing transmissions, subject to device-level encryption.15. Enterprise Governance and Client Portal Access. Enterprise Suite and Secure Delivery customers may enable a client portal permitting their external clients to access shared documents securely. This Statement governs portal use as to Alexia's own processing, and additionally any separate notice the Enterprise Customer provides its own clients. Alexia is not responsible for the content, accuracy, adequacy, or legal sufficiency of any privacy notice, consent, or authorization an Enterprise Customer provides to its own clients, but requires by contract that customers provide notice and obtain consent as applicable law requires. Administrators may configure retention, access controls, sharing permissions, and compliance reporting parameters, and, subject to Section 11, initiate deletion of Authorized User accounts and associated Content. Because our relationship with customer-provisioned accounts is an intermediary relationship on that customer's behalf, an individual Authorized User's ability to delete their own account or Content unilaterally is subject to the Enterprise Customer's internal policy and superseding administrative rights.16. Account Management. Creation requires the information in Section 3. Where an administrator provisions an account, the administrator supplies initial registration information, and you establish your own credentials at first login. Login events - date, time, approximate location from IP, device identifier - are logged for security monitoring and retained in the audit trail; repeated failures may trigger temporary lockout and a security notification. Where federated SSO is enabled, the customer's identity provider performs authentication, and we receive only the assertion attributes necessary to establish the session. Password reset verifies identity via your registered email or an enabled secondary method; reset links are single-use and time-limited. We do not store passwords in plain text - they are stored using a salted, computationally expensive cryptographic hash, and Alexia personnel cannot view, recover, or reconstruct your password. Changing your email requires verification of both the current and new address, with a confirmation notice sent to the prior address as a safeguard against account takeover; multi-factor enrollment, modification, and removal require re-authentication and generate a security notification and audit entry. Administrators may restrict or be required to approve these changes on provisioned accounts.Deletion. Request through the Enterprise Access Center or the Section 29 contact. On a verified request, we delete or de-identify associated Personal Information except where Section 11 requires retention - audit trails, financial and tax recordkeeping, unresolved billing disputes, legal holds, or a superseding Enterprise Customer retention policy. Where an account was provisioned by an Enterprise Customer, deletion is subject to that customer's offboarding policy and may be referred to its administrator. Deleting an account does not delete Content already delivered to a recipient, Content in another user's account, or copies retained by a customer, recipient, or third party outside our control. 17. Government and Law Enforcement RequestsWe may receive requests for Personal Information or Content from domestic or foreign authorities, including subpoenas, court orders, warrants, mutual legal assistance requests, and national security processes. We require valid legal process that is appropriate to the information sought and consistent with the Stored Communications Act, which generally mandates a probable-cause warrant for communication content. We review requests for legal sufficiency, jurisdiction, and scope. Disclosures are limited to what valid legal process requires. We may challenge or seek to quash requests that are invalid, burdensome, or overbroad. Unless legally prohibited, including by non-disclosure orders, national security processes, or imminent threats to life or safety, we notify affected Enterprise Customers or Authorized Users before disclosure when practicable and provide delayed notice when restrictions expire. When requests seek Content processed on behalf of a customer, we direct the requester to that customer where lawful and practicable. Governments are not provided direct, unmediated, or bulk access to Platform infrastructure, and we maintain no mechanism to bypass or weaken Section 10 encryption. We honor foreign requests only when they are enforceable against Alexia through valid U.S. legal process, such as a U.S. court order, mutual legal assistance treaty, executive agreement under 18 U.S.C. 2523, or other applicable process. Where permitted, we may publish aggregate statistics regarding such requests.18. Export Control and Sanctions ComplianceThe Platform and its encryption functionality are subject to U.S. export controls and sanctions, including the Export Administration Regulations (15 C.F.R. Parts 730-774) and sanctions administered by the U.S. Department of the Treasury's Office of Foreign Assets Control. You represent that you are not located in, organized under the laws of, or ordinarily resident in a comprehensively sanctioned jurisdiction; are not a restricted party or owned or controlled fifty percent or more by a restricted party; and will not export, re-export, transfer, provide, or use the Platform or Content in violation of applicable export controls, sanctions, anti-boycott laws, or prohibited EAR end-use restrictions. We may conduct restricted-party screening and may suspend, restrict, terminate, or block access, accounts, or transmissions, and make required reports where continued service may violate applicable law. Alexia is not liable for good-faith actions taken to comply with export or sanctions requirements, and