tréxō robotics

Privacy Policy

Trexo Robotics — EU, EEA, United Kingdom & Switzerland. How we collect, use, share, and protect your personal data.

Last updated: 21 July 2026.

1. Introduction

At Trexo Robotics, we take your privacy seriously. This Privacy Policy explains how we collect, use, share, and protect your personal data when you interact with us in the European Union (EU), the European Economic Area (EEA), the United Kingdom (UK), and Switzerland. It applies whenever you:

  • Visit our European website at eu.trexorobotics.com/ or any associated subdomain;
  • Contact us by email, phone, WhatsApp, Facebook Messenger, or any other channel;
  • Submit a form, request information, book or take part in an assessment, attend a roadshow or trade event;
  • Place a reservation for or purchase a Trexo device;
  • Use a Trexo device, or have a child or family member who uses one;
  • Receive any of our products or services from one of our authorised distributors (in which case the distributor will have their own privacy policy that also applies to you).

Please do not send detailed health information, assessment materials, medical records, photos, videos, or other sensitive information through social messaging channels such as WhatsApp, Facebook Messenger, Instagram, or similar platforms unless we specifically ask you to do so. Where sensitive information is needed, we may direct you to a more secure intake, assessment, support, or file-sharing channel.

Please read this Privacy Policy carefully. If you do not agree with it, please do not use our services or share personal data with us. If you have questions, you can contact us at privacy@trexorobotics.com at any time.

2. Who we are

2.1 Data controller

The data controller responsible for the processing of your personal data described in this Privacy Policy is:

Trexo Robotics Inc.
6705 Millcreek Dr, Unit 3
Mississauga, Ontario, Canada L5N 5M4
Email: privacy@trexorobotics.com

Trexo Robotics Inc. is incorporated under the laws of Ontario, Canada. It is the entity that determines how and why your personal data is processed in connection with our products and services in the EU, UK, and Switzerland.

Trexo Robotics Europe Sp. z o.o. is the controller for billing/contract data relating to customers in the EU, and is a subsidiary of Trexo Robotics Holdings Inc. (US). Trexo Robotics Inc. (Canada) is the controller for billing/contract data relating to customers in the UK, and is the lead controller for the broader processing (manufacturer, operations). Both are sibling entities under Trexo Robotics Holdings Inc. (US), which is the parent holding company and does not process EU/UK personal data.

2.2 Our European and UK contracting entities

Trexo Robotics Europe Sp. z o.o. is our affiliate established in Poland (ul. Bobrowiecka 8, II piętro, 00-728 Warszawa, Polska). It is the contracting entity that handles the sale, invoicing, and billing of Trexo devices and related services to customers, clinics, and distributors in the EU. For these limited billing and contracting activities, Trexo Robotics Europe Sp. z o.o. acts as a separate data controller.

Trexo Robotics Inc., established in Canada (6705 Millcreek Dr, Unit 3, Mississauga, Ontario, Canada L5N 5M4), is the contracting entity that handles the sale, invoicing, and billing of Trexo devices and related services to customers, clinics, and distributors in the UK. For these limited billing and contracting activities, Trexo Robotics Inc. acts as a separate data controller.

For all other processing described in this Privacy Policy, Trexo Robotics Inc. is the lead controller.

2.3 Our representatives in the EU, UK and Switzerland

Because Trexo Robotics Inc. is established outside the EU, UK, and Switzerland, we have appointed representatives in these jurisdictions. You can contact them directly with questions about how your personal data is processed.

EU Representative (Article 27 GDPR):
Rickert Rechtsanwaltsgesellschaft mbH
Colmantstraße 15, 53115 Bonn, Germany
Email: art-27-rep-trexorobotics@rickert.law

UK Representative (Article 27 UK GDPR):
Rickert Services Ltd UK
PO Box 1487, Peterborough, PE1 9XX, United Kingdom
Email: art-27-rep-trexorobotics@rickert-services.uk

Swiss Representative (Article 14 FADP):
HÄRTING Attorneys-at-Law Ltd.
Untermüli 1, 6300 Zug, Switzerland
Email: Swissdatarep@haerting.ch

2.4 Data Protection Officer

We have not appointed a Data Protection Officer (DPO). For all privacy-related questions, please contact us at privacy@trexorobotics.com or contact one of our representatives listed above.

