Who we are and how to contact us

Copperpot d.o.o., Podsusedska Aleja 55, Zagreb, Croatia, Croatian personal identification number (OIB) 15535509542, is the controller for the processing described in this policy. We provide software sales, support, eLearning production and training services, including services relating to Articulate and Vyond products.

Our contact for privacy matters is Branimir Trošić. You can send questions or requests concerning personal data to btrosic@copperpot.eu or to our postal address above. This policy is available at https://copperpot.odoo.com/privacy-1.

When we process learners’ data or project materials solely on a client organisation’s instructions, that organisation is the controller and Copperpot acts as its processor. The client’s privacy notice and our data processing agreement govern that activity. Please direct requests about such data to the client; we will assist it in responding. 

What data we collect and its sources

Business contacts and transactions. We process names, business email addresses, telephone numbers, organisation names, job roles, countries, communication languages, customer and billing details, and information about enquiries, quotations, purchases, licences, renewals, trial dates and trial status.

Communications and events. We process enquiries, replies, attachments, meeting and webinar registrations, attendance details, and available message sending, delivery and read information. Marketing email statistics may include opens and link clicks, as explained below.

eLearning and recruitment. Depending on the service or project, we may process learner names and contact details, participation and learning results, and photographs, voice recordings and video recordings supplied or created for agreed project purposes. For recruitment, we process contact details, CVs, application materials, qualifications, experience and interview notes.

Website and technical data. Our website and hosting systems process IP addresses, browser and device information, access times, requested pages, referral information, language preferences and cookie choices. Website analytics are explained in section 9.

We receive data directly from you, from your organisation or an authorised contact, and from Articulate and Vyond through our partnership arrangements. Partner referrals may include contact details, product interests, trial information and records of marketing consent. We use those records only within the scope of the permission given. Where we receive data indirectly, we provide the relevant information at first contact, before disclosure where required, and in any event within the applicable GDPR deadline, normally one month.

Please do not provide sensitive personal data that is unnecessary for the relevant request or project. We do not seek such data for routine sales and marketing activities. 

Purposes and legal bases

We process personal data under the General Data Protection Regulation (GDPR). The legal basis depends on the purpose and your relationship with us.

Enquiries, demonstrations and trials. We use contact and product information to answer questions, prepare quotations and organise requested demonstrations and trial access. The basis is taking steps at your request before entering into a contract, under Article 6(1)(b), where you are the prospective contracting party. For representatives of organisations, we rely on our legitimate interest in responding to business enquiries and managing business relationships, under Article 6(1)(f).

Sales, licence delivery, renewals and support. We process the information needed to fulfil orders, activate and renew licences, provide services and resolve support requests. The basis is contractual necessity under Article 6(1)(b), or our legitimate interest in delivering services to the organisation you represent under Article 6(1)(f).

Webinars and training. We use registration and participation details to organise the requested event, provide access, communicate practical information and deliver agreed learning services. The basis is Article 6(1)(b), or Article 6(1)(f) for arrangements made through your organisation. Registering for an event does not automatically subscribe you to unrelated marketing.

Accounting and legal requirements. We process invoices and financial records to meet our legal obligations under Article 6(1)(c). We retain necessary evidence and handle disputes on the basis of our legitimate interest in establishing, exercising or defending legal claims under Article 6(1)(f).

Marketing and optional tracking. We use consent under Article 6(1)(a) where required for newsletters, promotional email and WhatsApp campaigns, optional website cookies and associated tracking. We rely on a statutory exception for electronic marketing only where its specific conditions are met. We do not treat a partner referral, trial request or acceptance of this policy as unrestricted marketing consent.

Recruitment. We process applications to assess suitability and take steps towards an employment contract under Article 6(1)(b). Limited retention after the process is based on our legitimate interest in documenting recruitment and handling potential claims under Article 6(1)(f).

Security and administration. We use necessary technical records, access controls and business correspondence to protect systems and operate our business under Article 6(1)(f). Where we rely on legitimate interests, we assess necessity and the impact on individuals’ rights. You may ask for information about the relevant assessment.

Providing information needed for an order, invoice, application or requested service may be a contractual or legal requirement. If you do not provide it, we may be unable to fulfil the relevant request. Marketing consent is optional and is not a condition of purchasing a product or receiving support. 

Email and WhatsApp communications

We use Odoo to manage enquiries, customer relationships, messages and campaigns, and Google Workspace for business email and collaboration. WhatsApp Business is connected to Odoo. When you communicate with us through WhatsApp, your telephone number, message content, attachments and associated technical data are processed through the systems involved in that service.

