Skip to content

Version 1.0 · Last updated: November 11, 2026

Data Processing Agreement

How BackPR handles personal data for an organization as its processor (GDPR Article 28). Part of the Terms of Service.

Version 1.0 · Last updated: November 11, 2026
This is the same text the BackPR app shows at app.backpr.com/legal/dpa. Leer en español

This Data Processing Agreement is part of the Terms of Service between your organization ("you", the controller) and the operator of BackPR ("BackPR", "we", the processor). It covers the personal data we handle for you in the BackPR service, as Article 28 of the EU General Data Protection Regulation (GDPR) requires.
Privacy contact: hi@backpr.com

1. Roles

You decide why and how personal data of your families, participants and staff is used: you are the controller. We handle that data only to run BackPR for you: we are your processor. For our own account, sign-up, billing and security records we are a separate controller (see the Privacy Notice).

2. What is processed

  • Subject matter and purpose: providing the BackPR service to you (registration, payments, attendance, check-in and pickup, messages, staff tools, records, reports, support, security and backups).
  • Duration: for as long as you use BackPR, plus the deletion period in section 11.
  • People: children and other participants, parents and guardians, emergency contacts and authorized pickup adults, your staff and volunteers, payers.
  • Data: names, contact details, dates of birth, family links, registrations, schedules, attendance, check-in and pickup records, messages, forms and waivers, invoices and payment records (not card numbers), files you upload, and staff records.
  • Special categories, only if you choose to record them: children's and participants' health information such as allergies, medications, conditions, immunization status, dietary needs and accommodations.

3. Your instructions

We process personal data only on your documented instructions: the Terms of Service, this agreement, and the way you and your people set up and use the service. We tell you if we think an instruction breaks data protection law. We do not sell personal data, and we do not use it for advertising or to build profiles for our own purposes.

4. Confidentiality

Everyone at BackPR who can access your data is bound by confidentiality and may access it only when needed to provide support, keep the service secure or fix a problem.

5. Security measures

We keep the measures described in the Security Overview, including:

  • one private database per organization, so one organization's records are never stored in another's database;
  • field encryption with a key of your organization for health records and custody notes;
  • private files (uploads, exports, signed documents) sealed with a key of your organization before they are stored;
  • sign-in with passkeys or one-time email codes, roles and permissions, and a fresh confirmation for sensitive actions;
  • a tamper-evident audit log of changes in each organization;
  • weekly encrypted backups;
  • encrypted connections (HTTPS) and limits against abuse and automated attacks.

6. Sub-processors

You give us general authorization to use the sub-processors on the Sub-processors page. They are bound by data protection terms that give at least the protection of this agreement, and we remain responsible for them. Before we add or replace one we update that page and tell an owner of your organization by email at least 30 days ahead. You may object for a data protection reason by writing to hi@backpr.com; if we cannot resolve it, you may end the service.

7. International transfers

Our sub-processors may process data outside the country where you are, including in the United States. Where data protection law requires a transfer tool, the transfer relies on an adequacy decision or on the European Commission's Standard Contractual Clauses (with the UK addendum where it applies), which are part of our agreements with those sub-processors. Where a transfer between you and us needs such a tool, the Standard Contractual Clauses for controller-to-processor transfers apply between us and are part of this agreement.

8. Helping you with people's rights

A family can see and correct most of its own data in the family portal, ask for a copy, and ask for its account to be deleted. You can export your organization's data yourself. If a person writes to us about data you control, we pass the request to you and do not answer it ourselves. We help you with requests you cannot handle with the tools in the app.

9. Personal data breaches

If we become aware of a personal data breach affecting your data, we tell an owner of your organization without undue delay, with what we know: what happened, which data and roughly how many people, what we are doing, and who to contact. We keep you updated and help you meet your own duties to notify.

10. Other help

We give you the information you reasonably need for data protection impact assessments and for talking to a supervisory authority about our processing.

11. Deletion and return

You can export your data at any time. When the service ends you have 30 days to export. We then delete your organization's data from the live systems; encrypted backups expire about 8 weeks later. We keep only what the law requires us to keep.

12. Audits

We make available the information needed to show that we meet this agreement. Once a year, or after a breach, you may ask written questions or, with reasonable notice and at your own cost, carry out an audit that does not put other customers' data at risk.

13. Order of documents

If this agreement and the Terms of Service disagree about personal data, this agreement applies. Where the Standard Contractual Clauses apply, they come first.