← Back to home
Privacy policy
Last updated 6 August 2026
We collect as little as possible, and only what we actually need in order to reply to you and do the work. This page sets out exactly what that means.
Who is responsible
RExelerate AB, company reg. 559596-2472, registered in Kävlinge, Sweden, is the data controller for the processing described here.
Questions about personal data, or requests for access, rectification or erasure: support@rexelerate.se. We reply within one working day and resolve the matter within one month at the latest.
When you visit rexelerate.se
We set no cookies and use no third-party scripts. There is no cookie banner here for the simple reason that there is nothing to consent to. The page loads no fonts, images or measurement tools from other companies' servers – everything sits on our own address.
The site is hosted by Cloudflare, which as our supplier handles the web traffic. Cloudflare logs the technical information every web server needs in order to function and defend itself: IP address, time, which page was requested and which browser was used. It is used solely for operations and security, not to follow you between sites or build profiles.
Legal basis: legitimate interest (Article 6(1)(f) GDPR) in operating and protecting the site.
When you contact us
If you submit the contact form, what you wrote is assembled into an email that you send yourself from your own email client. The form stores nothing with us, and sends nothing until you do.
Once the email arrives we process the details you chose to give – typically name, company name, email address and what you described – in order to reply and give an assessment.
- Purpose: answering your enquiry and preparing a possible agreement.
- Legal basis: legitimate interest, or steps prior to entering a contract (Article 6(1)(f) and 6(1)(b) GDPR respectively).
- Retention: twelve months after the last contact, if it does not lead to an engagement. The correspondence is then deleted.
Our email is hosted with Google Workspace, which is therefore a data processor for the email correspondence we have with you.
When you are a client
As a client we process contact details for you and your staff, invoicing records, and the data required to build and run what you ordered.
- Legal basis: performance of a contract (Article 6(1)(b)), and for accounting a legal obligation (Article 6(1)(c)).
- Retention: for the term of the agreement and three years after. Accounting records are kept for seven years under Swedish accounting law.
If we build something that processes your customers' personal data – a form, a booking flow or an automation – we become your data processor. In that case we sign a data processing agreement. It is included; you do not have to ask for it.
The client portal
The portal at rexelerate.se/kund requires a login and is excluded from search indexing. It shows operational status, reports and work in progress for your own engagement. The measurement behind the reports is done without third-party cookies and without identifying individual visitors.
Who may receive the data
We never sell personal data and do not pass it on for anyone else's marketing. The suppliers that process data on our behalf are:
- Cloudflare – hosting the website.
- Google Workspace – email and documents.
- Our accounting firm – invoicing records and bookkeeping.
A data processing agreement is in place with all of them. Any transfer outside the EU/EEA relies on the European Commission's standard contractual clauses.
Data may also have to be disclosed where law or a decision by an authority requires it.
Your rights
You have the right to
- know what data we hold about you, and get a copy of it,
- have incorrect data corrected,
- have data erased once we no longer have reason to keep it,
- request that processing be restricted,
- object to processing based on legitimate interest,
- receive data you provided in a machine-readable format (portability).
Get in touch at support@rexelerate.se and we will sort it out. If you think we are handling your data wrongly you have the right to complain to the Swedish Authority for Privacy Protection (IMY).
Security
Traffic to the site is encrypted over HTTPS. Access to systems and accounts is limited to those who need it and protected with two-factor authentication. We take daily backups and regularly test that they can be read back. If a personal data breach occurs we report it to IMY within 72 hours and inform you if you are affected.
Changes
If we change this policy we update the date at the top. If the change matters materially to you as a client we get in touch directly rather than letting you discover it yourself.