Data Processing Agreement
v1.0 · effective 2026-04-27
This Data Processing Agreement (“DPA”) forms part of the agreement between the customer organisation (“Controller”) and ColPort Mill BV (“Processor”) governing the provision of the Mill course-authoring service. It reflects Article 28 of Regulation (EU) 2016/679 (“GDPR”).
1. Subject matter and duration
Mill processes personal data on behalf of the Controller solely to deliver the Service: course authoring, learner authentication, SCORM-package generation, translation, and audit logging. Processing duration matches the Controller’s subscription term.
2. Categories of data
- Author identity: name, email, organisation membership.
- Learner identity (when SSO/SCIM is configured): name, email, role.
- Learner progress: course completion, quiz attempts, xAPI statements.
- Source content uploaded for course generation (documents, transcripts).
3. Sub-processors
Mill engages the sub-processors listed below. Most process entirely within the EU. Where a sub-processor processes outside the EEA, or on a global endpoint that carries no region, the region column says so and the transfer runs under Standard Contractual Clauses signed with that provider.
Model providers receive the prompt and the source content you supply. We do not send them account records, learner names, or learner results.
| Sub-processor | Purpose | Region |
|---|---|---|
| Hetzner Online GmbH | Hosting, database, and object storage | Nuremberg, DE |
| Anthropic (EU endpoint) | Architect, content writer, translation and drift checking | EU inference |
| Section images (Gemini), voice narration (Cloud Text-to-Speech), translation | Global API endpoints — no region is set on the request | |
| Mistral AI SA | Outline and section writing; voice narration when Voxtral TTS is selectedWhen EU AI is on, or a Mistral key is connected | Paris, FR |
| Black Forest Labs GmbH (FLUX) | Section image generationWhen EU AI is on, or FLUX is the configured image provider | Freiburg, DE — requests pinned to the EU API host |
| Operator-configured speech endpoint | Voice narration when EU AI is onWhen EU AI is on and an EU speech endpoint is configured | Wherever the operator points EU_TTS_BASE_URL — Mill does not fix it |
| OpenAI | Text generation and narration on a customer-supplied keyOnly when a customer connects their own OpenAI or Azure OpenAI key | US, unless the customer's endpoint is elsewhere |
| DeepL SE | TranslationWhen a DeepL key is configured | Cologne, DE |
| HeyGen | AI avatar video renderingOnly when the avatar feature is used | US |
| D-ID | AI avatar video rendering (alternative adapter)Only when the avatar feature is used with the D-ID adapter | Outside the EEA |
| Scaleway | Object storage for rendered video and, once the project format ships, learner-submitted filesWhen Scaleway storage credentials are configured | Amsterdam, NL |
| OVH | Write-once evidence storageWhen WORM retention is configured | Gravelines, FR |
| Stripe Payments Europe | Billing | IE |
| Resend | Transactional email | EU / US |
| Upstash | Rate limiting (anonymised counters) | EU edge |
| Cloudflare | Turnstile bot protection at sign-up | Global edge |
4. Technical and organisational measures
- Encryption in transit (TLS 1.2+) and at rest (AES-256).
- Per-org KMS-managed data encryption keys with rotation API.
- Role-based access control with audit-logged admin actions.
- Backups in EU only, encrypted, 30-day retention.
- Annual penetration test + quarterly vulnerability scan.
5. Data-subject rights
Mill assists the Controller in fulfilling Articles 15–22 GDPR. Export + deletion endpoints are available at /account/data-export and /account/data-delete. Erasure SLA: 30 days from verified request.
6. Breach notification
Mill notifies the Controller without undue delay (and in any event within 72 hours of becoming aware) of a personal-data breach affecting Controller data, including a description of the categories and approximate number of data subjects + records concerned.
7. Audits
Mill is pursuing SOC 2 readiness; an attestation is not yet available. Customers requiring formal audit evidence today can request our security questionnaire responses and architecture documentation under NDA. For regulatory requirements beyond what a SOC 2 readiness package covers, on-site audits can be arranged with 30 days’ notice and a reasonable scope agreement.
For DPA negotiation contact: dpa@colport.eu