Last updated: 4 November 2026
This agreement is made between you as the customer ("the controller") and Coachplan ApS, CVR 44913933, Helga Pedersens Gade 79, 8.6, 8000 Aarhus C, Denmark ("the processor"). It forms part of Coachplan's terms and conditions and applies for as long as you use Coachplan.
The processor processes personal data on behalf of the controller to provide the Coachplan platform and client app. This agreement meets the requirements of Article 28 of the General Data Protection Regulation (GDPR).
The processor only processes personal data on documented instructions from the controller. The terms, this agreement and the features the controller uses make up the instructions. The processor will inform the controller if, in its opinion, an instruction infringes data protection law.
Only people who need it get access to the personal data, and they are bound by confidentiality.
The processor takes appropriate technical and organizational measures under Article 32, including encryption in transit and at rest, access control so each company only sees its own data, logging, regular security updates and daily backups in the EU.
The controller gives general authorization for the processor to use sub-processors. The current list is in section 5 of the privacy policy. The processor will notify the controller by email at least 30 days before adding or replacing a sub-processor. If the controller objects, it may terminate the agreement before the change takes effect. Sub-processors are bound by the same data protection obligations as in this agreement, and the processor remains liable for them.
Transfers only take place on a valid basis: an adequacy decision by the European Commission (such as for the United Kingdom), certification under the EU-US Data Privacy Framework, or the European Commission's Standard Contractual Clauses. See section 6 of the privacy policy.
The processor assists the controller with requests from data subjects, with security, with data protection impact assessments and with any prior consultation of the supervisory authority.
The processor notifies the controller without undue delay and no later than 48 hours after becoming aware of a breach. The notification includes the information the controller needs to report the breach to the supervisory authority.
When the controller deletes its account, all personal data about the controller's clients is deleted immediately. Copies in backups are deleted automatically within 90 days. Before deletion, the controller can have its data returned by contacting support@coachplan.dk.
The processor makes available the information needed to demonstrate compliance with this agreement. Audits or inspections may take place at most once a year with 30 days' notice and at the controller's expense, unless a supervisory authority requires otherwise.
Liability and changes follow Coachplan's terms and conditions. This agreement is governed by Danish law, and disputes are settled by the District Court of Aarhus (Retten i Aarhus), Denmark.
