This is a translation; the Danish version applies. The agreement follows the structure of the Danish Data Protection Agency’s standard contractual clauses under GDPR Art. 28(3). It forms part of the agreement on use of the BackPack platform.
1. Parties and purpose
The Customer is the data controller. BackPack Systems ApS, CVR 46452720, Engsøvej 21, 8240 Risskov (“BackPack”) is the data processor. This agreement sets out BackPack’s processing of personal data on behalf of the Customer under GDPR Art. 28.
2. The processing
- Purpose: to provide travel information, communication and administration through the platform.
- Data: name, contact details, travel documents, packing lists, emergency contacts and other data the Customer registers. The Customer may choose to register sensitive data, such as health information, and is responsible for having a basis for doing so.
- Data subjects: travellers, participants, guides, relatives and the Customer’s staff.
- Duration: for the term of the agreement and until data has been deleted or returned.
3. Instructions
BackPack only processes personal data on documented instructions from the Customer, unless EU or Danish law requires otherwise. This agreement and the Customer’s use of the platform form the instructions. BackPack informs the Customer if it believes an instruction breaches data protection rules.
4. Confidentiality
BackPack ensures that people with access to the data are bound by confidentiality, and that access is only given to those who need it.
5. Security
BackPack implements appropriate technical and organisational measures under GDPR Art. 32. They are described in Annex B.
6. Sub-processors
The Customer gives general authorisation to use sub-processors. Current ones are listed in Annex A and on the security page. BackPack gives at least 30 days’ written notice of changes, and the Customer may object within the notice period. If the parties cannot agree, the Customer may terminate the affected part of the agreement. BackPack imposes the same obligations on sub-processors and remains liable for their performance.
7. Third-country transfers
Transfers outside the EU/EEA only take place on the Customer’s instructions and on a valid basis under GDPR Chapter V, such as an adequacy decision or standard contractual clauses. The basis for each sub-processor is set out in Annex A.
8. Assistance
BackPack assists the Customer in responding to data subject requests and in complying with GDPR Art. 32-36, including impact assessments and prior consultation, as far as is reasonable given the nature of the processing.
9. Personal data breaches
BackPack notifies the Customer without undue delay and no later than 48 hours after becoming aware of a breach. The notification contains the information BackPack has, so the Customer can meet its duty to notify the supervisory authority.
10. Deletion and return
When the agreement ends, BackPack deletes or returns the personal data, at the Customer’s choice, within 30 days, unless the law requires it to be kept.
11. Audit and documentation
BackPack makes available the information needed to show compliance and allows for audits, including inspections, with reasonable notice. The Customer bears its own costs and BackPack’s reasonable costs of an audit, unless the audit shows a material breach.
12. Term and liability
This agreement applies for as long as BackPack processes personal data for the Customer. Liability follows the main agreement unless the GDPR requires otherwise. This agreement prevails over other agreements as regards the processing of personal data.
Annex A: Sub-processors
| Name | Service | Location | Transfer basis |
|---|---|---|---|
| Google Ireland Ltd. / Google LLC | Firebase, Cloud Functions, data storage and notifications | EU (europe-west1) | EU-US Data Privacy Framework and SCCs for any transfer |
| Google Ireland Ltd. / Google LLC | Vertex AI (Gemini) for Trip Builder | EU (europe-west4, the Netherlands) | EU-US Data Privacy Framework and SCCs for any transfer |
| Resend, Inc. | Sending system emails | USA | Standard contractual clauses (SCCs) |
| one.com (Group.one) | Domain email for customer contact | EU | No third-country transfer |
Annex B: Technical and organisational measures
- Encryption in transit (HTTPS/TLS) and encryption of stored data at Google Cloud.
- Access control with logins, roles and security rules, so users only reach the data they need.
- Server functions in EU regions (europe-west1 and, for Trip Builder, europe-west4).
- Secrets are kept in a separate secrets system and not in source code.
- Trip Builder (the AI feature) only receives the material provided for the task, and a member of staff approves the result.
- BackPack staff get access on a need-to-know basis and are bound by confidentiality.
- A procedure for handling and notifying personal data breaches.