You are the controller. Backdne (Rotterdam, KvK 42082688) is the processor for everything that runs through the portal, your dashboard and your site: appointments, inquiries, invoices, orders, members, files and the other modules you switch on. For our own administration (your contract, our invoices to you) Backdne is the controller.
Contact and address details, appointments and orders, invoices and payments, messages and files your customers send, staff records you keep in the dashboard, and technical data such as IP addresses (removed after 30 days). Special categories only if you choose to record them (for example intake forms in online consults); we never ask for a citizen service number (BSN).
We process personal data only to deliver the services in your contract and as you configure them in the dashboard. We do not sell it, do not use it for advertising and do not use it to train AI models. If a legal obligation forces us to do otherwise, we tell you first unless the law forbids it.
Everyone at Backdne with access is bound to confidentiality. Access by Backdne staff to your dashboard is read-only by default, recorded in your activity log and only used for support or when you ask.
Encryption in transit (TLS) and at rest; secrets and tokens are additionally encrypted per purpose. Row-level security separates clients in the database. Two-factor authentication for you and your team (you can make it mandatory), short sessions, rate limits on public endpoints, daily encrypted backups kept for 30 days, an error and audit log, and dependency scanning on every change.
We use the sub-processors on the sub-processor list (backdne.com/subprocessors). We bind them to the same obligations. We announce a new sub-processor at least 30 days in advance by email; you may object, and if we cannot solve the objection you may end the affected service without cost.
The dashboard lets you export, correct and delete the data of a person yourself (customer card, inquiries, mail flows, support). If a request reaches us, we forward it to you within 5 working days and help where needed.
We inform you without undue delay and at the latest within 36 hours after discovering a personal data breach that affects your data, with what we know: what happened, which data and people, what we did and what you may need to do. Reporting to the Dutch Data Protection Authority and to those affected is your decision; we help.
On request we provide the information needed to show we comply: this agreement, the sub-processor list, our security measures and, when available, pentest summaries. An audit on site is possible once a year at your cost with 30 days notice, or sooner after a breach.
When the contract ends you can export your data (CSV, JSON and your activity log) during 30 days. After that we delete it, including from backups within the 30-day backup cycle, except what we must keep by law (invoices: 7 years).
Liability follows the terms of our contract with you. Dutch law applies; disputes go to the court in Rotterdam.