How we process your data as a processor, and which sub-processors we use.
Last updated: 19.10.2026 · Data processing agreement version 1.1, effective 1 December 2026
When you use Trackrs, your company is the controller and Rasmussen Solutions ApS (CVR 42296244, Skovvej 12, 4622 Havdrup) is the processor. Our obligations are set out in a data processing agreement based on the standard contractual clauses of the Danish Data Protection Agency (Datatilsynet), which an administrator accepts electronically in Trackrs. Here you can see which data is involved, how long it is kept and which sub-processors we use.
Read the data processing agreement (PDF, Danish)
The data processing agreement itself is in Danish only. This page is a translation of the GDPR page; the agreement text is not translated. For our own processing of user, login and subscription data we are the controller; see the privacy policy and the terms.
Name, email, role, department, profile picture or initials, last activity, push tokens and login via RsConnect. Loans (which tool, when, to whom), movement history and the activity log.
The app uses the phone's GPS to decide whether an employee is at or near one of your locations, also in the background if the employee has given permission. We store current presence with coordinates, arrivals and departures, and observations of BLE tags, tools and networks with time, user and position.
Tools, serial numbers, photos, service and reports. Scans from fixed RFID readers contain the reader id, tag id and signal strength, not the identity of employees.
Reports of missing tools may contain contact persons, licence plates and a free-text note. Images and speech from the AI glasses and the app are processed by Anthropic and OpenAI. Trackrs has no fields for article 9 or article 10 data.
When a subscription ends, we delete your data manually no later than 90 days after termination, following a written deletion procedure, and confirm it in writing to your contact person.
| BLE observations | Deleted automatically after 90 days |
| Arrival and departure events | Deleted automatically after 180 days |
| Current presence per user (incl. GPS) | No time limit. Overwritten at the next registration |
| Tool, network and priority observations with user and GPS | Kept for as long as the subscription runs |
| Movement history | Kept for as long as the subscription runs |
| Activity log, loans, reports, support cases | No time limit |
| Reports to insurance | The report is sent as a PDF by email and is not stored in file storage. The report record is kept in the database without a time limit |
| Raw RFID scans in PostgreSQL/Timescale | Deleted automatically after 90 days. Daily summaries are kept |
| RFID scans in InfluxDB Cloud | Kept for as long as the subscription runs |
| File storage | Deleted files can be restored for 30 days |
| Deleted users and companies | Marked as deleted. Final deletion is done manually on request (see How to request access or deletion) |
When the subscription ends, the processor deletes the controller's data no later than 90 days after termination and confirms the deletion in writing to the controller's contact person. The deletion is done manually by the processor following a written internal deletion procedure covering the database, file storage, Firebase and RFID time series from the controller's readers in PostgreSQL. InfluxDB Cloud cannot delete single readers' data; there the processor sets the retention period so that scans from the controller's decommissioned readers expire within the deadline in this section. Copies in backups then disappear by themselves within 7 days (database) and 30 days (soft-deleted files). The same procedure is used when the controller asks for the company to be deleted in the service. Before deletion the controller can ask for an export.
Employees and contact persons at a company that uses Trackrs should address their request to that company, because it is the controller. If you write to us, we forward the request to the company within 3 working days of receiving it. We do not answer it ourselves.
Administrators can see and correct most data in Trackrs themselves. Deletion in the service is soft deletion (data is marked as deleted). We carry out requests to delete a user or a company manually. On request we provide an employee's position and presence history as an export. If you need us to delete or anonymise a user, delete the whole company's data or hand over data the service cannot export itself, write to privacy@trackrs.dk from an administrator's email address with the company name, CVR number and a description of what you want. We carry it out manually within 30 days.
privacy@trackrs.dk
Rasmussen Solutions ApS · CVR 42296244 · Skovvej 12, 4622 Havdrup
If you believe we process personal data in breach of the rules, you can complain to the Danish Data Protection Agency (Datatilsynet): www.datatilsynet.dk.
We use these suppliers to provide Trackrs. If a new one is added, we email your contact person and administrators with at least 30 days' notice, update the list here and note it in the change log below. You can object within the notice period.