3. What personal data we collect

The personal data we collect depends on how you interact with us. We have grouped it by source below.

3.1 Information you give us directly

You may give us personal data when you contact us, fill out a form on our website or at an event, request information, book an assessment, place a reservation, or correspond with us by any other means. This may include:

  • Contact and profile data: first name, last name, email address, telephone number, country, postal address, and your relationship to the end user (e.g., parent, guardian, healthcare professional).
  • Health data of the end user: medical condition, diagnosis, medical history, contraindications, current therapies, weight, height, leg and limb measurements, and other clinical information necessary to assess whether a Trexo device is appropriate and to customise it for the end user.
  • Demographic data: date of birth or age, gender, and city/postcode.
  • Photos, videos, and recordings: photographs or videos of the end user during the assessment and training, and audio/video recordings of remote assessments conducted by video call.
  • Payment data: billing address, billing email, and information related to payment cards or bank accounts. Card details and bank account numbers are collected and processed directly by our payment processor (Stripe). We do not store full card numbers on our systems.
  • Commercial data: purchase, reservation, or order history; correspondence about pricing and delivery.
  • Communications: questions, feedback, support tickets, training and check-in records, and any other information you choose to send us.

If you provide us with personal data about another person (for example, your child or a person under your care), you confirm that you are authorised to do so under applicable law.

3.2 Information collected automatically from Trexo devices

The Trexo device is operated through a tablet running our app, which controls sessions and logs session data. The Trexo device can be used offline. If the device is not connected to the internet for 60 days, the device login is disabled, and the user must reconnect the device to the internet to re-authenticate. The device itself is not disabled, only the login. This is a safety and security measure. When the device is connected to the internet, the app transmits operational and session data back to us so that we can support you, monitor device safety, and improve our products. This data includes:

  • Patient and device identifiers: an internal patient ID, a device identifier (including the device serial number), and an identifier for the tablet running our app. These identifiers are linked in our systems to the end user's name and email, which means session data from a Trexo device is identifiable personal data, not anonymous.
  • Session and activity data: number of sessions; start and end times; duration; steps taken; number of starts; initiation and cadence metrics; sync timestamps. Device error and fault logs are automatically uploaded to Trexo systems when the device is connected to the internet.
  • Technical and version data: firmware version, ROS version, Android version, dashboard version, and other technical attributes of the device and the tablet.
  • Location data: Coarse location data (approximately 11 km resolution, with one decimal point of precision in latitude/longitude). This is used for device issue tracking, for example, to identify patterns in device issues that may be associated with environmental factors such as temperature or humidity in a region. Precise location is not collected or transmitted. The Trexo Android app may request 'precise location' permission solely because Android requires this permission to manage Wi-Fi network connections; the permission scope is broader than the data Trexo actually collects.

3.3 Information collected automatically when you use our website

When you visit our European website, we and our service providers may automatically collect:

  • Device and connection data: IP address; approximate location derived from IP; device type, operating system, browser, language, and time zone.
  • Usage data: pages visited, time spent on each page, clicks, scrolling and other interactions, referring URL, search terms used to find us, and similar analytics information.
  • Cookies and similar technologies: see Section 7 ("Cookies and tracking technologies") for details.

3.4 Information from third parties

We may receive personal data about you or the end user from third parties, for example:

  • Healthcare professionals, physiotherapists, or schools who refer you to us with your consent;
  • Authorised distributors, where you have asked them to put you in touch with Trexo;
  • Social media and advertising platforms, where you have engaged with our content or ads;
  • Publicly available sources, where relevant to the inquiry you have raised with us.

3.5 Required and optional information

Certain information is necessary to assess suitability for a Trexo device, customise the device, provide assessments, training, support, maintenance, and remote diagnostics, comply with medical-device, tax, accounting, and other legal obligations, and process reservations, orders, payments, and deliveries. If you do not provide this information, we may not be able to provide some or all of our products or services to you. Other information, such as marketing preferences, newsletter subscriptions, user stories, testimonials, photographs, videos, and other promotional consents, is optional.

