Privacy policy
Last updated 23 September 2026
We collect as little as possible, and only what we actually need in order to reply to you and do the work. This page sets out exactly what that means.
Who is responsible
RExelerate AB, company reg. 559596-2472, registered in Kävlinge, Sweden, is the data controller for the processing described here.
Questions about personal data, or requests for access, rectification or erasure: support@rexelerate.se. We reply within one working day and resolve the matter within one month at the latest.
When you visit rexelerate.se
We set no cookies. There is no cookie banner here for the simple reason that there is nothing to consent to. Fonts and images sit on our own address. For visitor statistics we use Cloudflare Web Analytics – a cookie-free measurement tool that does not single out individual visitors. The Our work page also shows previews of our own demo sites, hosted with the same provider (Cloudflare). Everything else sits on our own address. That this site works without consent is an assessment of this site and its tools – not a general rule for every site we build.
The site is hosted by Cloudflare, which as our supplier handles the web traffic. Cloudflare logs the technical information every web server needs in order to function and defend itself: IP address, time, which page was requested and which browser was used. It is used solely for operations and security, not to follow you between sites or build profiles.
Legal basis: legitimate interest (Article 6(1)(f) GDPR) in operating and protecting the site.
When you contact us
Normally: when you submit the contact form, what you wrote goes to our form function (a server function at Cloudflare), which builds an email from it and hands it to Resend for delivery to our inbox at Google Workspace. The function keeps no copy and does not log what you wrote. The email contains what you filled in – name, email address, company, phone and service area if given, and your message – plus a random reference that you also see in the receipt.
Fallback: if sending fails you get a ready-made email draft to send from your own email client instead. In that case nothing has been stored with us until your email arrives.
We process the details in order to reply and give an assessment.
- Purpose: answering your enquiry and preparing a possible agreement.
- Legal basis: legitimate interest, or steps prior to entering a contract (Article 6(1)(f) and 6(1)(b) GDPR respectively).
- Retention: twelve months after the last contact, if it does not lead to an engagement. The correspondence is then deleted.
Our email is hosted with Google Workspace, the data processor for the correspondence. The form's email passes through Resend (processor for the delivery) and the form function runs at Cloudflare, which may process the request in data centres both inside and outside the EU/EEA. We do not claim that processing takes place exclusively within the EU – see who may receive the data.
When you are a client
As a client we process contact details for you and your staff, invoicing records, and the data required to build and run what you ordered.
- Legal basis: performance of a contract (Article 6(1)(b)), and for accounting a legal obligation (Article 6(1)(c)).
- Retention: for the term of the agreement and three years after. Accounting records are kept for seven years under Swedish accounting law.
If we build something that processes your customers' personal data – a form, a booking flow or an automation – we become your data processor. In that case we sign a data processing agreement. It is included; you do not have to ask for it.
The client portal
The portal at rexelerate.se/kund (in Swedish) requires a login and is excluded from search indexing. It shows operational status, reports and work in progress for your own engagement. The measurement behind the reports is done without third-party cookies and without identifying individual visitors.
Who may receive the data
We never sell personal data and do not pass it on for anyone else's marketing. The suppliers that process data on our behalf are:
- Cloudflare (USA, with data centres in the EU as well) – hosting the website, visitor statistics and the form function.
- Google Workspace (USA) – email and documents.
- Resend (USA) – delivery of the contact form's email.
- Our accounting firm – invoicing records and bookkeeping.
A data processing agreement is in place with all of them. Any transfer outside the EU/EEA relies on the European Commission's standard contractual clauses.
Data may also have to be disclosed where law or a decision by an authority requires it.
Your rights
You have the right to
- know what data we hold about you, and get a copy of it,
- have incorrect data corrected,
- have data erased once we no longer have reason to keep it,
- request that processing be restricted,
- object to processing based on legitimate interest,
- receive data you provided in a machine-readable format (portability).
Get in touch at support@rexelerate.se and we will sort it out. If you think we are handling your data wrongly you have the right to complain to the Swedish Authority for Privacy Protection (IMY).
Security
Traffic to the site is encrypted over HTTPS. Access to systems and accounts is limited to those who need it and protected with two-factor authentication. We take daily backups and regularly test that they can be read back. If a personal data breach occurs we assess the risk and report it to IMY within 72 hours of becoming aware of it, unless it is unlikely to result in a risk to your rights and freedoms. If it is likely to result in a high risk to you we inform you without undue delay.
Changes
If we change this policy we update the date at the top. If the change matters materially to you as a client we get in touch directly rather than letting you discover it yourself.