no refund is owed for affected periods. Enterprise Customers operating internationally remain responsible for compliance with applicable export controls, sanctions, customs regulations, telecommunications licensing, and local laws in jurisdictions where they transmit or receive Content.19. Corporate Structure and OwnershipAlexia Fax Enterprise is operated solely by Alexia Network LLC, an Arizona limited liability company organized under A.R.S. Title 29, Chapter 7. Alexia Network LLC is the Platform’s sole operator, intellectual-property owner, controller or processor of record for Personal Information, contracting counterparty, and entity responsible for Platform operations.No nonprofit, foundation, charitable, or other affiliated entity owns, governs, or administers the Platform or its data. Controlled affiliates or contracted sub-processors may perform functions, but Alexia Network LLC remains primarily accountable. To the extent permitted by A.R.S. 29-3304 and applicable law, company liabilities are solely those of Alexia Network LLC. Members, managers, officers, employees, and agents are not personally liable solely because of their status.20. Intellectual PropertyThe Platform, including software, source code, APIs, interfaces, documentation, technology, trade dress, and trademarks including ALEXIA FAX and ALEXIA NETWORK, is owned by Alexia Network LLC or its licensors and protected by applicable intellectual-property laws. Customers retain ownership of their Content. Alexia receives only the non-exclusive, worldwide, royalty-free rights necessary to host, store, transmit, format, encrypt, back up, secure, and process Content to provide the Services and comply with law. Alexia may use voluntary feedback without compensation or restriction.21. Security Breach NotificationIf a security breach results in unauthorized acquisition of unencrypted Personal Information, Alexia will notify affected individuals and applicable Enterprise Customers as required by A.R.S. 18-552 and other applicable laws. For PHI, Alexia will comply with HIPAA and applicable BAAs, including required notice. Under GDPR or UK GDPR, Alexia will notify Controllers without undue delay when acting as Processor and make required regulatory or data-subject notifications when acting as Controller. Notices will provide available material information concerning the incident. Notice may be delayed where legally permitted and does not constitute an admission of fault or liability.22. Disclaimers and Allocation of ResponsibilityTo the maximum extent permitted by law, except for express warranties in an executed agreement, BAA, or DPA, the Platform is provided “AS IS” and “AS AVAILABLE.” Alexia disclaims applicable express, implied, and statutory warranties, including merchantability, fitness for a particular purpose, title, non-infringement, and accuracy. Alexia does not guarantee uninterrupted operation, error-free service, prevention of every unauthorized access, or successful or timely delivery of every transmission. Users acknowledge risks outside Alexia’s control, including public telecommunications networks, carriers, recipient systems, compromised user credentials or devices, external email infrastructure, incorrect recipient information, recipient handling of delivered Content, and future limitations of cryptographic technology. Enterprise Customers determine what Content is transmitted, recipients, regulatory suitability, required consents and notices, retention settings, permissions, and Authorized Users. Customers are responsible for determining whether their use complies with applicable legal, regulatory, residency, and contractual requirements. Alexia is not responsible for independent acts or omissions of carriers, recipients, identity providers, customer administrators, or other third parties except where applicable law imposes non-waivable responsibility. Nothing excludes rights or liabilities that cannot lawfully be excluded.23. Limitation of LiabilityTo the maximum extent permitted by law, Alexia and its members, managers, officers, employees, agents, licensors, and Sub-processors will not be liable for indirect, incidental, consequential, special, exemplary, or punitive damages or loss of profits, revenue, business, goodwill, data, or anticipated savings arising from the Platform, Personal Information, or Content. Alexia’s total aggregate liability will not exceed the greater of:(a) amounts actually paid by the affected customer or subscriber during the twelve (12) months preceding the event giving rise to the claim; or(b) US $100.Related claims constitute a single claim for purposes of this limitation. For free, trial, beta, evaluation, non-paying, and client-portal users, aggregate liability will not exceed US $100.Nothing limits liability that cannot legally be limited, including applicable liability for gross negligence, willful misconduct, fraud, or obligations expressly superseding this Section in an executed agreement. These limitations constitute a material allocation of risk.24. IndemnificationTo the maximum extent permitted by law, Enterprise Customers and Authorized Users acting independently will defend, indemnify, and hold harmless Alexia Network LLC and its personnel and Sub-processors from third-party claims, losses, liabilities, penalties, and reasonable legal expenses arising from:
- Unlawful or improper Content;
- Incorrect or unauthorized recipient information supplied by the sender;
- Failure to obtain required consent, authorization, or notices;
- Transmission of regulated information without required agreements;
- Data residency, localization, export-control, or sanctions violations;
- Compromised customer-controlled credentials, devices, or systems;
- Improper account, retention, access, or sharing configuration; or
- Violation of this Statement, applicable Terms, or law.
