Latest page update: 07.02.2023
1. About this page
2. What kind of data does RELEX process?
3. Services delivery related activities for which RELEX operates as a processor
4. Services delivery related activities for which RELEX operates as a controller
5. Future changes
6. Further information
1. About this page
This page lists and provides information related to the third-party sub-processors and RELEX corporate affiliates that may have incidental access to RELEX customer data while providing cloud or support services to those customers.
The page utilizes the following abbreviations when referring to different RELEX service families:
- RELEX Plan = Forecasting and Replenishment
- RELEX Store = Space & Assortment and On-the-Go Replenishment
- RELEX Work = Workforce Optimization and Management
Understanding the compliance requirements imposed on RELEX customers in terms of processing and subcontracting the processing of personal data, RELEX has split this page into those activities where RELEX undertakes personal data processing in the name of and on behalf of its customers and those where RELEX utilizes subcontractors for its own, independently defined purposes.
2. What kind of data does RELEX process?
Logistic service data
The majority of RELEX’s service-related data processing involves information not attributable to individuals, including:
- Information on articles manufactured, shipped, stored, distributed, sold, and remaining
- Enhanced information, learnings, and suggestions based on the above
- Data typically needed to authenticate services, related communications, and tracking-related competencies
Personal data
RELEX typically processes the following categories of personally identifiable data, which relate to both RELEX’s and our customers’ employees:
- User credentials
- Email addresses and phone numbers
- Device IP addresses
- Service usage information
- Training course data
The only RELEX solution that processes personal data as part of its core functionality is Workforce Optimization and Management. In this context, RELEX processes the following data on customer employees:
- Work history and competency information
- Employee default work location
- Work locations and shifts
- Absences
- Contractual employment information
- Terms of applicable collective agreements
Each class of data may be complemented by other data of similar stature and sensitivity.
Excluded data
Special categories of data such as employee race or health are not collected or processed in any RELEX service, including Workforce Optimization.
RELEX solutions do not collect data on RELEX customers’ end-consumers in an identifiable format. In other words, data is not collected on individual shoppers making purchases from stores serviced by RELEX solutions.
Processing roles and document scope
RELEX processes personal data both in the roles of ‘processor’ and ‘controller’ as defined by the European Union’s General Data Protection Regulation (2016/679). By comparison, the respective roles under California Consumer Privacy Act would be ‘business’ and ‘service provider’.
3. Services delivery related activities for which RELEX operates as a processor
This section focuses on providing transparency to RELEX customers on the data processing that RELEX undertakes in the role of a processor.
RELEX utilizes sub-processors to process personal data on behalf of its customers in the following contexts.
- Global support – RELEX services are operated, delivered, and maintained with the help of RELEX employees around the globe.
- Cloud hosting – RELEX service infrastructure is based on both private and public clouds.
- Managed services – Providing specific capabilities inside RELEX services, such as service user authentication.
- Ancillary services – Services that support customers’ use of RELEX core service offering, such as a training platform.
- Contractors – RELEX utilizes selected third party-contractors in areas requiring specific technical competencies.
The below sections provide more information on RELEX’s affiliates and specific subcontractors utilized for the above purposes.
Global support
RELEX maintains a global pool of technical and solution consultants to support, operate, deliver, and maintain services. While doing so, RELEX support personnel may process, store, or otherwise access customer employees’ personal data. Such access is subject to RELEX policies and supervision and may take place by the employees of the following RELEX affiliates.
| Affiliate company | RELEX services in relation to which personal data may be accessed from the affiliate company | Corporate location |
|---|---|---|
| RELEX affiliates in European Economic Area with access to customer personal data | ||
| RELEX Solutions ApS | all services | Denmark |
| RELEX Solutions SAS | RELEX Plan, RELEX Store | France |
| RELEX Solutions GmbH | all services | Germany |
| RELEX Solutions S.r.l | RELEX Plan, RELEX Store | Italy |
| RELEX Solutions AS | RELEX Plan, RELEX Store | Norway |
| RELEX Solutions Unipessoal LDA | RELEX Plan, RELEX Store | Portugal |
| RELEX IBERIA, S.L. | RELEX Plan, RELEX Store | Spain |
| Retail Logistics Excellence AB | all services | Sweden |
| Formulate AB | RELEX Plan, RELEX Store | Sweden |
| RELEX affiliates outside the European Union area with access to customer personal data and subject to an EU Commission adequacy finding justifying the processing of such data absent additional safeguards | ||
| RELEX Solutions UK Limited RELEX Limited | all services | United Kingdom |
| RELEX affiliates outside the European Union area with access to customer personal data | ||
| RELEX Solutions Pty Ltd | RELEX Plan, RELEX Store | Australia |
| RELEX Solutions Asia Limited | RELEX Store | Hong Kong |
| RELEX Solutions PTE LTD | RELEX Plan | Singapore |
| RELEX Solutions Inc. | RELEX Plan, RELEX Store | United States of America |
Cloud hosting by RELEX
Personal data from customers in Europe, the Middle East, and Africa is primarily stored in EU regions by public cloud providers. Personal data from customers in other regions is primarily stored in the USA by public cloud providers.