4. How we use your personal data and our legal bases

Under EU and UK GDPR, every use of personal data must have a valid legal basis. We use your personal data for the following purposes, on the following legal bases:

4.1 To provide our products and services to you

This includes processing your inquiry, conducting assessments, customising and delivering Trexo devices, providing support and maintenance, training you and other authorised users, and running remote diagnostics on devices.

Legal basis: performance of a contract or steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR / UK GDPR).

4.2 To process health data

We process health data only where it is necessary to assess whether a Trexo device is suitable for the end user, to customise the device, to monitor device safety, and to support clinical research where required consents and approvals are in place.

Legal basis: your explicit consent (Article 9(2)(a) GDPR / UK GDPR). Where a Trexo device is supplied through or used in a clinical setting, the relevant healthcare provider may instead process the health data on the basis of Article 9(2)(h) GDPR (necessary for the provision of health care) under their own responsibility.

You can withdraw your consent to the processing of health data at any time by contacting privacy@trexorobotics.com. If you withdraw consent, we may not be able to continue providing some or all of our products and services to you.

4.3 To comply with our legal and regulatory obligations

As a medical device manufacturer, we are subject to legal obligations under EU Regulation 2017/745 (the Medical Devices Regulation, "MDR") and, for Great Britain, the UK Medical Devices Regulations 2002 (as amended by the Medical Devices (Post-market Surveillance Requirements) (Amendment) (Great Britain) Regulations 2024, in force from 16 June 2025). For Northern Ireland, the EU MDR continues to apply. These obligations include post-market surveillance, vigilance reporting of incidents, traceability of devices, and retention of technical documentation.

Legal basis: compliance with a legal obligation to which we are subject (Article 6(1)(c) GDPR / UK GDPR), and, where health data is involved, reasons of public interest in the area of public health (Article 9(2)(i) GDPR / UK GDPR).

4.4 To communicate with you

This includes responding to your inquiries, sending you administrative and service-related messages, providing customer support, sending you appointment confirmations and reminders, and contacting you about your reservation, order, or device.

Legal basis: performance of a contract or pre-contractual steps (Article 6(1)(b)) and our legitimate interest in responding to inquiries and supporting our customers (Article 6(1)(f) GDPR / UK GDPR).

4.5 To send you marketing communications

Where you have signed up to receive our newsletter or other marketing communications, we will use your contact details to send you information about Trexo products, services, events, webinars, and resources.

Legal basis: your consent (Article 6(1)(a) GDPR / UK GDPR), or, in the limited case of existing customers receiving information about similar products and services, our legitimate interest (Article 6(1)(f) GDPR / UK GDPR), in accordance with the "soft opt-in" rules of the EU and UK ePrivacy regimes.

You can opt out of marketing communications at any time by clicking the "unsubscribe" link in any marketing email, or by emailing privacy@trexorobotics.com.

4.6 To improve our products, services, and website

This includes internal analytics, product research and development, testing and debugging, troubleshooting, A/B testing of features or messaging, and quality assurance. Where possible, we use aggregated or de-identified data for these purposes.

Legal basis: our legitimate interest in improving and securing our products and services, balanced against your interests and rights (Article 6(1)(f) GDPR / UK GDPR).

4.7 To protect security, prevent fraud and abuse, and enforce our terms

This includes monitoring for misuse of our website or services, protecting against security incidents, debugging, and enforcing our End User License Agreement and other contractual terms.

Legal basis: our legitimate interest in operating a safe and secure service (Article 6(1)(f) GDPR / UK GDPR), and where relevant, compliance with a legal obligation (Article 6(1)(c)).

4.8 To conduct clinical research and product development

We may use de-identified, pseudonymised, or aggregated data derived from device usage and assessments for clinical research, scientific publications, and the development of new features or algorithms. Where identifiable personal data is used for research, we will obtain the required consents or approvals and comply with applicable ethics and data-protection requirements.

Legal basis: your explicit consent (Article 9(2)(a)), or scientific research purposes (Article 9(2)(j) GDPR / UK GDPR) subject to appropriate safeguards.

4.9 To handle business transfers

If we sell or transfer all or part of our business or assets, we may transfer your personal data to the prospective buyer or successor, subject to appropriate safeguards.

