RELEX services’ processors

1. About this page
2. What kind of data does RELEX process?
3. Services delivery related activities for which RELEX operates as a processor
4. Services delivery related activities for which RELEX operates as a controller
5. Future changes
6. Further information

1. About this page 

This page lists and provides information related to the third-party sub-processors and RELEX corporate affiliates that may have incidental access to RELEX customer data while providing cloud or support services to those customers.  

The page utilizes the following abbreviations when referring to different RELEX service families:  

  • RELEX Plan = Forecasting and Replenishment 
  • RELEX Store = Space & Assortment and On-the-Go Replenishment 
  • RELEX Work = Workforce Optimization and Management 

Understanding the compliance requirements imposed on RELEX customers in terms of processing and subcontracting the processing of personal data, RELEX has split this page into those activities where RELEX undertakes personal data processing in the name of and on behalf of its customers and those where RELEX utilizes subcontractors for its own, independently defined purposes.  

2. What kind of data does RELEX process? 

Logistic service data 

The majority of RELEX’s service-related data processing involves information not attributable to individuals, including: 

  • Information on articles manufactured, shipped, stored, distributed, sold, and remaining 
  • Enhanced information, learnings, and suggestions based on the above 
  • Data typically needed to authenticate services, related communications, and tracking-related competencies 

Personal data 

RELEX typically processes the following categories of personally identifiable data, which relate to both RELEX’s and our customers’ employees: 

  • User credentials 
  • Email addresses and phone numbers 
  • Device IP addresses 
  • Service usage information 
  • Training course data 

The only RELEX solution that processes personal data as part of its core functionality is Workforce Optimization and Management. In this context, RELEX processes the following data on customer employees: 

  • Work history and competency information 
  • Employee default work location  
  • Work locations and shifts 
  • Absences 
  • Contractual employment information 
  • Terms of applicable collective agreements 

Each class of data may be complemented by other data of similar stature and sensitivity.  

Excluded data 

Special categories of data such as employee race or health are not collected or processed in any RELEX service, including Workforce Optimization. 

RELEX solutions do not collect data on RELEX customers’ end-consumers in an identifiable format. In other words, data is not collected on individual shoppers making purchases from stores serviced by RELEX solutions.   

Processing roles and document scope 

RELEX processes personal data both in the roles of ‘processor’ and ‘controller’ as defined by the European Union’s General Data Protection Regulation (2016/679). By comparison, the respective roles under California Consumer Privacy Act would be ‘business’ and ‘service provider’.  

3. Services delivery related activities for which RELEX operates as a processor 

This section focuses on providing transparency to RELEX customers on the data processing that RELEX undertakes in the role of a processor. 

RELEX utilizes sub-processors to process personal data on behalf of its customers in the following contexts.   

  • Global support – RELEX services are operated, delivered, and maintained with the help of RELEX employees around the globe.  
  • Cloud hosting – RELEX service infrastructure is based on both private and public clouds. 
  • Managed services – Providing specific capabilities inside RELEX services, such as service user authentication.  
  • Ancillary services – Services that support customers’ use of RELEX core service offering, such as a training platform.  
  • Contractors – RELEX utilizes selected third party-contractors in areas requiring specific technical competencies. 

The below sections provide more information on RELEX’s affiliates and specific subcontractors utilized for the above purposes. 

Global support 

RELEX maintains a global pool of technical and solution consultants to support, operate, deliver, and maintain services. While doing so, RELEX support personnel may process, store, or otherwise access customer employees’ personal data. Such access is subject to RELEX policies and supervision and may take place by the employees of the following RELEX affiliates. 

