Last updated: 31 August 2026
This Privacy Notice explains how Oy Redox Ab processes personal data on the Rex website and online store and in its B2B services, customer communications, product reviews, partnership applications, newsletters and marketing services.
Oy Redox Ab
Business ID: 0805772-2
Keskustie 62
19600 Hartola, Finland
Privacy contact: Antti Peltonen
Email:Â info@rex.fi
Telephone: +358 3 876 0750
Questions and requests concerning personal data may be sent to the email address above.
This Privacy Notice applies to the processing of personal data in the following services and situations:
Recruitment services and other services provided on a third-party website may be subject to that service provider’s own privacy notice. This will be indicated when the user is directed to the external service.
We process the name and contact details of the customer and recipient, delivery and billing addresses, order and product details, delivery method, payment method and payment status, customer communications, and information relating to returns, complaints and warranties.
The data is processed to accept and deliver orders, arrange payment, provide customer service, handle returns and fulfil the rights and obligations relating to the contract.
The legal basis for processing is the performance of a contract or taking steps at the request of the data subject before entering into a contract. The processing of billing, accounting and tax information is based on a legal obligation. Preventing abuse and establishing, exercising or defending legal claims are based on the controller’s legitimate interests.
As a rule, we do not store complete payment card details. The payment transaction is processed within the payment service provider’s system.
We process the user’s name, username, email address, telephone number, a protected identifier generated from the password, user-account status and events, and order and transaction history.
For B2B customers, we may also process the company name, business or VAT identification number, address and billing details, e-invoicing address and operator code, and the details of company and billing contacts.
The data is processed to create and maintain the account, assess B2B customer applications, enable ordering and manage the customer relationship and billing. Processing is based on a contract or steps taken before entering into a contract. The processing of company contact-person data may also be based on the legitimate interests of Oy Redox Ab and the relevant company in managing their business or partnership relationship.
We process the name and contact details of the person contacting us, the content and time of the communication, and any order, product and customer information required to handle the matter.
Depending on the circumstances, processing is based on a contract, steps taken before entering into a contract, a legal obligation or our legitimate interest in responding to enquiries and documenting customer service.
Please do not submit unnecessary sensitive information or personal data concerning other individuals in open form fields.
In connection with a product review, we may process a name or alias, email address, review content and rating, submission time, technical abuse-prevention data, and the user’s optional choice to remember their details in the browser.
The review, rating and the name or alias selected by the user may be published on the website. The email address will not be published. Data is processed to publish and manage reviews, assess authenticity and appropriateness, and prevent spam and abuse. Processing is based on our legitimate interest in maintaining a reliable product-review system. An optional browser cookie that remembers the user’s details is based on consent.
We may process the applicant’s name, contact details, company or organisation, position, country and market area, application content, sporting or partnership background, public professional or social-media profiles, and information relating to the assessment of the application.
Processing is based on steps taken at the applicant’s request before entering into a contract and our legitimate interest in assessing and managing reseller and partnership relationships.
We use the Klaviyo service provided by Klaviyo, Inc. to manage newsletters, marketing messages and related automated message flows.
We process the email address, name, language and country, newsletter subscription source and time, the wording and version of the consent used, confirmation of consent, marketing permission status, message sending and delivery data, bounces, spam complaints and unsubscribe information.
Sending newsletters is based on the recipient’s consent. Within the limits permitted by law, we may market our own similar Rex products to existing customers on the basis of our legitimate interests, provided that the customer was clearly offered the opportunity to opt out when their details were collected and in every marketing message.
Subscribing to the newsletter is voluntary. Consent may be withdrawn at any time using the unsubscribe link included in every message or by contacting us. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Where the user has given separate consent to personal marketing tracking, we may process information about newsletter opens, links clicked in messages, website visits, products viewed, checkouts started, orders, and purchases or other events attributed to messages.
This information may be linked to the user’s Klaviyo profile and used to:
Personal tracking of message opens and clicks, website tracking linked to a Klaviyo profile, and profiling based on such information are based on consent. Consent to receive the newsletter does not, by itself, constitute consent to personal tracking.
We do not use Klaviyo profiling to make decisions that produce legal effects or similarly significantly affect the user.
We use necessary cookies and similar technologies to provide functions such as the shopping cart, checkout, login, security and storage of the user’s cookie choices. These technologies are used only to the extent necessary to provide the service requested by the user.
Analytics, personalisation and marketing technologies are used only with the user’s consent. Users can accept or reject non-essential technologies and change their choices at any time through the Cookie Settings function on the website.
Where Klaviyo website tracking is enabled and the user has consented to it, Klaviyo’s __kla_id cookie may store an anonymous identifier and, after the user has been identified, associate browsing events with their Klaviyo profile. According to Klaviyo, the maximum cookie duration is two years, although the actual duration depends on the browser and the Klaviyo features used.
Current information about the cookies used, service providers, purposes and durations is provided in the cookie banner or the cookie settings available through it.