Legal basis: our legitimate interest in conducting our business (Article 6(1)(f) GDPR / UK GDPR).

4.10 To share user stories and promotional content (with your consent)

With your explicit prior consent, we may use photographs, videos, or testimonials shared by you or your family in our marketing materials, on our website and social media channels, at events, or in other promotional communications. Where the content features a child, we obtain consent from the parent or legal guardian. You can withdraw this consent at any time by contacting privacy@trexorobotics.com, and we will stop using the content in future communications and remove it from materials we control where reasonably possible. Withdrawal does not affect past use.

Legal basis: your explicit consent (Article 6(1)(a) GDPR / UK GDPR). Use of a person's image, voice, or likeness may also be subject to national image-rights, personality-rights, or related laws in EU/EEA Member States, and to the law of confidence, misuse of private information, and copyright in the UK. We address these through our separate Image, Video and Testimonial Consent Form.

5. Health data and other special category data

We are a medical device manufacturer and the personal data we collect includes information about the health and physical condition of end users, who in most cases are children. Under EU and UK GDPR, health data is a "special category" of personal data that benefits from heightened protection.

We process health data only where:

  • You (or, in the case of a child or person under your care, you on their behalf) have given your explicit and informed consent (Article 9(2)(a)); or
  • The processing is carried out by or on the responsibility of a healthcare professional, for the assessment of the working capacity, medical diagnosis, or the provision of health care (Article 9(2)(h)); or
  • The processing is necessary for reasons of public interest in the area of public health, including ensuring high standards of quality and safety of medical devices (Article 9(2)(i)); or
  • The processing is necessary for scientific research subject to appropriate safeguards (Article 9(2)(j)).

When we ask for your explicit consent, we will explain clearly what data we want to process, why we want to process it, and how you can withdraw your consent.

Health data is subject to enhanced safeguards in our systems, including encryption at rest and in transit, role-based access controls, and access logging.

6. Children's data

Trexo devices are primarily used by children with mobility challenges. We are committed to handling children's personal data with particular care.

We generally receive children's personal data from parents, guardians, healthcare professionals, schools, or through operation of the Trexo device. We do not ask children to submit personal data directly through our website or marketing channels.

Where consent is the legal basis for our processing of a child's personal data, that consent must come from a person with parental responsibility for the child. The age at which children can give their own consent for information society services differs by EU Member State. For consistency, we apply the threshold of 16 years across the EU/EEA, and the threshold of 13 years for the UK in line with the UK GDPR. If a Member State has set a lower age, the lower age will apply.

In practice, because our customers are almost always parents, guardians, healthcare professionals, or schools acting on behalf of the child, the question of the child's own consent rarely arises. If you are an adult end user of a Trexo device (for example, a young adult within the safety parameters of the device), this Privacy Policy applies to you directly.

We do not knowingly use personal data about children for targeted advertising or profiling. Where third-party advertising technologies on our website may incidentally process children's data, we configure those platforms to exclude minors where the platform offers such controls.

If you believe that we have collected personal data about a child without proper authorisation, please contact us at privacy@trexorobotics.com so we can investigate and, where appropriate, delete the data.

7. Cookies and tracking technologies

Our European website uses cookies and similar technologies to operate the site, understand how visitors use it, and support our marketing activities. We use our own first-party cookie consent banner and preferences interface to obtain your consent before non-essential cookies and tracking technologies are placed on your device. Your choices are stored in a first-party cookie on this domain, and you can change them at any time from the "Cookie preferences" link in the site footer.

We use the following categories of cookies:

  • Strictly necessary cookies: required for the website to function (for example, to remember your cookie preferences). These do not require consent.
  • Analytics cookies: help us understand how visitors interact with our website (for example, Google Analytics). We use this information to improve the website. Loaded only with your consent.
  • Advertising and retargeting cookies and pixels: used to deliver advertisements relevant to you on third-party platforms (for example, Meta Pixel, Google Ads, Pinterest). Loaded only with your consent.
  • Session replay: we use Lucky Orange, a session replay tool that records anonymised user sessions on our website (such as mouse movements, clicks, and scrolling) so we can identify usability issues. Loaded only with your consent. Sensitive form fields are masked.