Affiliate companyRELEX services in relation to which personal data may be accessed from the affiliate companyCorporate location
 RELEX affiliates in European Economic Area with access to customer personal data
RELEX Solutions ApS all servicesDenmark 
RELEX Solutions SAS RELEX Plan, RELEX Store France 
RELEX Solutions GmbH all services Germany 
RELEX Solutions S.r.l RELEX Plan, RELEX Store Italy 
RELEX Solutions AS RELEX Plan, RELEX Store Norway 
RELEX Solutions Unipessoal LDA RELEX Plan, RELEX Store Portugal 
RELEX IBERIA, S.L. RELEX Plan, RELEX Store Spain 
Retail Logistics Excellence AB all servicesSweden 
 RELEX affiliates outside the European Union area with access to customer personal data and subject to an EU Commission adequacy finding justifying the processing of such data absent additional safeguards 
RELEX Solutions UK Limited RELEX Limited all services United Kingdom 
 RELEX affiliates outside the European Union area with access to customer personal data 
RELEX Solutions Pty Ltd  RELEX Plan, RELEX Store Australia  
RELEX Solutions Asia Limited RELEX Store Hong Kong 
RELEX Solutions PTE LTD RELEX Plan Singapore 
RELEX Solutions Inc. RELEX Plan, RELEX Store United States of America 

Cloud hosting by RELEX 

Personal data from customers in Europe, the Middle East, and Africa is primarily stored in EU regions by public cloud providers. Personal data from customers in other regions is primarily stored in the USA by public cloud providers. 

Cloud hosting providers provide international support and maintenance for their services and may access limited amounts of customer personal data from regions other than their own. Such access is typically limited to technical operation and troubleshooting of the servers, storage systems, and application platforms used to provide applicable services. 

Where RELEX private cloud is used, RELEX maintains the processing of customer data in private clouds located in Finland and the USA and that data is split by customer region like the public cloud above. Third-party cloud providers do not have access to data processed in private clouds. 

Sub-processorRELEX services utilizing technologyService providedType of personal dataSub-processor corporate locationData Location
Amazon Web Services, Inc. (AWS) RELEX Store, RELEX Work Cloud hosting User identifiers in logs  Email addresses USA Customers located in EMEA and APAC regions have their data stored in AWS’s European regions.  Customers located in NA and LATAM regions have their data stored in AWS’s USA regions. 
Microsoft group all services Azure cloud hosting, identity management and authentication service, data routing.  
 
RELEX Plan The following microservices are hosted on Azure:  RELEX Identity Service, which provides authentication and acts as a federation gateway to RELEX application; and RELEX Application gateway, which provides routing for user requests. 
RELEX Store / RELEX Work:  username and credentials email address, device IP address phone number & other contact details log data re: service use other personal data provided (e.g. service requests) RELEX Plan: Username, email address, user ID, IP address USA  Customers located in EMEA and APAC regions have their data stored in Microsoft’s EU West region.  Customers located in NA and LATAM regions have their data stored in Microsoft’s US East region. 
More information on the mentioned vendors’ compliance can be found on Amazon Web Services compliance pages and Microsoft data protection resource pages

Managed services  

Managed service providers provide support and maintenance for their services internationally and may access limited amounts of customer personal data residing in RELEX infrastructure from regions other than their own. Such access is typically necessary to enable or restore the correct operation of managed service servers, storage systems, and application platforms.  

Sub-processorRELEX services utilizing technologyService providedType of personal dataSub-processor corporate location
Citrix Systems Inc.  CCM (aka. Hosted Space, may be delivered as part of RELEX Store) Application virtualization tool for delivering RELEX Hosted Space to customers. User identifiers email addresses USA 
Aiven Oy RELEX Plan, RELEX Store Data transfer in RELEX environment (transferring data between microservices and between solutions),  
such as managed message queues (Kafka) and managed database (PostgreSQL) 
User identifiers Finland 
Twilio Inc.  RELEX Plan, RELEX Store Sendgrid -email relay service for 1) communications between customer-stores-their vendors; 2) submission of support requests to RELEX. Email addresses USA 
Auth0, Inc. RELEX Work Authentication service User Identifier (email addresses), password, IP address USA 

Ancillary services 

The following sub-processors provide ancillary services to help support, operate, and maintain the service and may process, store, or otherwise access limited customer personal data while providing their ancillary services. 

The most relevant ancillary service which RELEX uses is a third-party online training tool. The provider of the tool stores and processes the user account information and profiles of persons participating in training courses. 