Our communications include replies, support, quotations, trial-related messages, renewal reminders and, where permitted, promotional campaigns. We distinguish requested service communications from marketing. You can opt out of marketing through the unsubscribe link in an email, by replying “STOP” on WhatsApp, or by writing to btrosic@copperpot.eu. An opt-out does not prevent necessary communications about an existing order or service.

Our marketing emails use tracking pixels and tracked links to report whether messages were opened and which links were clicked. These records can be associated with the recipient and used to assess campaign performance and the relevance of follow-up communications. Where consent is required for this tracking, it is used only with that consent. You can contact us to withdraw tracking consent or request communication without marketing tracking. Blocking external images may prevent open tracking, but does not necessarily prevent click tracking.

Messages and internal tasks may be scheduled according to the product, enquiry stage or trial date. We do not make decisions based solely on automated processing that produce legal or similarly significant effects, and we do not use AI to analyse personal data or assess individuals in these processes. 

Meetings and eLearning projects

We use Microsoft Teams, Google Meet and Zoom for meetings, demonstrations, webinars and training. The data involved may include your name, email address, attendance, chat messages, audio and video you choose to share. A meeting is not recorded merely because one of these services is used. Where recording is planned, we inform participants in advance and explain its purpose and applicable basis, obtaining consent where required.

Photographs, voices and recordings used in eLearning materials are processed for the agreed project. Where we determine the purpose, we obtain consent for identifiable promotional or other optional publication where required. Where we work on a client’s instructions, the client determines the lawful basis, authorised audience and retention instructions. We do not reuse client learner data or project recordings for unrelated marketing. 

Who receives personal data

Within Copperpot, access is restricted to our two authorised team members, according to their responsibilities. External recipients receive only data needed for their role.

Our main providers and recipients are Odoo for website hosting, business records, CRM and communications; Google for Workspace, Meet and website analytics; Meta and WhatsApp for business messaging; Microsoft for Teams; Zoom for videoconferencing; and IRVI d.o.o. for accounting. These providers may use authorised subprocessors under their applicable terms.

Articulate and Vyond receive information needed for the relevant trial, licence, quotation, activation, renewal or support request. They also act as separate controllers for their own customer, account and product operations. Their privacy notices explain those activities: https://www.articulate.com/trust/privacy/ and https://www.vyond.com/privacy/.

Providers processing data on our instructions act as processors under applicable data processing terms. Certain providers also act as separate controllers for their own security, legal or service administration purposes. Public authorities and professional advisers may receive information where a legal obligation, a dispute or an appropriate professional engagement requires it. 

Storage locations and international transfers

We use EU-region hosting for our Odoo Online database and Google Workspace data. Regional storage commitments apply to the data and services covered by each provider’s terms; they do not mean that every support operation, technical record, backup or third-party service is confined to the EU.

Articulate, Vyond, WhatsApp and international meeting providers may process data in the United States and other countries where they or their authorised subprocessors operate. Odoo and Google may also involve authorised international support or subprocessors, subject to their contractual safeguards. For example, Vyond identifies support operations in Hong Kong, Taiwan, Thailand and Singapore in addition to its US operations.

Where a transfer outside the European Economic Area requires safeguards, we rely on the applicable provider’s GDPR transfer arrangements: an applicable European Commission adequacy decision, including the EU–US Data Privacy Framework only where the recipient’s valid certification covers the transfer, or European Commission standard contractual clauses with supplementary measures where necessary. Odoo’s terms address international subsidiary access through standard contractual clauses; Google, WhatsApp, Articulate, Vyond, Microsoft and Zoom publish their relevant transfer terms and safeguards.

You can request information about the safeguards applicable to your data, including how to obtain a copy of relevant contractual safeguards, at btrosic@copperpot.eu. Disclosed documents may be redacted to protect confidential information without removing the substance of the safeguards. 

How long we retain data

We apply the following retention schedule to data for which Copperpot is the controller. If a record serves more than one purpose, we retain only what remains necessary for an applicable purpose. Expired data is deleted or anonymised as part of our regular retention reviews.

Enquiries, prospects and trials without a sale: up to two years after the last meaningful interaction or the end of the trial, whichever is later. Passive email-open records alone do not extend this period.

Customer and licence administration records: throughout the business relationship and for five years after it ends, to manage contractual matters and legal claims. Invoice and other statutory accounting records follow the separate period below.

Support requests and ordinary service correspondence: up to three years after the request is closed. Necessary evidence of contractual performance or a dispute may instead be kept under the customer-record or legal-hold rules.

Invoices and supporting accounting documents: 11 years from the last day of the financial year to which the relevant accounting records relate, or longer where a specific legal requirement or proceeding requires it.