You can manage your cookie preferences at any time by clicking the cookie settings link in the footer of our website. Withdrawing consent will not affect any processing that already took place lawfully before withdrawal.

8. Marketing communications

We may send you marketing emails about our products, services, events, and relevant resources. We will only do so where you have given your consent, or where we are permitted to do so under the "soft opt-in" rules for existing customers (i.e. you have already purchased or shown interest in similar products or services, and we offered you an opportunity to opt out at the time of collection and in every communication since).

You can opt out at any time by:

If you opt out of marketing, we will keep a minimal suppression record (typically your email address) so that we do not contact you again. You will still receive service-related and transactional messages where necessary.

9. Who we share your personal data with

We share your personal data only where necessary and only with the categories of recipients listed below. We do not sell your personal data for monetary consideration.

9.1 Service providers (processors)

We use third-party service providers to help us run our business. These providers process personal data only on our instructions, under written data-processing agreements that comply with Article 28 GDPR. Our current service providers include, by category:

  • Hosting and cloud infrastructure: Amazon Web Services (AWS) (data stored in Canada).
  • European website hosting, edge runtime, CDN and bot protection: Cloudflare, Inc. (global edge network, with EU points of presence). Cloudflare processes IP addresses and request metadata for every visit to eu.trexorobotics.com to deliver pages, cache static assets, and block abusive traffic. Cloudflare Turnstile is loaded on our contact and brochure forms to verify that submissions come from humans, not bots.
  • European website database, authentication, and file storage: Supabase (managed PostgreSQL hosted in the EU). Stores contact-form submissions, brochure requests, reservation records, and the brochure PDF asset served from our website.
  • Lead routing automation: Zapier, Inc. (United States). When you submit the contact form or request a brochure, a minimal payload (your name, email, role, country, locale, and the message you wrote) is forwarded to Zapier so the lead is routed into our CRM. The payload is sent over HTTPS and is processed under Standard Contractual Clauses.
  • CRM and customer data management: Salesforce (data stored in Quebec, Canada) and Airtable.
  • Online forms and assessment intake: Salesforce and Jotform. For EU/UK assessments, we use Jotform's European servers via a dedicated EU account.
  • Payment processing: Stripe.
  • Video calls and assessment recordings: Google Meet and Zoom (for video assessments and meetings).
  • Document storage: Google Workspace (including Google Drive) for storage of assessment recordings and business documents.
  • Training delivery: Thinkific for the delivery of training content and certifications.
  • Website analytics and session replay: Google Analytics and Lucky Orange (loaded only with consent. See Section 7).
  • Cookie consent management: managed in-house by Trexo through a first-party consent banner and preferences interface on this website. No third-party consent management platform is used.
  • Embedded video on our European website: YouTube (Google LLC), using the privacy-enhanced youtube-nocookie.com domain. The video player is embedded on the Trexo Home page. YouTube does not set tracking cookies until you start playback, but when you press play YouTube still receives your IP address, user-agent, and the URL of the page hosting the player. If you do not press play, no data is sent to YouTube beyond what is needed to load the player frame.
  • Advertising and marketing platforms: Meta (Facebook, Instagram, WhatsApp, Messenger), Google (Ads, YouTube), Pinterest, Spotify, Reddit, ManyChat (loaded only with consent. See Section 7).
  • Intra-group processing: Trexo Robotics Inc. (Canada) and Trexo Robotics Europe Sp. z o.o. process personal data on behalf of one another for the purpose of delivering services to EU and UK customers. The two entities are part of the same corporate group.

9.2 Authorised distributors

In countries where we work with local authorised distributors, the distributor will normally collect and process your personal data under their own privacy policy. If, by exception, you contact Trexo directly from a country where we have an authorised distributor, we may share your contact information with that distributor so that they can follow up with you. The distributor will then act as an independent controller of your personal data under their own privacy policy.

9.3 Healthcare professionals and clinical organisations

Where you receive an assessment, training session, or therapy from a healthcare professional or clinical organisation in connection with our products, that professional or organisation may also process your personal data as an independent controller under their own legal basis and privacy policy.

9.4 Professional advisors

We may disclose personal data to our legal counsel, accountants, auditors, insurers, and other professional advisors where necessary in the course of the services they provide to us, under confidentiality obligations.

