Privacy policy
REX is a customer relationship management (CRM) software published by Norisix OÜ for pharmaceutical companies and their field teams. This policy explains which personal data is processed, why, for how long, and what your rights are.
It applies to the crmrex.app website and the REX web and mobile applications.
Data controller
The data controller is the client organization (the laboratory or company) using REX to manage its field activity. Norisix OÜ acts as a processor within the meaning of Article 28 GDPR, on behalf of that organization.
For any question about your data, write to contact@crmrex.app; your request will be forwarded to the relevant controller where applicable.
Data processed
Account data: first and last name, email address, role, organization and agency.
Professional activity data: visit programs, visit reports, visited customers, objectives and statistics.
Geolocation data: a one-off position recorded when a visit starts and ends (see the dedicated geolocation notice).
Technical data strictly necessary for operation (authentication session).
Purposes and legal basis
Data is processed to provide the REX service (route planning, field activity tracking, reporting) and to manage user accounts.
The legal basis is the performance of the contract between the client organization and Norisix OÜ, and the employer's legitimate interest in organizing and monitoring commercial activity, while respecting employees' rights (Art. 88 GDPR).
Retention
Data is kept for the duration of the contractual relationship, then archived or deleted in accordance with legal obligations and the client organization's policy.
A deactivated user no longer appears in operational views; their data nonetheless remains attached to historical records (reports, statistics) to preserve accuracy and traceability.
Recipients
Data is accessible to authorized people within the client organization (management, administration) according to their role, and to strictly necessary technical providers (hosting).
No data is sold or transferred to third parties for advertising purposes.
Hosting
The marketing website is hosted by Hostinger (6 Lloyds Avenue Suite 4CL, London EC3N 3AX). The application infrastructure is operated on behalf of the client organization.
Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, object to and port your data.
To exercise these rights, contact your organization (the controller) or write to contact@crmrex.app. You may also lodge a complaint with the competent supervisory authority.
Audience measurement
The site uses Umami to measure traffic anonymously and privacy-respectfully. Umami works without cookies and without collecting personal data: no data is combined across sites or shared with third parties for advertising.
Purpose: understanding site traffic (page views, general referral) to improve it. No identifying data is kept; only aggregated statistics are retained, as long as necessary for traffic monitoring.
Cookies
The site uses no advertising cookies; audience measurement (Umami) works without cookies. Only mechanisms strictly necessary for authentication and application operation are used. Should an advertising tool ever be added, a consent banner would be put in place.