Privacy & data protection
This notice explains, in plain language, what REX processes when you visit this company website or send a business enquiry, why it is needed, how long it is kept and how to exercise your rights.
Last updated
01 / Responsibility
REX determines how personal data is used on this website and is therefore the data controller for the processing described below.
This notice covers the public pages under rex31.com/site and the contact form on those pages. Services, demonstrations and third-party websites reached through a link have their own data practices and are not covered by this notice.
02 / Processing record
We limit processing to the operations needed to serve the site, protect it and respond to a request you choose to send.
Serve pages, diagnose failures and protect the service against abuse.
Review your request, reply and, where relevant, prepare a proposal or other pre-contractual steps requested by you.
Send you a confirmation and route your enquiry to the authorised REX mailbox.
Limit automated or excessive submissions without profiling visitors.
If an enquiry leads to a contract, the information needed for the client relationship is moved into the relevant business records and kept for the applicable contractual, accounting or legal periods. You will be informed if a new use requires additional information.
03 / Data minimisation
The contact form distinguishes information needed to answer you from useful but optional context.
Do not include passwords, payment-card details, health data, government identifiers or confidential third-party records in the free-text field. If a later project requires protected material, REX will agree a suitable transfer channel separately.
04 / Access boundary
Access is limited to people and providers that need the information for the stated purpose.
The business mailbox used to review and answer the enquiry. Contact submissions are not copied to a separate personal inbox.
Hosts the website and contact service on the production VPS. Standard web-server logs are retained for 14 days.
Transmits the internal notification and your confirmation email. It processes the email address, content and delivery metadata as REX's email service provider.
Microsoft operates the REX receiving mailbox; the provider of the email address you supply necessarily receives the confirmation sent to you.
Resend states that customer email and log data is stored in the United States. Its Data Processing Addendum incorporates the European Commission's Standard Contractual Clauses and also describes the EU–US Data Privacy Framework. Email providers may process data internationally under their own applicable safeguards. You can ask REX for information about the safeguards relevant to your request.
Read Resend's Data Processing Addendum (opens in a new tab)
REX does not sell, rent or disclose contact-form data to data brokers, advertising networks or social platforms. It is not reused for newsletters or unsolicited marketing.
05 / Browser storage
The company site currently uses no audience analytics, advertising pixels, cross-site identifiers or social-media tracking widgets.
The site writes one first-party local-storage value named “rex-locale” containing only the selected interface language (en, fr or zh). It is used solely to keep the expected language and remains on your device until you clear browser storage. It is not sent with page requests, combined with another identifier or used to follow browsing behaviour.
Because the only browser storage is an interface-language preference that is necessary for the feature requested by the visitor, no consent banner is displayed. If a tool requiring consent is introduced later, it must remain disabled until a valid choice mechanism and this notice are updated.
06 / Safeguards
REX applies technical and organisational measures proportionate to the limited data handled by this site.
HTTPS protects traffic in transit; strict browser headers restrict scripts, framing, referrers and sensitive device permissions.
The contact service does not use a customer database. It creates a protected temporary text file only for the email send, then deletes it automatically.
Message bodies are excluded from application and Mailato audit logs; the contact endpoint's Nginx access log is disabled.
Origin checks, payload limits, a hidden anti-spam field, minimum form age, per-IP throttling and a global daily limit reduce automated abuse.
The service runs under a dedicated unprivileged system account with restricted filesystem, device, kernel and process access.
Only the business recipient needed to answer the request receives the internal message.
No internet transmission or storage system can be guaranteed absolutely secure. If a personal-data breach is likely to create a risk for individuals, REX will assess it and make the notifications required by applicable law.
07 / Individual control
Subject to the conditions in the GDPR, you may exercise the following rights without charge.
Ask whether REX processes your personal data and receive a copy.
Correct information that is inaccurate or incomplete.
Request deletion when the information is no longer needed or another legal ground applies.
Ask REX to freeze certain uses while an issue is examined.
Object, for reasons relating to your situation, to processing based on legitimate interest.
Receive data you supplied in a structured, commonly used format where the legal conditions apply.
Email rex31fr@hotmail.com with the subject “Data protection request”. Describe the request and the email address or submission reference involved. Do not attach identity documents unless REX asks for proportionate proof because there is reasonable doubt about identity.
REX will respond without undue delay and normally within one month. That period may be extended by up to two further months for a complex or numerous request; if so, you will be told within the first month and given the reason.
If you believe your rights have not been respected after contacting REX, you may lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL), the French supervisory authority.
Contact or lodge a complaint with the CNIL (opens in a new tab)08 / Version
This notice is reviewed when the contact workflow, hosting, email provider, browser storage or legal requirements change. Material changes will be dated on this page and, where required, brought to affected people’s attention before the new processing begins.
Current version: 31 August 2026. This is the first full version replacing the former one-sentence contact-form alert.
This notice is structured around Articles 12 and 13 of the General Data Protection Regulation and the transparency guidance published by the CNIL.