9.5 Authorities and legal disclosures

We may disclose personal data where we are required to do so by law, in response to valid requests from regulators, law enforcement, or courts, or where we believe disclosure is necessary to protect our rights, your safety, or the safety of others. As a medical device manufacturer, we are required to report serious incidents to the relevant national competent authorities in the EU/UK under applicable medical-device vigilance regimes, with MDR for EU/Northern Ireland and UK medical-device rules for Great Britain.

9.6 Business transfers

If we sell, transfer, or restructure all or part of our business, your personal data may be transferred to the buyer or successor entity, subject to the protections of this Privacy Policy and applicable law.

10. International data transfers

Trexo Robotics Inc. is headquartered in Canada, and some of our service providers are located in the United States and other countries outside the EU/EEA, the UK, and Switzerland. Your personal data may therefore be transferred to, stored in, and processed in these countries.

Laws in these countries may differ from those of your country of residence, and personal data may be subject to access by foreign courts, law enforcement, or national security authorities under local laws.

Where we transfer personal data outside the EU/EEA, the UK, or Switzerland, we ensure that an appropriate transfer mechanism is in place:

  • Transfers to Canada (Trexo Robotics Inc.): Canada benefits from a (partial) adequacy decision from the European Commission and an adequacy regulation from the UK Government, both covering organisations subject to Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Trexo Robotics Inc. is subject to PIPEDA in its commercial activities. Canada is also listed by the Swiss Federal Council as providing an adequate level of protection under Annex 1 of the Swiss Data Protection Ordinance (DPO), with the same PIPEDA scope.
  • Transfers to the United States and other non-adequate countries: we rely on appropriate safeguards, including the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914) for transfers from the EU/EEA, the UK International Data Transfer Agreement or UK Addendum to the EU SCCs for transfers from the UK, and equivalent safeguards permitted under Article 16 FADP for transfers from Switzerland (including Standard Contractual Clauses recognised by the FDPIC). Where required, we carry out transfer impact assessments and put in place supplementary measures. No personal data is transferred to Trexo US in the ordinary course; if this changes, transfer safeguards will be put in place.

You have the right to ask us for a copy of the safeguards we use for international transfers. Please contact privacy@trexorobotics.com.

11. How long we keep your personal data

We keep personal data only for as long as necessary for the purposes for which it was collected, including to meet legal, regulatory, accounting, and reporting obligations. The criteria we use to determine retention periods include:

  • The duration of our relationship with you (for example, while you have an active reservation, are an active customer, or actively use a Trexo device);
  • Our legal obligations as a medical device manufacturer, including device traceability, post-market surveillance, and vigilance reporting under the MDR. These obligations require us to retain certain records (such as device serial numbers and unique identifiers, manufacturing and supplier information, and post-market surveillance documentation) for at least 10 years after the last device of a given type is placed on the market. This does not mean all personal data is kept for 10 years, only those records necessary to meet our MDR obligations;
  • Whether there is an ongoing legal claim, dispute, complaint, or regulatory matter;
  • The sensitivity of the data (health data is retained for the minimum period reasonably necessary);
  • Whether you have asked us to delete your data (subject to any overriding legal retention requirements).

At a high level:

  • Lead and inquiry data: retained while we are in active discussions with you, and for a reasonable period thereafter to follow up.
  • Assessment and health data: retained for as long as necessary to support your relationship with us, and thereafter only where retention is required for safety, regulatory, or legal reasons.
  • Customer account, transaction, and device records: retained for the duration of the customer relationship and for the longer of (i) the period required under applicable accounting and tax laws and (ii) the period required under the MDR for device traceability.
  • Marketing data: retained while you remain subscribed to our communications and, if you unsubscribe, only as a suppression record to prevent further contact.
  • Website analytics and tracking data: retained for the periods set in our analytics and tracking tools (typically up to 26 months).

After the relevant retention period has expired, we either securely delete the personal data or anonymise it so that it can no longer be linked to you.

