This is a translation. If the Danish and English versions differ, the Danish version applies.
1. Data controller
BackPack Systems ApS, CVR 46452720, Engsøvej 21, 8240 Risskov, kontakt@backpack-app.dk, is the data controller for the processing described here.
2. What this policy covers
This policy covers our website, enquiries to us and our customer relationships.
Are you a traveller in an app that runs on BackPack? Then your travel company is the data controller for your data, and BackPack is the data processor. Contact your travel company if you have questions or want to use your rights.
3. How we process data
| Purpose | Data | Legal basis | Recipients | Retention |
|---|---|---|---|---|
| Answering the contact form | Company, name, email, phone, topic, number of travellers, date, message | GDPR Art. 6(1)(b) and (f) | Google (Cloud Functions), one.com (email) | Up to 24 months after last contact |
| Email correspondence | Name, email, content | GDPR Art. 6(1)(b) and (f) | one.com (email) | Up to 24 months after last contact |
| Customer and contract administration | Contact persons, agreement details | GDPR Art. 6(1)(b) | Google, one.com | During the relationship and 5 years after it ends |
| Bookkeeping | Invoice and payment details | GDPR Art. 6(1)(c), Danish Bookkeeping Act | Our bookkeeping provider | 5 years after the end of the financial year |
| Running and securing the website | IP address, time, request (logs) | GDPR Art. 6(1)(f) | Google (Firebase Hosting) | Google’s standard log periods |
| Statistics | Online identifiers, page views, events | Consent, GDPR Art. 6(1)(a) | Google (Google Analytics) | 2 months in Google Analytics |
4. Recipients and third countries
We use data processors that process data on our behalf under a data processing agreement. The main ones are Google Ireland Ltd. / Google LLC (Firebase Hosting, Cloud Functions and, if you consent, Google Analytics) and one.com (email).
When we use Google, data may be transferred to the USA. The transfer is based on the EU-US Data Privacy Framework, under which Google is certified, and standard contractual clauses (SCCs).
The contact form is not stored in a database. It is sent as an email to our inbox.
5. Providing data is voluntary
Giving us data is voluntary. If you don’t, we can’t answer your enquiry or enter into an agreement with you. Statistics cookies require your consent, and the site works without them.
6. Automated decisions
We make no automated decisions or profiling with legal effect for you. Trip Builder uses AI to draft trip content, makes no decisions about people, and a member of staff always approves the result.
7. Your rights
You have the right of access, rectification, erasure, restriction, data portability and objection. You can withdraw your consent at any time under Cookie settings at the bottom of the page. This does not affect the lawfulness of processing before withdrawal. Write to kontakt@backpack-app.dk to use your rights.
8. Complaints
You can complain to the Danish Data Protection Agency (Datatilsynet), Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk.
Version history
- 7 November 2026: New address, named recipients, third-country transfers, Google Analytics, roles and rights.
- 8 July 2026: Previous version.