Webinar registrations, attendance records and meeting recordings: up to 12 months after the event, unless the recording forms part of an agreed deliverable or separate publication permission specifies another period. Data retained for a separately permitted customer or marketing relationship follows the relevant period for that purpose.

eLearning project materials for which we are the controller: working files containing personal data are retained for up to six months after final acceptance, and final deliverables for up to two years after delivery or throughout an agreed ongoing support period, whichever is longer. Where we are the processor, the client’s documented return and deletion instructions apply instead.

Marketing contact lists: until consent is withdrawn or you object, or for up to two years without a meaningful interaction, whichever occurs first. Recipient-level email-open and click records are retained for up to 12 months. We retain necessary consent and opt-out evidence for five years after the last relevant marketing communication or withdrawal, whichever is later, to demonstrate compliance. A minimal suppression record is kept while we operate the relevant marketing channel and need it to prevent renewed contact; its necessity is reviewed annually.

Job applications: up to 12 months after the recruitment process ends. If you are hired, information required for employment is transferred to the personnel record and is subject to the applicable employment retention requirements.

Technical and security logs under our control: up to 12 months, unless a specific security incident or legal requirement justifies a longer period. Google Analytics user-level and event-level data is retained for no more than 14 months; cookie lifetimes are separate and explained below. Aggregate statistics that no longer identify individuals may be retained longer.

Deleted data may remain in restricted provider backups until the applicable backup cycle expires. For Odoo, this can be up to 12 months. Google’s data processing terms provide a deletion period of up to 180 days once a deletion instruction takes effect, with an additional recovery period of up to 30 days after service termination. Backup copies are not used for ordinary business activity. If data is restored, applicable deletion instructions are reapplied.

Where a legal claim, investigation or preservation obligation requires longer retention, only the relevant records are restricted and retained until the matter is finally resolved and any applicable retention obligation expires. 

Cookies and website statistics

Our website uses Odoo cookies and similar technologies to maintain sessions, support security, remember language and time-zone preferences and record cookie choices. The cookie banner allows you to accept optional cookies or choose “Only essentials”. Optional cookie-based analytics require consent; refusing them does not prevent you from submitting an enquiry.

The principal cookies include session_id, an Odoo session and security cookie normally lasting up to seven days; frontend_lang, which remembers language for up to one year; tz, which stores the time zone for the browser session; and website_cookies_bar, which records the banner choice for up to 999 days, subject to browser limits and earlier deletion. These technologies support requested functions, preferences and consent management.

Google Analytics 4 is configured to measure website visits and interactions when optional cookies are accepted. It uses information such as page views, referrals, device characteristics and online identifiers. Its _ga and _ga_<identifier> cookies normally expire after two years, although browser restrictions or deletion may shorten their lifetime. Google receives technical information when the service loads. See https://policies.google.com/technologies/partner-sites for Google’s explanation of its processing.

Our Odoo-hosted Plausible integration also provides aggregate website statistics, such as visited pages, referral sources and device categories, without using tracking cookies. Where technical data involved in these limited statistics constitutes personal data, our basis is our legitimate interest in understanding site use without individual cross-site tracking.

You can change your choice using the website’s cookie settings control. You can also delete this site’s cookies in your browser and revisit the site to display the banner again, then select “Only essentials”. Browser settings can block or delete cookies, but blocking necessary cookies may affect functionality. Withdrawing consent does not affect processing already lawfully performed. 

How we protect data

We use individual accounts, restricted access rights, two-factor authentication, protected connections and backups appropriate to our systems. Access is limited according to responsibilities, and external processing is governed by the applicable service and data protection terms. We review access when responsibilities change. No technical system can guarantee absolute security. 

Your rights

Subject to the conditions and exceptions in the GDPR, you may request access to and a copy of your personal data, correction of inaccurate data, erasure, and restriction of processing. You may request data portability where processing is based on consent or a contract and is carried out by automated means.

You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing at any time, without having to give a reason, and we will stop processing for that purpose. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal. Some data may still need to be retained to meet legal obligations or handle legal claims.

Send requests to btrosic@copperpot.eu. We respond without undue delay and normally within one month. If complexity or the number of requests justifies an extension of up to two further months, we inform you within the first month and explain why. We may request proportionate additional information where reasonably needed to verify identity. Requests are normally free; any legally permitted fee or refusal will be explained.

You can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), https://azop.hr/, or another competent supervisory authority. You do not have to contact us first. For data processed solely on a client’s behalf, please contact that client as controller; we will assist it as required. 

Children and changes to this policy

Our services are directed at businesses and adult users. We do not knowingly collect or process children’s personal data. If you believe a child’s data has been provided to us, please contact btrosic@copperpot.eu so that we can investigate and take appropriate action.

We update this policy when our activities, providers or applicable requirements change. The current version is published at https://copperpot.odoo.com/privacy-1 with the date of the latest update. We communicate material changes through appropriate channels and obtain new consent where required.