12. How we protect your personal data

We implement reasonable administrative, technical, and physical security measures to protect your personal data against unauthorised access, alteration, disclosure, loss, or destruction. These measures include:

  • Encryption of personal data at rest and in transit using industry-standard algorithms;
  • Role-based access controls and least-privilege access policies;
  • Regular security reviews, vulnerability scanning, and where appropriate penetration testing;
  • Confidentiality obligations and data-protection training for our personnel;
  • Contractual data-protection requirements on our service providers and sub-processors;
  • Backups, business continuity, and incident response procedures.

No system is completely secure, and we cannot guarantee the security of data transmitted to us over the internet. If you believe that the security of your personal data has been compromised, please contact us at privacy@trexorobotics.com.

13. Automated decision-making and profiling

We do not currently use your personal data to make decisions about you that are based solely on automated processing and that produce legal or similarly significant effects on you. If this changes in the future, we will update this Privacy Policy and provide you with the information required under Article 22 GDPR / UK GDPR.

We may use limited inferences (for example, your stated interest in particular content) to tailor the information and offers we send you, but these are not "automated decisions" within the meaning of Article 22.

14. Your rights

Depending on where you reside, you have rights regarding the processing of your personal data under the EU GDPR, the UK GDPR, or the Swiss FADP. These rights are broadly similar but not identical across the three regimes. The list below describes the rights as they apply under the EU GDPR and UK GDPR; if you reside in Switzerland, your rights are governed by the Swiss FADP and may differ in scope and exercise.

  • Right of access: to ask whether we hold personal data about you and, if so, to obtain a copy of that data and information about how we process it.
  • Right to rectification: to ask us to correct inaccurate or incomplete personal data.
  • Right to erasure ("right to be forgotten"): to ask us to delete your personal data, subject to legal obligations that may require us to retain it.
  • Right to restrict processing: to ask us to limit how we process your data in certain circumstances.
  • Right to object: to object to processing based on our legitimate interests, including direct marketing.
  • Right to data portability: to receive your personal data in a structured, commonly used, and machine-readable format, or to have us transmit it to another controller where technically feasible.
  • Right to withdraw consent: where we process your personal data based on consent, to withdraw that consent at any time, without affecting the lawfulness of processing before withdrawal.
  • Right not to be subject to solely automated decisions: as described in Section 13.
  • Right to lodge a complaint: as described in Section 15.

To exercise any of these rights, contact us at privacy@trexorobotics.com or one of our representatives listed in Section 2.3. We will respond within one month of receiving your request. We may extend this period by up to two further months for complex or numerous requests, in which case we will let you know.

For Swiss residents: the Swiss FADP grants you rights that are broadly comparable to the GDPR rights listed above, including the right to information (Art. 25 FADP), the right to data delivery and transfer (Art. 28 FADP), and the right to object to certain processing. There are some differences in scope and procedure. To exercise your rights under the Swiss FADP, contact our Swiss representative at the address in Section 2.3 or privacy@trexorobotics.com.

We may need to verify your identity before responding to your request. If we are unable to comply with your request, we will explain why.

15. How to make a complaint

If you have a concern about how we handle your personal data, we encourage you to contact us first at privacy@trexorobotics.com so we can try to resolve it. You also have the right to lodge a complaint with a supervisory authority:

  • EU/EEA residents (including Norway, Iceland, and Liechtenstein): a list of national supervisory authorities is available at edpb.europa.eu. Residents of Norway can also contact Datatilsynet (datatilsynet.no). Residents of Iceland can contact Persónuvernd (personuvernd.is). Residents of Liechtenstein can contact the Datenschutzstelle (datenschutzstelle.li).
  • UK residents: the Information Commissioner's Office (ICO) at ico.org.uk.
  • Swiss residents: the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch.

16. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in the technologies we use, in applicable law, or for other operational reasons. The "Last updated" date at the top of this Policy will reflect the most recent version. Where the changes are material, we will notify you in advance, for example by email or by a notice on our website.

17. Contact us

If you have any questions or concerns about this Privacy Policy or how we handle your personal data, please contact us at:

Trexo Robotics Inc.
6705 Millcreek Dr, Unit 3, Mississauga, Ontario, Canada L5N 5M4
Email: privacy@trexorobotics.com

For EU/UK/Swiss residents, you can also contact our local representatives listed in Section 2.3.