1. Who we are
ESN Porto (Erasmus Student Network Porto) is the organisation responsible for your data, or in legal terms, the data controller.
- Full legal name: Associação Erasmus Student Network Porto
- Address: Rua de Olivença 27, 4000-369 Porto, Portugal
- Tax number (NIF): 509 935 303
- Contact for anything about your data: info@esnporto.org
ESN Porto is a local section of the Erasmus Student Network. We are run by student volunteers.
2. What data we collect
Data you give us
When you create an account in the ESN Porto member app, buy a ticket for an event, or order from our merch store, we collect:
| Data | Where it comes from |
|---|---|
| Name | your account and event registrations |
| Email address | your account |
| Phone number | your profile |
| Date of birth | your profile and event registrations |
| Address | your profile |
| Nationality and country | your profile |
| Gender | your profile |
| Passport or identity document number | required when buying event tickets |
| Tax number (NIF/VAT) | required for invoicing |
| University and study programme | your profile |
| ESNcard number and expiry date | your profile |
| Profile picture | if you upload one |
Data we receive from Eventupp
We use Eventupp as our event and ticketing platform. When you register for an ESN Porto event through Eventupp, we receive a copy of your registration and purchase data: name, email, phone, date of birth, nationality, ESNcard, university, programme, and the events you bought tickets for, including prices.
We keep this copy in our own database so the member app can show you your tickets quickly without querying Eventupp every time. We are responsible for that copy, and this policy covers it.
Data collected automatically
- When you are signed in: a session cookie that keeps you logged in.
- If you enable notifications: the technical address your browser uses to receive push messages.
- If you join our Telegram community: your Telegram username, linked to your ESNcard.
3. Why we use your data, and on what legal basis
| What we do | Why | Legal basis |
|---|---|---|
| Run your member account | so you can sign in and use member features | performance of a contract (your membership) |
| Sell and manage event tickets | so you can attend our events | performance of a contract |
| Validate your ESNcard | to confirm you are entitled to member benefits | performance of a contract |
| Pass your details to esncard.org so you can use partner discounts (for example Ryanair and FlixBus) | because those partners require identification to grant the discount | performance of a contract |
| Issue invoices and keep accounting records | because the law requires it | legal obligation |
| Send you transactional emails (password resets, order confirmations, event reminders) | so the service works | performance of a contract |
| Send you push notifications | to tell you about events | consent (you can turn it off at any time) |
| Run the Telegram community | to let ESNcard holders join | consent |
| Keep statistics about our events and community | to understand what we do and improve it | legitimate interest |
4. Who else sees your data
We do not sell your data. We share it only where it is necessary:
- Eventupp: our events and ticketing platform. Your registration and payment data is processed there. [to be confirmed]
- esncard.org and the Erasmus Student Network: to validate your ESNcard and let you use network-wide partner discounts.
- Payment providers: card payments in the member app are handled by Stripe. We never see or store your card number.
- Our own infrastructure: our database runs on a server we control, not on a third-party cloud database service.
- Our volunteers: ESN Porto volunteers with an administrative role in the app can see member profiles in order to do their work (for example, checking ESNcard validity or managing an event). They are bound to keep what they see confidential.
- Authorities: if we are legally required to.
- Analytics providers: see the Cookie Policy. These are only activated if you consent.
5. How long we keep it
Our rule is that personal data is anonymised after five years. We strip out the details that identify you and keep only anonymous statistics about our events.
Two exceptions:
- Invoicing and accounting records must be kept for [to be confirmed], because tax law requires it. We cannot delete these earlier, even if you ask.
- You can ask us to delete your data sooner (see section 6).
If you ask to be deleted, we remove your identifying data everywhere except the accounting records described above.
6. Your rights
Under the GDPR you can ask us to:
- See the data we hold about you
- Correct anything wrong (you can also edit most of it yourself in your profile)
- Delete your data, subject to the invoicing exception above
- Restrict or object to how we use it
- Receive a copy in a portable format
- Withdraw consent at any time, where we relied on consent (this does not affect anything we did before you withdrew it)
How to ask: write to info@esnporto.org. We will answer within 30 days. The person responsible for handling these requests is the President of ESN Porto.
If you are not happy with our answer, you can complain to the Portuguese data protection authority, the CNPD (www.cnpd.pt).
7. Where your data goes
Our servers are in the European Union. Eventupp and esncard.org operate within the EU.
If you consent to analytics on our website, some data is transferred to Google in the United States under the EU–US Data Privacy Framework. You can refuse this without losing access to anything.
8. How we protect it
Our database enforces row-level security, meaning each person's data is only readable by that person and by volunteers whose role requires it. Access to our servers is restricted and logged. We review these controls periodically and fix what we find.
We cannot promise that no system is ever breached. If a breach happens that puts you at risk, we will tell you.
9. Children
Our services are for university students and are not directed at children under 16. We do not knowingly collect data from them.
10. Changes to this policy
If we change this policy we will update the date at the top. If the change is significant, we will tell you in the app.
For the cookies and similar technologies we use, see our Cookie Policy.