| Name | Purpose | Location | Transfer basis | Updated |
|---|---|---|---|---|
| Microsoft Ireland Operations Ltd. (Microsoft Azure)Dublin, Ireland | API (App Service), PostgreSQL databases, file storage (Blob), Key Vault | EU – North Europe (Ireland) | Data is stored in the EU. Possible support and operations access from third countries: SCC in Microsoft's Products and Services Data Protection Addendum | 18.10.2026 |
| InfluxData Inc. (InfluxDB Cloud Serverless)San Francisco, USA | Time series of RFID scans (reader id, tag id, signal strength) | EU – AWS Frankfurt (eu-central-1) | Data is stored in the EU. Possible access from the USA: DPF and SCC in InfluxData's DPA | 18.10.2026 |
| Stackhero (MQTT broker)Paris, France | Relaying of scans from RFID readers | EU | EU company. No transfer from the processor | 18.10.2026 |
| Google Cloud EMEA Ltd. (Firebase)Dublin, Ireland | Loan declarations, alarms via Pub/Sub, Cloud Functions | EU – Functions europe-west3 (Frankfurt) and Firestore in the EU | Data is stored in the EU. Possible access from the USA: DPF (Google LLC) and SCC in Google's Cloud Data Processing Addendum | 18.10.2026 |
| Google Cloud EMEA Ltd. (Firebase Cloud Messaging)Dublin, Ireland | Push notifications to Android devices (push token and message text) | Global, including the USA | DPF (Google LLC) and SCC in the Firebase Data Processing and Security Terms | 18.10.2026 |
| 650 Industries, Inc. (Expo)California, USA | Push notifications to the app (forwarded to Google and Apple) | USA | DPF and SCC (module 2) in Expo's terms | 18.10.2026 |
| Mailgun Technologies, Inc. (Sinch)Texas, USA | EU – Mailgun EU region | Content is processed in the EU. Account and delivery data may be accessed from the USA: DPF and SCC in Sinch's DPA | 18.10.2026 | |
| Anthropic Ireland, LimitedIreland | AI glasses (images and text) and analysis of feedback and support cases. Input and output are deleted at Anthropic within 30 days and not used for training | USA | SCC (module 2/3) in Anthropic's Data Processing Addendum. Anthropic is not DPF-certified | 18.10.2026 |
| OpenAI Ireland Ltd.Dublin, Ireland | Speech-to-text for the AI glasses and the app | USA | SCC in OpenAI's Data Processing Addendum. OpenAI is not DPF-certified | 18.10.2026 |
| GitHub, Inc.88 Colin P. Kelly Jr. St, San Francisco, CA, USA | Support cases and feedback from MCP | USA | DPF and SCC in GitHub's Data Protection Agreement | 18.10.2026 |
| Raintank, Inc. (Grafana Labs, Grafana Cloud)New York, USA | Monitoring and operational logs | EU – Stockholm (eu-north-0) | Data is stored in the EU. Possible access from the USA: DPF and SCC (module 2/3) in Grafana Labs' data processing agreement | 18.10.2026 |
| Netlify, Inc.San Francisco, USA | Hosting of the web app (app.trackrs.dk). Netlify sees the traffic | Global CDN | DPF and SCC in Netlify's DPA | 18.10.2026 |
DPF = EU-US Data Privacy Framework (decision (EU) 2023/1795). SCC = the Commission's standard contractual clauses (decision (EU) 2021/914). At least once a year we check that the DPF certifications are active and that the suppliers' data processing agreements contain SCC.
Connections you set up yourselves are not sub-processors. This covers connections to Mesterplan, MilePro and e-conomic, API keys you issue yourselves, and AI assistants (MCP clients) you connect yourselves.
The following are independent controllers or lookup services and are not sub-processors either:
The processor's own systems: RsConnect (login) and the processor's own Grafana installation. Cloudflare is only used for DNS and sees no content data.
| 19.10.2026 | Version 1.1: clarified wording and removed ui-avatars.com as a sub-processor. |
| 18.10.2026 | First public list of sub-processors. Data processing agreement version 1.0 published, effective 1 December 2026. |
Not part of the agreement. You fill in the fields in [ ] and hand the template to your employees no later than when the function is put into use (article 13 GDPR).
How [Company] uses Trackrs
[Company], CVR [no.], uses Trackrs to keep track of tools and equipment. Trackrs is provided by Rasmussen Solutions ApS, which processes the information on our behalf.
What is registered: your name, email and role, which tools you have borrowed or moved, and when. If [Company] uses presence, the Trackrs app uses your phone's position to register when you arrive at and leave our locations: [list: warehouse, workshop, building sites …]. The app can register in the background when you have given permission.
Purpose: to find tools, prevent theft and know which equipment is at which location. The information is not used to [assess your work performance / follow you outside working hours].
Legal basis: [section 12(1) of the Danish Data Protection Act (agreement on control measures) / article 6(1)(f) GDPR – our legitimate interest in protecting and planning the use of our equipment].
Who sees the information: [roles]. The supplier and its sub-processors, see [link to the GDPR page].
For how long: arrival and departure events 180 days. BLE observations 90 days. Loan history [period].
Your options: you can switch off the location permission in the phone settings [consequence: …]. You have the right of access, rectification, erasure, restriction and objection. Contact [name/email]. You can complain to the Danish Data Protection Agency (Datatilsynet), www.datatilsynet.dk.