— Rex Software

Authorised Sub-processor Register

Last Updated:

23 March 2026

1. Introduction and Scope

This Authorised Sub-processor Register identifies the third-party entities engaged by Rex Software Group to support the delivery of Rex CRM, Business Intelligence (BI), and AI Admin features. In accordance with the Rex Group Privacy Policy and UK Data Protection Laws, this document defines the processing relationship where the Customer (Real Estate Agency) acts as the Data Controller and Rex acts as the Data Processor.

For customers in the United Kingdom, the primary contracting entity is Rex Labs Limited (Company No. 11241778). For customers in Australia, the contracting entity is Rex Software Pty Ltd (ACN 145 420 284). Rex engages the sub-processors listed below to perform specific processing activities strictly under the Controller’s instructions and within the framework of our "Privacy by Design" architecture.

2. Master Sub-processor Table

‍

Entity Name	Service Provided	Processing Location	Nature of Processing
Snowflake Inc.	Cloud Data Warehouse	Australia	Persistent storage for Business Intelligence (BI) data and AI Admin interaction logs (prompts, tool calls, and responses).
Anthropic (Claude)	AI/LLM Inference	United States / Global	Real-time natural language processing and inference for AI Admin operations. Strict contractual prohibition on model training. (Ephemeral processing).
OpenAI	AI/LLM Inference	United States / Global	Real-time natural language processing and inference for AI Admin operations. Strict contractual prohibition on model training. (Ephemeral processing).
Google (Vertex AI)	AI/LLM Inference	United States / Global	Real-time inference for AI Admin operations. Strict contractual prohibition on model training. Zero-retention policy verified.
Estuary	Data Pipeline & Ingestion	UK/EEA (Egress Point)	Managing data ingestion. Identity Segregation Logic: Pseudonymisation (SHA-256 hashing) occurs in the UK prior to AU transfer.
Jitsu	Data Pipeline & Ingestion	UK/EEA (Egress Point)	Event streaming for interaction logging and BI. Identity Segregation Logic: All hashing logic and salts reside strictly in the UK.

3. Master Sub-processor Table

The following data categories are processed by authorised sub-processors to support CRM, BI, and AI functionality:

Contact Identity Data: Names, email addresses, phone numbers, and postal addresses. For BI purposes, identity fields are pseudonymised via SHA-256 hashing.
Property & Transaction Data: Property addresses, valuations, listing details, offer records, and commission figures.
User/Agent Data: CRM user login timestamps, activity history, and task completion logs.
Interaction Logs: User-entered prompts, tool calls, and LLM-generated responses stored within the Snowflake AU environment for audit and Article 22 "Right to Explanation" requests.
Communication Metadata: Timestamps and logs of email/SMS dispatch (not including message bodies or content).

Technical Note on Data Minimization: While Rex utilizes "Atomic Scoping" as a roadmap goal, V1 of AI Admin returns full API responses to the LLM. This is a deliberate engineering decision to avoid a "Logic Disconnect" between the filtering agent and the reasoning agent, which would otherwise hinder the AI's ability to perform context-dependent tasks.

4. International Transfer Safeguards

For data transfers to non-adequate jurisdictions (the USA and Australia), Rex Labs Limited implements rigorous safeguards to mitigate risks from statutes such as US FISA Section 702 and the Australian Assistance and Access Act 2018:

Legal Mechanisms: Execution of the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, including a commitment to challenge overbroad government data requests.
Identity Segregation: Unique salts used for SHA-256 hashing are never synchronized to Australia. They remain exclusively in the UK-hosted environment, ensuring re-identification keys are inaccessible in the BI layer.
Snowflake Tri-Secret Secure: Implementation of Customer Managed Keys (CMK) ensures Rex maintains control over the key hierarchy. This technical measure ensures data remains inaccessible to the infrastructure provider or government entities even under a statutory notice.
Encryption Standards: Mandatory use of TLS 1.2+ for all data in transit and AES-256 encryption at rest.
Ephemeral LLM Logic: Contractual "Zero-Retention" or immediate deletion mandates for LLM providers (Anthropic, OpenAI, Google). Data in the context window is discarded immediately post-inference and is never used for model training.

5. Data Retention and Deletion Commitments

Rex enforces the following retention periods to comply with the principle of storage limitation:

Data Environment	Retention Period	Deletion/Anonymisation Action
Snowflake (BI Data)	Duration of contract + 90 days	Automated purge upon contract termination.
Snowflake (AI Logs)	12 months	Logs deleted or anonymised after 12 months.
LLM Providers	Ephemeral	Immediate discard post-inference; zero retention.
Raw Ingestion (GCS)	90 days	Mandatory purge of all raw data in storage buckets.

6. Changes to Sub-processors

Notification Policy: In accordance with the Data Processing Agreement (DPA), Rex Labs Limited will provide UK customers with a 30-day notice period prior to the appointment of any new sub-processor.

Right to Object (Article 21): Data subjects or controllers may exercise their right to object to AI-powered processing via a persistent is_ai_excluded flag on the CRM contact record. When this flag is active, the Model Context Protocol (MCP) tool is programmatically mandated to return a "null set" or "Access Denied" response, preventing any data egress to AI sub-processors.

Right to Erasure (Article 17): Upon receipt of a valid erasure request in the CRM, a trigger-based event pipeline ensures that the deletion is synchronized and finalized within the Australian Snowflake logs within 30 business days.

‍