Privacy notice

How we handle your data

This notice tells you what personal data ColPort Hall processes, why, for how long, who we share it with, and what rights you have. Written in plain English. The formal GDPR-compliant text lives at the bottom.

Last updated: 10 October 2026 · Version 3.2

Who we are

ColPort B.V. is the Data Processor

When your employer uses ColPort Hall, your employer is the Data Controller, they decide what learning data is collected and for what purpose. ColPort B.V. (registered in the Netherlands) acts as the Data Processor, handling the data strictly on your employer's documented instructions.

For ColPort's own processing (e.g. if you submit a demo request through our marketing site), ColPort is the Data Controller.

What we collect

Data categories + lawful basis

Identity + account

Name, work email, job title, department, employer. Lawful basis: contract (Art. 6(1)(b)), you cannot use the platform without an account.

Learning records

Course enrolments, completions, assessment scores, certificate history, xAPI statements. Lawful basis: legal obligation (Art. 6(1)(c)) for compliance training; legitimate interest (Art. 6(1)(f)) for voluntary learning.

Communications metadata

Email open/click events, SMS delivery receipts, in-app notification reads. Lawful basis: legitimate interest, needed to confirm that mandatory training was delivered.

Device + session data

IP address, browser type, device fingerprint, approximate location. Lawful basis: legitimate interest, security, fraud prevention, session management.

Retention

How long we keep what

Training completion records

7 years after completion, aligns with most jurisdictional fiscal and workplace-safety retention rules. Configurable downwards if your legal counsel confirms a shorter baseline.

Certificate records

Duration of employment + 2 years minimum. Public verification URLs remain resolvable for the full retention period.

AI conversation summaries

90 days maximum. GDPR data-minimisation principle, no long-term storage of learner-AI exchanges.

Session recordings (Inn)

90 days by default, configurable per organisation. Deleted automatically by the nightly purge job.

Your rights

GDPR / equivalent data-subject rights

Under Articles 15-22 of the GDPR (and the equivalents in other jurisdictions. CCPA, UK GDPR, LGPD, etc.) you have the right to access, correct, erase, port, and object to our processing of your personal data. You can exercise every one of these rights from your account's /me/my-data page without emailing support. Results delivered within 30 days (usually within 48 hours for automated requests).

Access (Art. 15)

Export everything we hold about you as structured JSON or a human-readable PDF. Includes learning records, certificates, AI conversations, communication metadata.

Erasure (Art. 17)

Pseudonymisation of non-retained data. Completion records subject to legal hold remain linked to an anonymous ID.

Portability (Art. 20)

xAPI statements exported as JSON-LD, industry standard, ingestible by any compliant LRS.

Object (Art. 21)

Opt out of AI personalisation at any time from your profile page. Falls back to a standard, manually-managed learning path.

Sub-processors

Who else sees your data

Every outside service the platform's code can send personal data to, and when it does. A service that is not switched on for this deployment receives nothing.

Sub-processors
Service	Personal data it receives	Where	Used when
Hetzner Hetzner Online GmbH The server Hall and Inn run on: the application, the database, file storage and background jobs.	Everything the platform holds.	Germany Inside the EU	Always.
Resend Resend, Inc. Sends the platform's emails.	The recipient's name and email address, and the email itself.	United States Data may leave the EU, under the EU Standard Contractual Clauses (2021/914)	When this deployment sends email.
Anthropic (Claude) Anthropic PBC Writes AI drafts and answers the AI assistants.	The text sent to an AI feature: prompts, course material and what a person types. Email addresses, phone numbers, IBANs, card numbers and BSN-like numbers are replaced first; names are not.	United States Data may leave the EU, under the EU Standard Contractual Clauses (2021/914)	When an organisation has AI switched on and its AI provider is Anthropic, the default.
Mistral Mistral AI SAS Writes AI drafts and answers the AI assistants, inside the EU.	The text sent to an AI feature, with the same numbers and addresses replaced first.	France Inside the EU	When an organisation chooses Mistral as its AI provider.
Voyage AI Voyage AI Turns course text into search vectors for Inn's search and the course coach.	Course text, and the questions learners ask the course coach.	United States Data may leave the EU, under the EU Standard Contractual Clauses (2021/914)	When semantic search is switched on, and only for organisations whose AI provider is Anthropic.
Google Cloud Translation Google Cloud EMEA Limited Translates course text by machine.	The course text being translated.	United States Data may leave the EU, under the EU Standard Contractual Clauses (2021/914)	When machine translation is switched on.
CM.com CM.com Netherlands B.V. Sends text messages.	The phone number and the message.	Netherlands Inside the EU	When an organisation sends training by text message.
Twilio Twilio Inc. Sends a text message when CM.com cannot.	The phone number and the message.	United States Data may leave the EU, under the EU Standard Contractual Clauses (2021/914)	When CM.com is not set up or cannot send a message.
Sentry Functional Software, Inc. Collects error reports so we can fix faults.	Technical details of an error. Email addresses, IP addresses and cookies are removed before a report is sent.	United States Data may leave the EU, under the EU Standard Contractual Clauses (2021/914)	When error reporting is switched on.
Stripe Stripe Payments Europe, Limited Takes payments for Inn courses and subscriptions.	The buyer's name, email address and payment details.	Ireland Data may leave the EU, under the EU Standard Contractual Clauses (2021/914)	When someone pays for an Inn course or subscription.

We tell customers 30 days before we add or replace a sub-processor, and you can object within that time.

Not on this list: your organisation's own sign-in provider, which your organisation chooses; videos your organisation embeds from YouTube or Vimeo, which load only when a learner presses play and which your organisation's privacy notice names; and browser push services, which carry a push message encrypted so they cannot read it.

Contact

The Data Protection Officer

Reach the DPO at dpo@colport.io. For complaints we cannot resolve, you have the right to lodge a complaint with your national supervisory authority (in the Netherlands: Autoriteit Persoonsgegevens).

The formal, signed privacy notice PDF is available on request from your account manager and is auto-delivered during procurement.

Want to see the full sub-processor list?

The trust center names every service that may receive personal data, what it receives, where, and when.

Request a demo