Data processing agreement.
For clients of Backdne. You decide what happens with the personal data of your customers and staff; we process it on your behalf, only for the services you use. This agreement is part of every contract with us (Article 28 GDPR).
Roles
You are the controller. Backdne (Rotterdam, KvK 42082688) is the processor for everything that runs through the portal, your dashboard and your site: appointments, inquiries, invoices, orders, members, files and the other modules you switch on. For our own administration (your contract, our invoices to you) Backdne is the controller.
What we process
Contact and address details, appointments and orders, invoices and payments, messages and files your customers send, staff records you keep in the dashboard, and technical data such as IP addresses (removed after 30 days). Special categories only if you choose to record them (for example intake forms in online consults); we never ask for a citizen service number (BSN).
Only on your instructions
We process personal data only to deliver the services in your contract and as you configure them in the dashboard. We do not sell it, do not use it for advertising and do not use it to train AI models. If a legal obligation forces us to do otherwise, we tell you first unless the law forbids it.
Confidentiality
Everyone at Backdne with access is bound to confidentiality. Access by Backdne staff to your dashboard is read-only by default, recorded in your activity log and only used for support or when you ask.
Security
Encryption in transit (TLS) and at rest; secrets and tokens are additionally encrypted per purpose. Row-level security separates clients in the database. Two-factor authentication for you and your team (you can make it mandatory), short sessions, rate limits on public endpoints, daily encrypted backups kept for 30 days, an error and audit log, and dependency scanning on every change.
Sub-processors
We use the sub-processors on the sub-processor list (backdne.com/subprocessors). We bind them to the same obligations. We announce a new sub-processor at least 30 days in advance by email; you may object, and if we cannot solve the objection you may end the affected service without cost.
Your customers' rights
The dashboard lets you export, correct and delete the data of a person yourself (customer card, inquiries, mail flows, support). If a request reaches us, we forward it to you within 5 working days and help where needed.
Data breaches
We inform you without undue delay and at the latest within 36 hours after discovering a personal data breach that affects your data, with what we know: what happened, which data and people, what we did and what you may need to do. Reporting to the Dutch Data Protection Authority and to those affected is your decision; we help.
Audits
On request we provide the information needed to show we comply: this agreement, the sub-processor list, our security measures and, when available, pentest summaries. An audit on site is possible once a year at your cost with 30 days notice, or sooner after a breach.
End of the service
When the contract ends you can export your data (CSV, JSON and your activity log) during 30 days. After that we delete it, including from backups within the 30-day backup cycle, except what we must keep by law (invoices: 7 years).
Liability and law
Liability follows the terms of our contract with you. Dutch law applies; disputes go to the court in Rotterdam.