Documented instructions only
We process personal data only on your written instructions, captured in the MSA + platform configuration. Any expanded scope requires a new written instruction.
Data Processing Agreement
Your DPO's cheat sheet
This page summarises the Data Processing Agreement (DPA) that ColPort signs with every customer under Article 28 of the GDPR. The formal, signed DPA is attached to every order form. Share it with your DPO before procurement closes so their questions land early.
Last updated: 21 April 2026 · DPA Version 2.4 · SCC 2021/914 attached
Last updated: 21 April 2026 · DPA Version 2.4 · SCC 2021/914 attached
The roles
Controller + Processor, no ambiguity
You (the customer) are the Data Controller. You decide what learning data is collected, why, and who sees it. ColPort B.V. is the Data Processor — we handle personal data strictly on your documented instructions. Inn experts engaged through the platform are your sub-processors for the duration of their engagement (ColPort facilitates the DPA flow-through).
Core obligations
What we commit to do
Purpose limitation
Learner data is used exclusively to deliver the services under your subscription. We never use it to train third-party AI, enrich ad networks, or build competing products.
Confidentiality
Every ColPort employee and contractor with data access signs a confidentiality agreement. Access is least-privilege, time-limited, and auditable via the hash-chained log.
Cooperation with your obligations
We help you respond to data-subject requests, regulator queries, and DPIAs. Response turnaround is bound by the DPA, typically 72 hours for substantive replies.
Security measures
Annex II, technical + organisational measures (TOMs)
Encryption at rest + in transit
AES-256 encryption for data at rest. TLS 1.3 for data in transit. Phone numbers encrypted with a separate key and never stored in plaintext anywhere, including logs.
Access control
Row-Level Security enforced at the database layer on every table. Multi-factor authentication required for all admin and engineering roles. SSH access via short-lived certificates only.
Resilience + recovery
Daily encrypted backups retained 30 days. Quarterly restore drills. Multi-AZ database replication. RTO: 4 hours. RPO: 15 minutes.
Pen-testing + audits
Annual third-party penetration test. SOC 2 Type II attestation (annual). ISO/IEC 27001 certification in progress (target Q3 2026). All audit reports available under NDA.
Sub-processors
Annex III, authorised sub-processors
The full list is at /trust. Summary: every sub-processor sits in the EU (primary region) or an adequate third country under GDPR Art. 45; each has signed a DPA with ColPort; every sub-processor addition triggers a 30-day notice to customers with a right to object.
Primary data residency
Frankfurt (Germany) on Supabase. Backend workers on Hetzner EU. Edge CDN via Vercel EU. All sub-processors EU-hosted by default; US region available on request for North American customers under SCC 2021/914.
Added or removed, always notified
The trust center RSS feed announces every sub-processor change 30 days before it takes effect. Object within the 30-day window and we work with you on alternatives.
Breach notification
What happens if something goes wrong
You’re notified in 24 hours
Personal data breach affecting your tenant → email + phone notification to your designated DPO contact within 24 hours of confirmation. Well under the 72-hour GDPR ceiling.
Full post-mortem in 14 days
Documented root cause, scope, remediation, and preventive actions. Ready for onward notification to the supervisory authority and affected data subjects.
Cooperation with your response
We share evidence, hash-chain log excerpts, and engineering-level access to support your investigation. We don’t hide behind the Processor label.
International transfers
SCC 2021/914 + TIA + supplementary measures
Where EU personal data leaves the EU (e.g. a US-region request for North American customers), we rely on the European Commission’s Standard Contractual Clauses 2021/914 + a documented Transfer Impact Assessment + supplementary technical measures (encryption, access limitations, pseudonymisation). The full TIA is attached to every DPA that covers non-EU transfers.
Need the signed DPA for procurement?
Ask your account manager or email dpo@colport.io, we turn around signed copies within one business day.
Request a demo