Sub-processorRELEX services utilizing technologyService providedType of personal dataSub-processor corporate location
Absorb Technology Ltd All Online training tool. Business email Supervisor, job category User account User training profile & transcripts IP addresses & logs Canada 

Contractors 

The following sub-processors provide contract staff that work in close cooperation with RELEX staff to help support, operate, and maintain the service. 

Sub-processorRELEX services utilizing technologyService providedType of personal dataSub-processor corporate location
TGA Solutions Oy All Technical support All types of personal data available in the respective serviceFinland
Wunderdog Oy RELEX Store, RELEX Work  Development. support and maintenance All types of personal data available in the respective serviceFinland
Polarsquad Oy RELEX Plan, RELEX Work Development, support and maintenance All types of personal data available in the respective serviceFinland
George Technology Group RELEX Plan, RELEX Store Delivery, development All types of personal data available in the respective serviceSouth Africa

4. Services delivery related activities for which RELEX operates as a controller 

The below chart lists service delivery related activities where RELEX undertakes personal data processing – with the help of its processors – for which it has defined the purposes and means itself. 

  • Global support – RELEX services are operated, delivered, and maintained with the help of RELEX employees around the globe.  
  • Managed services – Monitoring service performance and authorized service usage. 
  • Ancillary services – Tracking and sharing status information on ongoing tickets, tasks, and projects. 
  • Corporate infrastructure – Tools for structuring RELEX’s support process, conducting communications and collecting feedback. 

Global support 

RELEX maintains a global pool of technical and solution consultants to support, operate, deliver, and maintain services. While doing so, RELEX support personnel may process, store, or otherwise access customer employees’ personal data when handling support issues via support tickets. Such access is subject to RELEX policies and supervision and may take place by the employees of any of the RELEX affiliates listed in the similarly named subsection under section 3. 

Managed services 

Managed service providers provide support and maintenance for their services internationally and may access limited amounts of personal data processed in such services. Such access is typically necessary to enable or restore the correct operation of managed service servers, storage systems, and application platforms.  

ProcessorRELEX services utilizing technologyService providedType of personal dataSub-processor corporate location
Datadog Inc.  All Logging platform User ids Logs of sent emails USA 
Honeycomb aka. Hound Technology, Inc. RELEX Plan, RELEX Work Performance tracing platform User ids USA 
Sentry.io aka Functional Software, Inc RELEX Plan, RELEX Work Web client error tracing tool User ids IP addresses USA 

Ancillary services 

The following processors provide ancillary services to help support, operate, and maintain the service and may process, store, or otherwise access limited customer personal data while providing ancillary services. 

ProcessorRELEX services utilizing technologyService providedType of personal dataSub-processor corporate location
Smartsheet All Visibility tool for RELEX to offer its customers (& internal teams) visibility to ongoing tickets/tasks/projects.   Names (both RELEX and customer employee names, potential partner names) USA 

Corporate infrastructure 

The following processors provide services related to RELEX’s larger corporate operations while relating to RELEX’s delivery of contracted services to customers.  

ProcessorRELEX services utilizing technologyService providedType of personal dataSub-processor corporate location
Atlassian Pty Ltd and Atlassian Network Services Inc. All Support system Business contact information of employees entering support tickets Jira user account details IP addresses & access logs USA, Australia 
YodelTalk Limited All Support phone call routing Phone number of users who calls RELEX support. Phone calls may be recorded for quality assurance purposes. USA 
Twilio Inc.  All Sendgrid -email relay service for purposes of sending messages to customers Email addresses USA 

5. Future changes 

RELEX will maintain and update this page to communicate changes in sub-processors utilized by RELEX that process personal data.  

To provide cutting edge services to its customers, RELEX, like other SaaS -providers, will constantly evaluate subcontractors’ fit within RELEX’s platform and architecture. To keep the information on this page up to date, RELEX will make changes and additions to the page from time to time, and changes will apply from the date that the revised version of the page is published. 

RELEX will inform customers of material page updates by email. Customer employees may adjust the recipients of such communications by following the instructions on communication emails.  

6. Further information 

For more information about RELEX’s subcontracting practices and related privacy implications and safeguards, please contact:
subprocessor-communications@relexsolutions.com