Cloud hosting providers provide international support and maintenance for their services and may access limited amounts of customer personal data from regions other than their own. Such access is typically limited to technical operation and troubleshooting of the servers, storage systems, and application platforms used to provide applicable services.
Where RELEX private cloud is used, RELEX maintains the processing of customer data in private clouds located in Finland and the USA and that data is split by customer region like the public cloud above. Third-party cloud providers do not have access to data processed in private clouds.
| Sub-processor | RELEX services utilizing technology | Service provided | Type of personal data | Sub-processor corporate location | Data Location |
|---|---|---|---|---|---|
| Amazon Web Services, Inc. (AWS) | RELEX Store, RELEX Work | Cloud hosting | User identifiers in logs Email addresses | USA | Customers located in EMEA and APAC regions have their data stored in AWS’s European regions. Customers located in NA and LATAM regions have their data stored in AWS’s USA regions. |
| Microsoft group | all services | Azure cloud hosting, identity management and authentication service, data routing. RELEX Plan The following microservices are hosted on Azure: RELEX Identity Service, which provides authentication and acts as a federation gateway to RELEX application; and RELEX Application gateway, which provides routing for user requests. | RELEX Store / RELEX Work: username and credentials email address, device IP address phone number & other contact details log data re: service use other personal data provided (e.g. service requests) RELEX Plan: Username, email address, user ID, IP address | USA | Customers located in EMEA and APAC regions have their data stored in Microsoft’s EU West region. Customers located in NA and LATAM regions have their data stored in Microsoft’s US East region. |
Managed services
Managed service providers provide support and maintenance for their services internationally and may access limited amounts of customer personal data residing in RELEX infrastructure from regions other than their own. Such access is typically necessary to enable or restore the correct operation of managed service servers, storage systems, and application platforms.
| Sub-processor | RELEX services utilizing technology | Service provided | Type of personal data | Sub-processor corporate location |
|---|---|---|---|---|
| Citrix Systems Inc. | CCM (aka. Hosted Space, may be delivered as part of RELEX Store) | Application virtualization tool for delivering RELEX Hosted Space to customers. | User identifiers email addresses | USA |
| IT Voimala Oy | Hosted space VDA solution | Management of Citrix solution and related solution monitoring and session analytics | User name, IP address and time stamps contained in session statistics | Finland |
| Aiven Oy | RELEX Plan, RELEX Store | Data transfer in RELEX environment (transferring data between microservices and between solutions), such as managed message queues (Kafka) and managed database (PostgreSQL) | User identifiers | Finland |
| Confluent Inc. | RELEX Plan, RELEX Store | Data transfer in RELEX environment (transferring data between microservices and between solutions). | User identifiers, typically email addresses | USA |
| Twilio Inc. | RELEX Plan, RELEX Store | Sendgrid -email relay service for 1) communications between customer-stores-their vendors; 2) submission of support requests to RELEX. | Email addresses | USA |
| Auth0, Inc. | RELEX Work | Authentication service | User Identifier (email addresses), password, IP address | USA |
Ancillary services
The following sub-processors provide ancillary services to help support, operate, and maintain the service and may process, store, or otherwise access limited customer personal data while providing their ancillary services.
The most relevant ancillary service which RELEX uses is a third-party online training tool. The provider of the tool stores and processes the user account information and profiles of persons participating in training courses.
| Sub-processor | RELEX services utilizing technology | Service provided | Type of personal data | Sub-processor corporate location |
|---|---|---|---|---|
| Docebo Inc. | All | Online training tool | Email address, company, user training profile, user training transcript, IP address, logs | Canada |
Contractors
The following sub-processors provide contract staff that work in close cooperation with RELEX staff to help support, operate, and maintain the service.
| Sub-processor | RELEX services utilizing technology | Service provided | Type of personal data | Sub-processor corporate location |
|---|---|---|---|---|
| TGA Solutions Oy | All | Technical support | All types of personal data available in the respective service | Finland |
| Wunderdog Oy | RELEX Store, RELEX Work | Development. support and maintenance | All types of personal data available in the respective service | Finland |
| Polarsquad Oy | RELEX Work | Development, support and maintenance | All types of personal data available in the respective service | Finland |
| George Technology Group | RELEX Plan, RELEX Store | Delivery, development | All types of personal data available in the respective service | South Africa |
4. Services delivery related activities for which RELEX operates as a controller
The below chart lists service delivery related activities where RELEX undertakes personal data processing – with the help of its processors – for which it has defined the purposes and means itself.