Alexia will provide reasonable notice and cooperation. No settlement imposing obligations, admissions, or continuing restrictions on Alexia may be entered into without Alexia’s written consent. This Section does not apply where legally unenforceable against consumers.25. Claims; Force MajeureTo the maximum extent permitted by law, claims relating to this Statement or processing of Personal Information or Content must be brought within one (1) year after accrual. Where prohibited, the shortest legally permitted period applies. This Statement creates no third-party beneficiary or private-action rights beyond those provided by law. Alexia is not liable for failure, delay, loss, or unavailability caused by circumstances beyond its reasonable control, including natural disasters, war, terrorism, civil disturbance, governmental action, telecommunications or utility failures, public internet failures, third-party cyberattacks notwithstanding reasonable safeguards, or related Sub-processor failures. Nothing creates a partnership, joint venture, agency, employment, or fiduciary relationship.26. Governing Law and Dispute ResolutionThis Statement and related disputes are governed by the laws of the State of Arizona, except where superseded by federal or other mandatory law. Before arbitration or litigation, parties will attempt good-faith resolution for at least thirty (30) days following written notice, except where immediate injunctive relief is appropriate. Unresolved disputes will be resolved through final and binding arbitration before one arbitrator in Maricopa County, Arizona, under the commercial rules of a nationally recognized arbitration organization. The Federal Arbitration Act, 9 U.S.C. §§ 1–16, governs enforcement. Either party may bring an eligible individual small-claims action or seek appropriate injunctive or equitable relief concerning intellectual property, confidentiality, or unauthorized Platform access. To the fullest extent permitted by law, disputes must be brought individually and not through any class, collective, consolidated, private-attorney-general, or representative proceeding. If this waiver is unenforceable for a particular claim, only that claim may proceed in court. For disputes not subject to arbitration, applicable state and federal courts in Maricopa County, Arizona have exclusive jurisdiction and venue, subject to mandatory law. To the maximum extent permitted by law, each party waives trial by jury. Conflicting dispute provisions in an executed Enterprise Customer agreement control for that customer. Nothing deprives international consumers of mandatory rights that cannot legally be waived.27. General ProvisionsSeverability. Invalid provisions will be modified or severed to the minimum extent necessary without affecting the remainder.No Waiver. Failure to exercise a right does not waive it. Waivers must be authorized in writing. Assignment. Users may not assign obligations without Alexia’s written consent. Alexia may assign its rights and obligations, including through a corporate transaction. Survival. Provisions intended by their nature or terms to survive termination remain effective. Language. The English version controls except where applicable law requires otherwise.Entire Understanding. This Statement, together with applicable Terms of Service, enterprise agreements, BAAs, and DPAs, constitutes the entire understanding concerning its subject matter and supersedes prior privacy statements except where expressly incorporated into an executed agreement.28. Changes to This StatementAlexia may update this Statement to reflect changes in the Platform, business practices, corporate structure, or applicable law. Alexia will communicate material changes through the Platform, account email, website notice, or another legally sufficient method. Alexia will honor required notice periods or consent requirements. Non-material changes may become effective upon posting. Continued use after the effective date constitutes acceptance to the extent permitted by law. Users who disagree may discontinue use and exercise applicable deletion rights. Executed agreements containing different change-notification requirements control for the applicable customer.29. Contact Information Entity of Record:Alexia Network LLCArizona limited liability company Privacy Office:support@worldscholarsarena.com Legal Department:support@worldscholarsarena.com Security Incidents:support@worldscholarsarena.com Mail:Alexia Network LLCAttn: Privacy OfficeUnited States of America EU / UK Article 27 Representative:Atem A Tangap Data Protection Officer:Atem A Tangap. Privacy-rights requests will be acknowledged within ten (10) business days and addressed within applicable legal periods. Do not send PHI, payment-card information, or other sensitive Content to general inquiry addresses. End of Statement.
