Privacy notice

How we handle your data

This notice tells you what personal data ColPort Hall processes, why, for how long, who we share it with, and what rights you have. Written in plain English. The formal GDPR-compliant text lives at the bottom.

Last updated: 21 April 2026 · Version 3.2

Who we are

ColPort B.V. is the Data Processor

When your employer uses ColPort Hall, your employer is the Data Controller, they decide what learning data is collected and for what purpose. ColPort B.V. (registered in the Netherlands) acts as the Data Processor, handling the data strictly on your employer’s documented instructions.

For ColPort’s own processing (e.g. if you submit a demo request through our marketing site), ColPort is the Data Controller.

What we collect

Data categories + lawful basis

Identity + account

Name, work email, job title, department, employer. Lawful basis: contract (Art. 6(1)(b)), you cannot use the platform without an account.

Learning records

Course enrolments, completions, assessment scores, certificate history, xAPI statements. Lawful basis: legal obligation (Art. 6(1)(c)) for compliance training; legitimate interest (Art. 6(1)(f)) for voluntary learning.

Communications metadata

Email open/click events, SMS delivery receipts, in-app notification reads. Lawful basis: legitimate interest, needed to confirm that mandatory training was delivered.

Device + session data

IP address, browser type, device fingerprint, approximate location. Lawful basis: legitimate interest, security, fraud prevention, session management.

Retention

How long we keep what

Training completion records

7 years after completion, aligns with most jurisdictional fiscal and workplace-safety retention rules. Configurable downwards if your legal counsel confirms a shorter baseline.

Certificate records

Duration of employment + 2 years minimum. Public verification URLs remain resolvable for the full retention period.

AI conversation summaries

90 days maximum. GDPR data-minimisation principle, no long-term storage of learner-AI exchanges.

Session recordings (Inn)

90 days by default, configurable per organisation. Deleted automatically by the nightly purge job.

Your rights

GDPR / equivalent data-subject rights

Under Articles 15-22 of the GDPR (and the equivalents in other jurisdictions. CCPA, UK GDPR, LGPD, etc.) you have the right to access, correct, erase, port, and object to our processing of your personal data. You can exercise every one of these rights from your account’s /me/my-data page without emailing support. Results delivered within 30 days (usually within 48 hours for automated requests).

Access (Art. 15)

Export everything we hold about you as structured JSON or a human-readable PDF. Includes learning records, certificates, AI conversations, communication metadata.

Erasure (Art. 17)

Pseudonymisation of non-retained data. Completion records subject to legal hold remain linked to an anonymous ID.

Portability (Art. 20)

xAPI statements exported as JSON-LD, industry standard, ingestible by any compliant LRS.

Object (Art. 21)

Opt out of AI personalisation at any time from your profile page. Falls back to a standard, manually-managed learning path.

Sub-processors

Who else sees your data

The full sub-processor list with data categories, purposes, and locations is published at /trust. Summary: all sub-processors sit inside the EU (Frankfurt primary), each carries a DPA with ColPort, and we notify customers 30 days before adding a new sub-processor.

Contact

The Data Protection Officer

Reach the DPO at dpo@colport.io. For complaints we cannot resolve, you have the right to lodge a complaint with your national supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens).

The formal, signed privacy notice PDF is available on request from your account manager and is auto-delivered during procurement.

Want to see the full sub-processor list?

The trust center lists every third party that touches your data, why, where it lives, and the audit attestation they hold.

Request a demo