- Global support – RELEX services are operated, delivered, and maintained with the help of RELEX employees around the globe.
- Managed services – Monitoring service performance and authorized service usage.
- Ancillary services – Tracking and sharing status information on ongoing tickets, tasks, and projects.
- Corporate infrastructure – Tools for structuring RELEX’s support process, conducting communications and collecting feedback.
Global support
RELEX maintains a global pool of technical and solution consultants to support, operate, deliver, and maintain services. While doing so, RELEX support personnel may process, store, or otherwise access customer employees’ personal data when handling support issues via support tickets. Such access is subject to RELEX policies and supervision and may take place by the employees of any of the RELEX affiliates listed in the similarly named subsection under section 3.
Managed services
Managed service providers provide support and maintenance for their services internationally and may access limited amounts of personal data processed in such services. Such access is typically necessary to enable or restore the correct operation of managed service servers, storage systems, and application platforms.
| Processor | RELEX services utilizing technology | Service provided | Type of personal data | Sub-processor corporate location |
|---|---|---|---|---|
| Datadog Inc. | All | Logging platform | User ids Logs of sent emails | USA |
| Honeycomb aka. Hound Technology, Inc. | All | Performance tracing platform | User ids | USA |
| Sentry.io aka Functional Software, Inc | RELEX Plan, RELEX Work | Web client error tracing tool | User ids IP addresses | USA |
Ancillary services
The following processors provide ancillary services to help support, operate, and maintain the service and may process, store, or otherwise access limited customer personal data while providing ancillary services.
| Processor | RELEX services utilizing technology | Service provided | Type of personal data | Sub-processor corporate location |
|---|---|---|---|---|
| Smartsheet | All | Visibility tool for RELEX to offer its customers (& internal teams) visibility to ongoing tickets/tasks/projects. | Names (both RELEX and customer employee names, potential partner names) | USA |
| InSided B.V. | RELEX Community, optional to all services | Online community platform including discussion forums, Q&A, product news, best practice blog and product ideation | Name, email address, company, role, community user ID, IP address, username, profile picture | The Netherlands, USA |
| Microsoft group | RELEX Community | Analysis of community user data for improving platform usage & customer service/engagement. The utilized tool is Microsoft BI | Name, username, company, email address, activity in the community | USA |
| Salesforce group | All | Storing and analyzing customer account and contact related data | Name, role, email address, community activity, community membership | USA |
| Productboard, Inc. | A separate tool | Product management tool via which customers can track and provide feedback to RELEX Solution development. | Name, company, email address | USA |
Corporate infrastructure
The following processors provide services related to RELEX’s larger corporate operations while relating to RELEX’s delivery of contracted services to customers.
| Processor | RELEX services utilizing technology | Service provided | Type of personal data | Sub-processor corporate location |
|---|---|---|---|---|
| Atlassian Pty Ltd and Atlassian Network Services Inc. | All | Support system | Business contact information of employees entering support tickets Jira user account details IP addresses & access logs | USA, Australia |
| YodelTalk Limited | All | Support phone call routing | Phone number of users who calls RELEX support. Phone calls may be recorded for quality assurance purposes. | USA |
| Twilio Inc. | All | Sendgrid -email relay service for purposes of sending messages to customers | Email addresses | USA |
5. Future changes
RELEX will maintain and update this page to communicate changes in sub-processors utilized by RELEX that process personal data.
To provide cutting edge services to its customers, RELEX, like other SaaS -providers, will constantly evaluate subcontractors’ fit within RELEX’s platform and architecture. To keep the information on this page up to date, RELEX will make changes and additions to the page from time to time, and changes will apply from the date that the revised version of the page is published.
RELEX will inform customers of material page updates by email. Customer employees may adjust the recipients of such communications by following the instructions on communication emails.
6. Further information
For more information about RELEX’s subcontracting practices and related privacy implications and safeguards, please contact:
subprocessor-communications@relexsolutions.com