We may process IP addresses, browser and device information, timestamps, requested addresses, error and event logs, login and session information and security observations.
Data is processed to ensure the operation and security of the online services, investigate errors, prevent abuse and handle legal claims. Processing is based on our legitimate interest in maintaining secure and reliable online services.
We obtain personal data mainly:
Where personal data is obtained from a source other than the data subject, we will provide the information required under the General Data Protection Regulation.
We disclose or provide access to personal data only to the extent necessary for the purposes described in this Privacy Notice.
Recipients or processors may include:
Payment service providers may also process payment information as independent controllers on the basis of their own legal obligations.
Klaviyo, Inc. is located at 125 Summer Street, Floor 6, Boston, MA 02110, United States. Klaviyo states that it stores customer data processed through the service in the United States in the Amazon Web Services Northern Virginia data centre. Klaviyo group entities and sub-processors may also process data in other countries disclosed by Klaviyo.
Klaviyo states that it participates in the EU–U.S. Data Privacy Framework. For transfers to which the Data Privacy Framework cannot be applied, Klaviyo uses the Standard Contractual Clauses approved by the European Commission and supplementary safeguards.
Further information about Klaviyo’s data processing is provided in its Privacy FAQs. Klaviyo’s current list of sub-processors is available at klaviyo.com/legal/subprocessors.
Where we use other service providers outside the EEA, we ensure the lawfulness of the transfer through a European Commission adequacy decision, Standard Contractual Clauses or another mechanism permitted by applicable data protection law. Further information about transfer mechanisms or a copy of the applicable safeguards may be requested using the contact details in section 1.
We retain personal data only for as long as necessary for the relevant purpose or to meet a legal obligation.
| Data category | Principal retention period |
|---|---|
| Order, billing and accounting records | For the period required by accounting and tax law, generally for at least six years from the end of the calendar year in which the financial year ended. |
| Other delivery, return and complaint data | For the performance of the contract and generally for no more than three years after the order or matter has been completed, unless a warranty, legal claim or law requires a longer period. |
| Active consumer or B2B user account | For the duration of the customer relationship and user account. The account and related data are generally erased or anonymised within 24 months after closure or a determination of long-term inactivity, except for transaction records that must be retained longer. |
| Rejected or incomplete B2B application | No more than 12 months from the decision or last communication. |
| Customer service and other enquiries | Generally no more than three years after the matter has been closed. |
| Product review | For as long as the review remains published or is necessary for maintaining the review system. Unpublished contact and moderation information is generally erased within three years after submission. |
| Reseller, partnership or ambassador application | Rejected application data is generally retained for 12 months after the decision. Information relating to an established partnership is retained for the duration of the relationship and generally for three years afterwards, unless law or a legal claim requires a longer period. |
| Newsletter subscriber contact and consent information | For the duration of the consent. Long-term inactive profiles are reviewed and generally erased or anonymised 24 months after the last purchase, click or other documented interaction, unless another legal basis applies. |
| Personal open, click, website and marketing attribution data | No more than 24 months from the event, unless consent is withdrawn earlier. |
| Marketing opt-out and withdrawal record | The minimum information necessary for as long as required to comply with the opt-out. Logs required to demonstrate consent and withdrawal are generally retained for three years after the last marketing activity. |
| Technical and security logs | Generally no more than 12 months, unless investigating a specific security incident or legal claim requires a longer period. |
Klaviyo retains information for as long as the customer account remains active unless Oy Redox Ab deletes the information earlier. Klaviyo states that it erases remaining customer data within 90 days after termination of the entire Klaviyo agreement. Oy Redox Ab applies its own deletion practices described above while the agreement remains in effect.
At the end of the retention period, the data is erased or anonymised unless another lawful basis requires continued retention.
Subject to applicable law and the legal basis for processing, the data subject has the right to:
The supervisory authority in Finland is the Office of the Data Protection Ombudsman:Â tietosuoja.fi.
Requests to exercise these rights should be sent to info@rex.fi. We may request additional information to verify the identity of the person making the request. We will normally respond within one month. These rights are not absolute in every situation; for example, a statutory retention obligation may prevent immediate erasure.
Information marked as mandatory for an order, user account or other requested service is necessary to enter into a contract or provide the service. If this information is not provided, we may be unable to process the order, create the account or provide the requested service.
Subscribing to the newsletter, accepting non-essential cookies and consenting to personal marketing tracking are voluntary. Refusing them does not prevent use of the online store or other core services.
We protect personal data using appropriate technical and organisational measures. Depending on the purpose, these measures include encrypted data transmission, access controls, individual user accounts, secure password handling, system updates, backups, logging, security-incident management, personnel instructions and confidentiality obligations.
Service providers are selected and monitored in accordance with data-protection and information-security requirements. Required data-processing agreements are concluded with processors.
We may update this Privacy Notice when our processing activities, services or applicable law change. The current version and its update date will be published on this page. Where a change materially affects data subjects’ rights or the purposes for which personal data is used, we will also provide appropriate notice before the change takes effect.